Step 1: Extract Hashes from Windows

Security Account Manager (SAM) is a database file in Windows 10/8/7/XP that stores user passwords in encrypted form, which could be located in the following directory:
C:\Windows\system32\config

The first thing we need to do is grab the password hashes from the SAM file. Just download the freeware PwDump7 and unzip it on your local PC.

Open a Command Prompt. Navigate to the folder where you extract the PwDump7 app, and then type the following command:
PwDump7.exe > d:\hash.txt

Once you press Enter, PwDump7 will grab the password hashes from your current system and save it into the file d:\hash.txt.

Step 2: Cracking Passwords with John the Ripper

As you can see the password hashes are still unreadable, and we need to crack them using John the Ripper. John the Ripper is one of the most popular password cracking tools available that can run on Windows, Linux and Mac OS X.

Just download the Windows binaries of John the Ripper, and unzip it.

Open a Command Prompt and change into the directory where John the Ripper is located, then type:
john --format=LM d:\hash.txt

It will start cracking your Windows password. In my example, you can clearly see that John the Ripper has cracked the password within matter of seconds.

Final Words

John the Ripper is probably the world’s best known password cracking tool. But its lack of a GUI interface makes a bit more challenging to use. Don’t use it for illegal purposes.

How to Recover Windows Password with Cain & Abel?

Forgot your administrator password and can’t log in? Cain & Abel needs to be installed, so you must have another working computer to recover your password. First of all, remove the hard drive from your locked machine and then attach it to a working computer as a secondary drive. Then follow these steps to recover Windows password:

1. Visit the Cain & Abel website and download the Windows NT/2000/XP version of the program. Install the program on your computer. During installation, you’ll also be prompted to install WinPcap, which is fine.
2. Click on the “Tools” menu and select “Syskey Decoder”. On the Syskey Decoder dialog, click on the “…” button to locate the SYSTEM file of your locked Windows installation. By default, the SYSTEM file is located in C:\Windows\System32\Config. The program will immediately display the decoded boot key which is required for cracking your Windows password.

   

3. Click on the “Cracker” tab. On the left, click on the “LM & NTLM Hashes” and then click the big blue plus sign on the Cain toolbar. Make sure the “Import Hashes from a SAM database” button is checked. Choose the SAM file of your locked Windows installation and enter the boot key that you’ve got in the step above.

   

4. Click Next. All the user accounts will be loaded to the right. Right-click on the user account you need the password for, choose Brute-Force Attack -> NTLM Hashes.
   

5. Now check predefined under charset and select the suitable dictionary to use and click start.

   

   That’s it! Just wait for Cain & Abel to recover the password!

If you have no way of getting the SAM and SYSTEM files from your Windows PC, you will not be able to use Cain & Abel to recover your password. If you have no luck with Cain & Abel, I recommend you to use PCUnlocker Live CD which can remove your forgotten Windows password instantly.

How to Crack Windows Server 2003 Password?

All you need to do is to create a Live CD which contains password cracking utility on another computer you can login, then bring the Live CD to boot up your server that you need to crack a password on.  It allows you to crack both local administrator password and domain administrator password on your Windows Server 2003. These instructions are written assuming a bootable CD is being used, but are essentially the same for a bootable USB flash drive.

1. Download the bootable disk’s image of Reset Windows Password utility, it comes in a .ZIP file. Unzip the download file and you’ll get the ISO image file: ResetWindowsPwd.iso.
2. Burn the ISO image on a new CD use your favorite burning software (If you don’t have one, I recommend you use ISO2Disc.) Once the CD is burned successfully, unplug the Live CD from the computer.
3. Insert the Live CD into your locked computer with a forgotten Windows Server 2003 password. Set the computer BIOS to boot with CD drive as first boot device. After booting from the CD, the computer will load the Windows PE operating system inside the CD drive and open up the Reset Windows Password utility.
4. Select your Windows SAM registry hive from the drop-down list. The program will perform a complete analysis of the SAM file and display a list of Windows local user accounts inside it. If you’re going to crack the domain admin/user password, click on the “Reset Active Directory Password” option, the program will show you all domain user accounts on your server.
5. Choose the user account whose password needs to be cracked, and click on “Reset Password” button. It will crack/remove your lost or forgotten password instantly.
6. Remove the CD and re-boot the system and you should now be able to log on Windows Server 2003 immediately.

The Live CD could also be used to crack lost or forgotten admin/user password on Windows Server 2012/2008/2000. This is probably the most effective, simple piece of software that you have seen around.

