标题: [转帖]一个能够导出NT/2000用户密码的工具 [打印本页] 作者: 钉子 时间: 2004-11-26 00:23 标题: [转帖]一个能够导出NT/2000用户密码的工具 CopyPwd Reference Information<br>
<br>
<br>
--------------------------------------------------------------------------------<br>
<br>
Disclaimer: CopyPwd is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Usage of CopyPwd is at the risk of the person or company using this software.<br>
Contents<br>
1. Shameless Product Endorsement<br>
2. Download Location<br>
3. Background Information<br>
4. Usage<br>
--------------------------------------------------------------------------------<br>
<br>
Shameless Product Endorsement<br>
Are you still using the builtin Windows tools for administration of your Windows NT or Windows 2000 network? Why? For 5 years, tens of thousands of system administrators have relied upon 'Hyena' for day-to-day system managements tasks. With over 85 different features, Hyena is the most cost effective tool available for management of Windows NT and Windows 2000 domains.<br>
For more information, visit <a target=_blank href=http://www.systemtools.com/hyena>http://www.systemtools.com/hyena</a><br>
--------------------------------------------------------------------------------<br>
<br>
Download Location<br>
Download CopyPwd from <a target=_blank href=http://www.systemtools.com>http://www.systemtools.com</a> . CopyPwd can be found in the Free Tools section.<br>
Before using, view ALL of the information in this file.<br>
--------------------------------------------------------------------------------<br>
<br>
Background Information<br>
The CopyPwd utility was created for one purpose: to copy user passwords from any Windows NT/2000 domain to one or more user accounts on either the same computer or another Windows NT/2000 domain. There are a lot of potential uses for such a capability: the main ones being domain consolidation/migration and password synchronization.<br>
Security Implications : A number of potential users of this utility have commented that there are some potential security concerns about CopyPwd. In particular, the main concern is that a rogue administrator could use the utility to copy the password of a sensitive account, change the password on the account, logon and use the account using their known password, then set the original password back before anyone knew that it had been changed. This is possible using this utility, but we don't know of any way to prevent this and still have the benefit of this utility's purpose. Plus, the same 'exploit' can be performed by simply cracking the password, which would have the added benefit of not needing to change the original password or changing it back.<br>
The technique used by the CopyPwd to retrieve the password was originally developed by Todd Sabin. More information about his "pwdump" project can be found at <a target=_blank href=http://www.webspan.net/~tas/pwdump2.>http://www.webspan.net/~tas/pwdump2.</a> Mr. Sabin's work was published under a GNU license, meaning that the source code was published with the understanding that any derivative works also will fall under the GNU license. As such, CopyPwd also falls under the GNU license. CopyPwd is a FREE utility. The only work added to Mr. Sabin's original pwdump project was to simply write the password back into any designated account. The source code to CopyPwd can be found in the source.zip file that is part of the CopyPwd archive.<br>
CopyPwd is not the only software available that allows for copying passwords. We believe that the only way to perform password copying is by using the technique developed and published by Mr. Sabin. As far as we know, CopyPwd is the only utility that is both free and open source that performs this function.<br>
The general technique used by CopyPwd to extract and set the password is as follows:<br>
<br>
All user and computer accounts are "dumped", along with the password hash that is used by the account <br>
<br>
The administrator modifies the file created in the previous step to include only the accounts that are needed for copying <br>
<br>
