1/ One of the problems with hacking is that you are always certain you are going it in the sub-optimal, least elegant fashion.
Such is the case in my examination of those disk images from the Mesa County election computer. A natural question is to grab password hashes.
Such is the case in my examination of those disk images from the Mesa County election computer. A natural question is to grab password hashes.
2/ The standard free utility for examining a disk image is "Autopsy". There are more expensive commercial offerings. Autopsy has a lot of really cool plugins. I assume it would have one for password hashes, but I can't find one.
3/ So I do it the inelegant way. I simply go through the filesystem and extract the SAM, SECURITY, and SYSTEM registry "hives" (aka. files in registry format). 
4/ I then run those files through one of many possible tools that can extract the password hashes, and get the hashes (aka. "encrypted form of the passwords" (sic)).
5/ I then run through "hashcast", using "mutated dictionary" attacks. It doesn't find anything except the the "Guest" accounts have an empty password (google 31D6CFE0D16AE931B73C59D7E0C089C0 and see for yourself).
6/ I'm not skilled cracking passwords. I do the standard thing (mutated dictionary), because it almost always succeeds quickly. I don't have practice at cracking tough nuts when the simple/obvious approach fails.
7/ So as it turns out, there was a better way. It turns out the password for a lot of the accounts was "Colorado2019!!!"
https://twitter.com/passingthehash/status/1440080114939617290
• • •
Missing some Tweet in this thread? You can try to
force a refresh
