Unfortunately, I've forgotten the password to both the local admin account and the domain admin account on my domain controller. This box is to be used in an exploitation demonstration but the passwords are still required to setup the vulnerable services. What are my options here?

I've attempted to liveboot a few password recovery tools via cd boot but they don't seem to work (it's probably me using them incorrectly). I've attempted to map the drive to my host machine to crack hashes from the SAM file locally/offline but the SAM file requires specific permissions that I do not have on the host machine. I feel like there are additional security protections in place with this being a domain controller, something I do not have experience with in terms of forensics and recovery. Is there an easy path to recovering the passwords for both accounts or even retrieving the hashes of those passwords?

Note: there is a similar question on this but the answer is not present in the thread so I'm asking again. Also, this server is part of a domain (it's the controller) so that's something different to consider compared to the other question.

  • Windows 2003? Really this server is eol and it's no longer secure to use it. You really should move the service to a newer os to save your live as admin. – BastianW Mar 18 '17 at 22:29
  • The Windows Server 2003 VM is part of a demonstration to show how the SamSa threat actors carried out their attack on MedStar last year. Don't worry, I'd never use Server 2003 in prod. (Report on SamSa if interested - intelsecurity.com/advanced-threat-research/content/…) – JustSev Mar 22 '17 at 10:37

I have always used this method I wrote here to reset the admin password https://ittutorials.net/microsoft/windows-7/reset-administrator-password-on-windows/ but I have never tried it in a domain controller. I don't think there is a local account in a domain controller. You might give it a try...Let me know if you come up with a solution, I'm curious.

  • I'll continue with bootable recovery solutions but I seem to be having issues with them. I'm not sure whether it's because I'm doing it wrong or because it's a VM (Power on to firmware > boot from CD > Windows boots instead). I'll try this and retry remote password recovery via usb/cd bootable ubuntu. – JustSev Mar 18 '17 at 12:52
  • Do you have a RAID on the server? – Nelson Amaya Mar 18 '17 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.