CopyPwd is run a second time in "set" mode, reading the contents of the file created in "dump" mode. For each account in the input file, CopyPwd retrieves the account using the name specified in the file, and sets the password. <br>
<br>
Note that the actual password is not written to the file, but rather the password hash. The actual hash is written to the file in readable hex format, but is converted back into binary before being written back.<br>
Restrictions - CopyPwd must be run on the actual machine that the passwords are being copy from or to. Also, the user running the software must be an administrator, or more precisely, must be logged into an account with administrative rights. Even more precisely, the process that initiates CopyPwd must have sufficient rights, and in particular the SE_DEBUG_NAME privilege.<br>
--------------------------------------------------------------------------------<br>
<br>
Usage<br>
Important: The information stored in the output/input file used by CopyPwd should be treated as extremely sensitive. Although only the usernames and password hashes are written to the file, the hashes should be treated as the actual passwords. Any password cracking software can use the password hash information to crack the password, thereby possibly compromising security. It is recommended that after completion of the CopyPwd process, that the input/output file containing the password hashes be erased, preferably by a security program that can overwrite the file location with zeros or random data.<br>
Installation<br>
To install CopyPwd, simply copy the CopyPwd files into a separate directory on any Windows NT/2000 computer. CopyPwd cannot be run against a remote computer. If passwords are being copied from one set of accounts on one computer to another, then CopyPwd must be installed on both the source and destination computers.<br>
CopyPwd must be run in two stages, first to "dump" the passwords, then to "set" the passwords. <br>
Dumping Passwords<br>
To dump the passwords, issue the command:<br>
CopyPwd DUMP >copypwd.txt<br>
This will place all user/computer accounts and the password hashes on the local computer into a file named "copypwd.txt". Treat this file as extremely sensitive.<br>
The copypwd.txt file can be modified with Notepad. In general, remove any accounts that will not be involved in the copy process, including computer accounts, if necessary. Computer accounts end with a "$", and will be in all capital letters. The user account in the file is separated from the password hash by a colon (:). If using CopyPwd to set passwords, the user account must be changed to match the user account on the destination computer. If the destination computer is running Windows 2000, the lookup and account name match will be based on the Active Directory attribute "SamAccountName". This corresponds to the "Pre-Windows 2000 Logon Name" field as used on the user Properties Account dialog.<br>
Setting Passwords<br>
After performing any modifications as needed as discussed above, run CopyPwd to set the passwords, using the command:<br>
CopyPwd SET<br>
CopyPwd will read the contents of the copypwd.txt file, lookup the user account on the local computer, and set the password as specified in the file. At present, the file must be named copypwd.txt<br>
--------------------------------<br>
下载地址:<a target=_blank href=http://www.systemtools.com/download/copypwd.zip>http://www.systemtools.com/download/copypwd.zip</a><br>
简单说明:<br>
使用的时候,将压缩包解压到某个文件夹中,复制出密码(加密了的)方法如下:<br>
CopyPwd DUMP >copypwd.txt<br>
然后将这个copypwd.txt复制到另一台机器上,将这个程序再复制过去,放在一起.<br>
导出密码时首先要保证用户已经在目标机器上建立,然后再使用<br>
copypwd set<br>
就行.我测试过,在我的机器上是可行的. 作者: ７９００５９ 时间: 2004-11-30 19:10 标题: [转帖]一个能够导出NT/2000用户密码的工具 呵呵是个好东西..作者: bad 时间: 2004-12-1 10:04 标题: [转帖]一个能够导出NT/2000用户密码的工具 支持，我也懒得试了。收藏先作者: arice888 时间: 2005-1-10 11:20 标题: [转帖]一个能够导出NT/2000用户密码的工具 要是能直接看到密碼更好.<br> 作者: azhao 时间: 2005-1-11 08:57 标题: [转帖]一个能够导出NT/2000用户密码的工具 支持作者: rolly 时间: 2005-1-23 17:25 标题: [转帖]一个能够导出NT/2000用户密码的工具 好像不能导出AD里的用户啊!作者: wyl_xp 时间: 2005-1-25 14:53 标题: [转帖]一个能够导出NT/2000用户密码的工具 回6楼的,在AD上,试过了可以导出密码,不过不能在Terminal 中,试过会出错,需要在console desktop.作者: ding2010 时间: 2005-3-19 10:21 标题: [转帖]一个能够导出NT/2000用户密码的工具 好东西，支持！