Investigating Windows systems with Linux
Revealing Mozilla
Firefox stores its data in history.dat. The first column contains the date and time information in Unix timestamp format. The third command in Listing 6 converts this to a human-compatible format. Dumphive [12] provides an approach to making the registry on a Windows system more easily readable (Figure 4). The dumphive /mnt/WINNT/system32/config/system system.txt command stores the register in a separate text file, which the investigator can probe using Unix text tools.
Windows Passwords
Access to the system is interesting in its own right, but discovering the user's passwords often opens up other vectors to the investigators, as most users don't bother changing their passwords when they log in to various websites and services. On top of this, passwords give the forensics investigator the ability to log in to a virtualized image system on VMware and to investigate various system logs and files.
In addition to employing brute force attacks and tools like John the Ripper, which use dictionaries or rainbow tables, the Linux admin can turn to other tools such as Bkhive, Samdump2, and Ophcrack [13].
Extracting local passwords from a SAM file is not hard, as used by Windows NT-based operating systems, especially if you combine various tools. For example, John the Ripper automatically detects a Windows SAM file if you feed it to the tool. The Microsoft-specific password genus is useful here: Although Windows credentials can be up to 14 characters, the system splits them into two strings of seven characters each. This is a useful contribution by the manufacturer that makes it easier for investigators to break passwords without extreme number crunching.
As of Windows Vista, Microsoft closed this gap and replaced the Lanmanager hashes with NT hashes. XP admins can set this up manually; investigators on Linux have to run dumphive to check whether the Registry contains an entry that sets HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Lsa to 1. If so, your only option might be to open your wallet and buy an 8.5GB dual-layer DVD with commercial LM or NT Rainbow Tables.
Like the other tools referred to in this article, Ophcrack is included in the Debian repositories. The Ophcrack utility requires rainbow tables and the hashes from the Windows machine. After completing the install, the investigator can work conveniently with the GUI and just double-click to decipher a user's password (Figure 5).
Domain Controllers
A different approach is required for Windows systems that log in to domain controllers; in this case, the credentials are not stored locally on the client. However, in many cases it is sufficient to run a network sniffer to capture the login exchange, identify the relevant data packets, save them to a file, and then feed a dump to Ophcrack. Of course, this is more complex, and you do need live access to the network.
« Previous 1 2 3 4 Next »
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Canonical Bumps LTS Support to 12 years
If you're worried that your Ubuntu LTS release won't be supported long enough to last, Canonical has a surprise for you in the form of 12 years of security coverage.
-
Fedora 40 Beta Released Soon
With the official release of Fedora 40 coming in April, it's almost time to download the beta and see what's new.
-
New Pentesting Distribution to Compete with Kali Linux
SnoopGod is now available for your testing needs
-
Juno Computers Launches Another Linux Laptop
If you're looking for a powerhouse laptop that runs Ubuntu, the Juno Computers Neptune 17 v6 should be on your radar.
-
ZorinOS 17.1 Released, Includes Improved Windows App Support
If you need or desire to run Windows applications on Linux, there's one distribution intent on making that easier for you and its new release further improves that feature.
-
Linux Market Share Surpasses 4% for the First Time
Look out Windows and macOS, Linux is on the rise and has even topped ChromeOS to become the fourth most widely used OS around the globe.
-
KDE’s Plasma 6 Officially Available
KDE’s Plasma 6.0 "Megarelease" has happened, and it's brimming with new features, polish, and performance.
-
Latest Version of Tails Unleashed
Tails 6.0 is based on Debian 12 and includes GNOME 43.
-
KDE Announces New Slimbook V with Plenty of Power and KDE’s Plasma 6
If you're a fan of KDE Plasma, you'll be thrilled to hear they've announced a new Slimbook with an AMD CPU and the latest version of KDE Plasma desktop.
-
Monthly Sponsorship Includes Early Access to elementary OS 8
If you want to get a glimpse of what's in the pipeline for elementary OS 8, just set up a monthly sponsorship to help fund its continued existence.