We're here in my local virtual machine. We'll be in the lab momentarily but I have Windows XP
pulled up here for a demonstration. The reason we're starting off with Windows XP is because
this is kind of like the baseline template of how modern versions of Windows store and
encrypt passwords on a system. Now there is no password encryption in Windows XP
but what there is, is a lot of hashing and storage default locations that will be familiar
to you later on when we start doing some of our exercises. Now first and foremost we are in the
C drive Windows system 32 config folder and inside of here, let me see if I can zoom in for us real
quick, you can see that we have a SAM file highlighted. Well right below that is the
security file and by their powers combined this is where Windows keeps its locally stored
credentials hashed on the actual local system. The same is true inside of Windows 10 and 11
for modern versions of Windows and the password itself in Windows XP is hashed with a little bit
of salt added to it. We'll be there in a moment but this is where you would get them. Now let's
say for the sake of argument that you've already extracted the SAM and security file because these
are system protected and when you remote into the system or work on it locally you can't just go in
here and delete them or replace them. The system would have a hemorrhage over it. Now on my virtual
Windows 11 you can see that in the same folder addressing and again the code for this is in the
box below that we're pretty much in the same region on the actual Windows system for local
password storage. Now the methodology of how these two actually store the passwords themselves
encrypt and salt and all that stuff is drastically different. XP uses hashing whereas Windows 11 here
you can actually go through and have your passwords encrypted and in XP the shorter the password
the less security that was put on it. These are good tidbits to know based on the type of system
that you're attacking because once you go into the POSIX based world things change rapidly. Inside
of our lab we have the Kali box opened up and on the Windows 10 where our BWAP is at that's Windows
10 and I can't have Windows 11 inside of our depth lab which is why I showed it from my local system
but now we're going to be truly in the lab just FYI. But inside of our Kali box is where we start
to realize that passwords are stored a little bit differently between Windows and non-Windows
based systems. I'm inside of my Kali box inside the terminal and I'll zoom in for you. One thing
that I have here is cat etsy password and I have the locations for this in the code box as well
but the etsy password file is not where all the passwords are stored at that's just a correlation
based on the information of usernames and groupings. So when I go ahead and press enter on
cat that being able to see the whole thing I can zoom in and show you that for instance Kali has
a user id and group of id of 1000 and 1000 and it also shows us the location of the home directory
and the shell that that user uses or prefers or has set as default. Now the actual passwords
themselves are stored in the etsy shadow file and it correlates line by line one to one for
the password to the actual shadow itself. So if line two is our user Kali in the password file
then line two inside of our shadow file is the actual hash of the password itself and I'm going
to type in cat pseudo cat etsy shadow. The reason it has to be pseudo is because that's a protected
file on the system and I'm going to highlight here this real quick and then zoom in for us.
As you can see Kali has a encrypted or excuse me a hashed password that starts off with a
dollar sign and goes all the way through. We'll come back to those dollar signs here in just a
moment but I wanted to show you the correlation of where all these users and passwords are actually
stored at because you need to know where they are first before we can actually start trying to
attack them.