Reset Windows Password utility is capable of running from a CD or USB drive. Just get your locked computer to boot from the CD/USB drive and the password cracking tool inside the CD/USB enables you to reset lost or forgotten Windows login password quickly and easily. It supports Windows 8/7/Vista/XP and Windows Server operating system.

Here we’ll walk you through the entire process of creating a password cracking Live CD and using it to reset lost or forgotten Windows login password. If you’re a little nervous, it might help to take a look at this entire step-by-step guide before you actually get started.

How to Reset Lost or Forgotten Windows Login Password?

1. Since you obviously can’t access your computer right now because you don’t know the password, you need to use a secondary computer to create a password cracking Live CD. Download the Reset Windows Password utility and save it onto that computer.
2. Once downloaded, extract the ISO file from the ZIP file. Feel free to do this using the integrated tool in Windows or a dedicated program like WinZip.
3. Burn the ISO file to a blank CD or DVD using your favorite CD/DVD burning program. If you don’t have one, you can use BurnCDCC or ISO2Disc program. If the ISO file is not burned correctly, the password cracking Live CD will not work at all.
4. After the password cracking Live CD is created, go to the computer that you are resetting the password on. Insert the Live CD into your optical drive and then restart your computer. Make sure that you have configured your BIOS to boot from CD before your hard drive. Otherwise, the CD won’t get boot up.
5. The booting process will take a while. Once it’s done loading up, you should see the Reset Windows Password program, which will display all of the Windows user accounts that it has found on your computer.
6. Choose the user account with a lost or forgotten password, and then click on Reset Password button. The program will unlock/enable that user account and clear/blank its password immediately.
7. Remove the password cracking Live CD from your optical drive and restart the computer. You’ll finally get to log into Windows without entering a password!

Reset Windows Password utility is not designed to recover/find your original Windows login password, because Windows login password is encrypted using some very strong encryption algorithms and the time in order to crack a password is usually unacceptable. But this program can overwrite/blank your lost or forgotten Windows login password in just a matter of seconds!

All you need is Password Recovery Bundle, a Windows password cracker tool. Borrow someone PC, download the tool and create a password reset CD. Then boot your PC with the CD and perform password cracking. But make sure to set your BIOS to boot from CD or you will end up with boot into Windows 7 logon screen.  Follow the step-by-step instructions to crack Windows 7 password:

1. Before the work, prepare a blank CD/DVD.  Then install and run Password Recovery Bundle on your computer.  Click Windows Password button to bring up the CD recording dialog, burn the default ISO image onto your CD.  The CD is the Windows password reset CD we’ll later use to crack Windows password.
2. Insert the Windows password reset CD into your locked computer. Set the computer to boot from the CD.
3. Restart the computer, it will start to boot from the CD.  After a while, your computer will launch the Reset Windows Password program. The software automatically detects your Windows 7 SAM registry hive and show a list of user accounts existing in your Windows 7 system.
   
4. Choose the user account whose password you already forgot, then click Reset Password button to remove the password.
5. Remove the CD and restart your computer.

“How to crack Windows 7 password in a short time?” You’ve done it now! You’ll find you can get into the computer directly without being asked for password. Not only for Windows 7, the Windows password reset CD you’ve created can also be used to crack Windows password on Windows Server 2008/2003/2000 and Windows 8/Vista/XP/Me.

In this tutorial we’ll show you how to hack Windows password with a Linux live CD – Ophcrack, which is a freeware that can crack Windows password so you can login without making any changes to your computer.

Step 1: Download Ophcrack and Create A Linux Live CD

The first thing we will need to do is download the CD image from Ophcrack’s website. There are two options to download: XP or Vista. So make sure you grab the right one. The Vista download works with Windows Vista or Windows 7, and the only difference between XP and Vista is the “tables” Ophcrack uses to hack the password.

Once the .iso file is downloaded, burn it to a CD using any CD/DVD burning software you like, such as BurnCDCC or ImgBurn. If you are going to be cracking your password on a computer that doesn’t have a CD drive, such as a netbook, you can also burn the ISO image to a USB flash drive using Universal USB Creator.

Step 2: Hack Windows Password

Boot the computer from the Linux Live CD that you created.  On some computers you may have to go into the BIOS settings to change the boot order or push a key to show the boot menu.

Once the disk is done booting, Ophcrack should start automatically and will begin hacking the passwords for all of the users on your computer.

If you have a complex password it will take a lot longer than simple passwords, and with the free tables your password may never be cracked. Once the hack is done you will see the password in plain text, write it down and reboot the machine to login. If your password isn’t hacked, you can also log in as one of the other users with admin rights and then change your password from within Windows.

With the free tables available you will not be able to hack every password, but the paid tables range from $100 to $1000 so you may be better off just resetting your password with Reset Windows Password utility.