full-disclosure - Microsoft EFS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <260C8053DAB7FC44BB58A4D6F16CB2C506B6E5@MSXP02.wcbbc.wcbmain.com>
Date: Tue Oct 11 18:31:39 2005
From: Tim.Dyke at worksafebc.com (Dyke, Tim)
Subject: Microsoft EFS

> The DEFAULT recovery agent is the Administrator, on the other hand you
always 
> can to decrypt the data from the userX login like that userX; So crack
the 
> password or overwrite it off-line (the same for the delegated recovery

> agent).

Tom wrote"
be careful:

overwriting the pw offline will work with efs on w2k.
it will not work with winxp/2003: you cant access any efs-data after 
resetting the password offline.

you'll have to crack the usesrs or the admins pw and either logon 
interactively or export their keys to get access to the efs-encrypted
data.

Tom"

Do you know how his will work for a machine that is part of a Domain?
Where there are no Local Users and the Default Recovery Agent is the
"Domain Admin"

I know tht one can always hack the local admin PW, then unjoin the
domain, but where does that leave the machine.
Is there any way to hack the "nounce" PW?

Thanks

Tim

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051011/78adfd2e/attachment.html