3 ms·

I used knoppix (and later SLAX) in high school to reboot shared computers (library, labs, etc) and then extract the SAM file from the C:\ drive. I would shuttle

I used knoppix (and later SLAX) in high school to reboot shared computers (library, labs, etc) and then extract the SAM file from the C:\ drive. I would shuttle the file home on a USB stick and crack it overnight. After doing this on a handful of computers I ended up having virtually every teacher/admin password in the school, including the domain admin which was no shit all lowercase "north". The crack was so fast for weeks I thought it was a mistake and never even attempted to use it. The most interesting thing was the patterns you could see with various teachers and pw reset policies. Some had themes like seasonal, others would take the current month and tack-on a number. I ended up getting expelled for using that domain admin account to poke around. Had to transfer to a different school and was perma-banned from touching a computer for the rest of my time there. It ended up being a blessing in disguise, I had a lot more fun and grew up a lot at the other, larger high school. I still recall my guidance counselor helping me setup my classes for senior year... "ok, yeah and we'll put you in programming for your elective... OH WAIT... you aren't allowed to be anywhere near a computer, ceramics it is". Ceramics ended up being a blast!

protocolture 4mo ago
I built a fake Novell login screen using VB6, it would save the users credentials to disk in plaintext, and then reboot, presenting the correct login screen which would work. I ended up scraping a whole bunch of credentials, even teacher creds, but they were always permissioned. Math teacher had a single folder where math stuff was dumped but couldn't escape that. One day we were sitting in one of the computer labs, and written on the board was just: U: training P: training with no effort having been made to erase it. That turned out to be effectively complete teacher level access. They couldn't decide what to do with a bunch of student teachers so just gave them unnamed creds with access to all subjects. And they left the account active for 12 months after the training program. By then, we had scavved up the credentials of a teacher who had been at the school since its inception, and thus had done every job and had the same sort of teacher god rights. His password was just redrocket or something silly. I had exams, exam answers, notes on student performance, basically everything possible for 3 years. I am so glad there was no logging or anything sensible or I would have been expelled too.
totetsu 4mo ago
Did you have to pretend a terminal was broken and call the domain admin or teacher over to log into it to get their credentials cached locally in that file in the first place?

protocolture 4mo ago

I built a fake Novell login screen using VB6, it would save the users credentials to disk in plaintext, and then reboot, presenting the correct login screen which would work. I ended up scraping a whole bunch of credentials, even teacher creds, but they were always permissioned. Math teacher had a single folder where math stuff was dumped but couldn't escape that. One day we were sitting in one of the computer labs, and written on the board was just: U: training P: training with no effort having been made to erase it. That turned out to be effectively complete teacher level access. They couldn't decide what to do with a bunch of student teachers so just gave them unnamed creds with access to all subjects. And they left the account active for 12 months after the training program. By then, we had scavved up the credentials of a teacher who had been at the school since its inception, and thus had done every job and had the same sort of teacher god rights. His password was just redrocket or something silly. I had exams, exam answers, notes on student performance, basically everything possible for 3 years. I am so glad there was no logging or anything sensible or I would have been expelled too.

totetsu 4mo ago

Did you have to pretend a terminal was broken and call the domain admin or teacher over to log into it to get their credentials cached locally in that file in the first place?