We've acquired a hard drive, whether it's the old spinny kind or an SSD, and we've taken it back to
our layer. Now we can clone it, which is the preferred method of me, because that way I could
take the original and put it back in place without nobody being none the wiser. Hopefully I get it
back in time. But by doing that clone, I have a backup or a copy of it that I also will forensically
hash to make sure it's the original to go through and work on it at my leisure. So while I'm doing
other pen testing activities across the network or wherever it may be, I can take that hard drive
and put it on a different system and either boot it into a physical system or into a virtual
environment because you can boot hard drives into something like VMware. Now by doing so,
we'll cover that in the next portion of this skill when we start getting into BIOS versus UEFI.
But let's say, for instance, we're not dealing with that just yet and we have the hard drive
in a virtualized environment, either by physically connecting it to our system and saying, hey,
virtual environment like VMware, boot to that physical device, or we've made an image of the
actual hard drive and we're using it as like a VMDK or something like that. Well, in our lab,
we're going to take a look at our systems. Let me swap over for a second. And you can see here,
this is the Hyper-V manager. This is what controls all the different systems that we use in our labs
for the different operating systems. Now, for the sake of argument, we're going to make our actual
Hyper-V adept learning lab here, our system at home, where we're using the actual stolen
or acquired hard drives. You may be wondering, at what point do we actually start getting into
the actual password attacks? I'm glad you asked, because there's two different ways we're going to
do this, and I'm going to use Windows and Ubuntu as an example. Now, below this video, I have a
link to something called Hiren Boot CD, and that is a software tool that a lot of pen testers keep
in their pockets, like I keep it on my Lego USB. Look back in previous skills for that one.
And I can boot from that into an actual system, whether it be Windows, POSIX-based,
whatever the case may be, preferably Windows, because it's kind of made and geared towards
Windows. So, all inside of your lab in C drive in a folder called Hiren, I have two copies of Hiren
Boot CD. One of them we're going to be using, the other one is there in case you want to take a look
at it. It's for, the 101 is for systems that don't have at least four gigs of RAM. I know they still
exist. But the Hiren HBCDPE x64 ISO is what we're going to be using for this exercise. And the first
part is going to be against Windows. So, we're going to go inside of our Hyper-V manager inside
of Win10. We're going to right-click and go to settings. Now, the hard drive itself, as I click
on it here, I'm going to zoom in for you. You can see here that it's connected to a virtual hard disk,
Windows10.vhdx. That could be, for the sake of argument in this portion of our skill, the clone
of a physical hard drive that we copied after acquiring it physically inside of an organization
per ROE. So, once this is mounted, you would go to your DVD drive that you see right below the
highlighted blue area. We're going to click on that and go to image file. And we're going to browse
into our C drive, Hiren folder, and we're going to select HBCDPE x64. Now, before we hit apply
and do all that fancy-dancy stuff, we're going to go into the actual firmware and boot. And here,
you will see the actual boot order of the system. This is important because if you just have it set
from boot from file, meaning the UEFI boot manager, it's just going to go straight into
Windows again, but you can select the DVD drive and move it up. So, that way the system,
when you start it up, will boot from that ISO that we just put in there. We're going to hit apply
and okie-dokie. Now, at this point, Windows10 is still running. We would have to restart it. So,
let's open up the actual VM for Windows10 and go into and do a restart. At this point,
after it restarts, it should boot into Hiren boot CD. And you'll notice that it looks ever so
slightly different than the actual Windows10 environment that we have already. Now, this
Hiren is capable of working with Windows11. Ask me how I know later. But it's for, you see there,
it's loading the files, going into the actual boot of Hiren. But primarily, this Hiren version
that we're using is for the more recent versions of Windows. It will work in older ones, but you
may have to run it once or twice in order for some of the tools to take effect. Primarily,
when we start getting into the actual running of this, we're going to be in what's called a live
OS environment, where we have a operating system running in the RAM or memory of a computer system
free of the actual hard drive that's been either put in physically or imported virtually, like a
convert to virtual hard drive. So, as this boots up, I'm going to skip until it's complete. Oh,
never mind. It's already come back up. And you could see that it's also going to do a little
bit of network configuration. You can disable this later on if you want. We're just leaving
everything by default. Now, what I want to show you is, is when you hit start and you go to all
programs, there is a couple of tools in here that you can actually use in order to be able to change
the password on that Windows system. And if I remember correctly, it's under security and
passwords. And there's one right there called NT Password Edit. I'll zoom in for you right there.
And there's a couple of others like Win Login Unlocker, but NT Password Edit is the one that
I generally go to. Now, you'll notice here that it's unpopulated and that's because it's working
off of what it thinks is the C drive right now, which is that live OS running inside the RAM.
You actually have to point this to the hard drive that's attached to the system,
either physically or virtually. And we're going to go in here and,
first, I'll make this bigger and expand it for you.
There we go, local C drive. But you also see that there's a boot X drive. That X drive is the actual
physical hard drive on the system itself. Now, we're looking for the SAM file. In previous skills,
we learned that that's inside of the Windows system 32 folder right there and inside of
config. There you will see the SAM. I bet it actually was C drive. See, this is a newer
version of Hirons and we're learning together. The previous version actually assigned the live
OS to C drive and the other way around. Here, the C drive is the physical hard drive. I wanted to
point that out instead of deleting it because some of you may have used Hirons before, and this is
a good tidbit to know. Once we load the SAM, C drive Windows system 32 config SAM, you can see
here that we have all the user accounts on that Windows 10 system. This is carrying over from
the previous skills as well, and that's why you see Ford Prefect in there also. Of note, it also
has the user IDs for the previous skills. Now, you could select any one of these. We could select
learner and go to change password. What this does is allows you to be able to change the password
and apply it to the SAM itself. It resets it. It doesn't tell you what the password is.
It just allows you to be able to reset it. This is a good bit of information to know because I'm
not going to change this just yet. But now, aside from that, if you did want to do a password dump
and start using something like Hashcat in the previous skill, you're in a live OS. That means
that everything on that physical hard drive is out of that locked state. Meaning that you can
exit out of this, open up my computer or this PC, go into the actual hard drive itself,
find your way into that SAM folder in system32config. There we go. And inside of here,
you could see all the registry hives such as SAM. Well, guess what? You're allowed to copy
that and the system hive for you to be able to import into Kali if you wanted to be able to do
Hashcat. You are now free to float about and be able to do that on this physical system,
which is why I prefer physical access.