The handling of passwords in a Microsoft OS is complex because they use passwords for many usages. The OS (or its domain controller) will store a hashed version of the password, but there are also values which are symmetrically encrypted with keys derived from the password or from the hash thereof. The authentication protocols do not include provisions for exchanging salts when some hashing must occur client side. It is difficult to alter the password processing algorithms without impacting a lot of subsystems and potentially breaking the backward compatibility, which is the driving force of the Windows ecosystem.
It goes down to strategic priorities. Microsoft knows that altering password hashing and authentication protocols to include a salt will have some non-negligible costs which they would have to assume (by fixing all the components which are thus affected). On the other hand, not changing the password hashing is rather "free" for them, because a flaky hashing algorithm will not convince customers to switch to other non-Microsoft systems (the OS market is, in practice, a captive market); it takes a lot more to force potential customers to envision an OS switch which is very expensive. Also, password hashing can arguably be qualified as "defence in depth", a second layer which has any impact only once a breach already occurred; as such, it could be presented as being of secondary importance. Therefore, it is logical, if irritating, that Microsoft does not update its poor password processing practices.
Historically, Microsoft did only one update, when they switched from NTLM v1 to v2, and it was kind of necessary because the older LM hash was so weak that it was beginning to be embarrassing. My guess is that it involved a lot of internal hassle and they are not eager to do it again.
@@pruina3395 if you got access to a drive, you don't have to have access to the users, but to all unencrypted files on this device. and the hashed passwords are probably not encrypted
@@Infisrael Correct me if I’m wrong, but this exploit also needs to be executed after the bad actor has already gotten access to the device, which can be done without the password being required. So the actual value of this exploit is (relatively) negligible because the bad actor already has access to the device itself right? (Assuming that the password they used is unique.)
TLDR: If the password can be bypassed, does that mean that reverse engineering the password is pointless?
If MS put as much effort into fixing their mistakes as they do making excuses, most of the world wouldn't be stuck with an OS that's an absolute dumpster fire.
It's worth keeping in mind users can change their passwords, thus whatever mechanisms are in place have to be able to handle this. Thus switching algorithms or adding a salt can't be too difficult since it could be done at the moment of a password change (which could be forced for all accounts when updating to a new version of Windows). The only problem I can think of is if you have accounts not intended for use by users but by software, changing those passwords would stop the software from working and the software may not have mechanisms in place to anticipate this and make it easy to get the software working again. But I would think this is a small concern.
@@TheTR0Nalt as an artist myself, I really agree with you. AI generated shit is not the same thing as a person making that same video/music/painting/any form of art, so yeah, imo, AI is only worth it when it helps you in your homework, other than that, it just makes no sense at all.
@@BrunoDantasS.5655 I'm don't like ai generated content like how tf are you able to sell ai art and the dog/cat whatever videos are just annoying the only one I like is text to speech Which is the only thing that works in ai
@@masterofx32 Enderman got hit with a community guidelines strike multiple times couple years ago, for the reason of "teaching people how to crack social media accounts" in his video about... TrustedInstaller. It doesn't matter if this is already known - given Enderman's troubles with YouTube before (not only TrustedInstaller) this video has a good chance of being taken down for a similar reason, and people want it saved.
@@XaneMyers It might still help prevent some 12 year old who is a bit more clever with tech but not so much with life from making a bad judgment and potentially getting in a lot of trouble.
Although disclaimers like this absolutely shouldn't be required, and "risky" videos like this should not be taken down for insane reasons, these disclaimers are always a sign that the video is gonna be good!
@theairaccumulator7144 they shouldn't but it's not good for ppl who use the same password in many places. a better hash function could prevent further damage.
11s login screen is just 10s with a fresh coat of paint that from 22000.65. 10d is fresh coat of paint from 8s and then 8s is fresh coat of paint from 7s and then vista. your 11 login screen is quite similar to 8.0. it has the same user account password. same welcome screen with same loading circle. i wouldn't be surprised. 8.0 development started before 2011. some parts of 11 login screen can be dated back to vista/xp
ah yes, Mr Jaunt R. On himself. one of the wisest people known to mankind, it's a shame what happened to him on December 15th, 2015, the world will never recover
He's probably hoping YouTube does take it down, especially with the false disclaimer, where while it's a felony to hack someone's computer in the USA, it's more patriotic in Russia.
@@LugiDergX I run windows, but need linux for some dev stuff. Linux is just straight up better than windows, its smaller, faster, less resources heavy and more secure. The only real downside is that most software is Windows exclusive and that's not a os issue.
@@LugiDergXyeah I am sorry but no windows is not ''the best'' you have a pretty closed mind. What you mean to say is they are THE BIGGEST (in the pc market). Windows has a lot of issues with it and has gotten pretty clunky but they don't have to fix anything because they effectively have a monopoly.
Man, I wish it wasn't. Windows is one of the better systems out there, security aside. And no, no amount of fanboy talk will ever convince anyone that MacOS or Linux are somehow better, where that pretty much isn't the case, and yet, users of those systems will always make claims saying otherwise.
When I was a teenager in my early days of computer enthusiasm, I was annoyed that websites would make me set a new password if I forgot it, rather than tell you what it is via email. However, now that I'm far more knowledgeable about this stuff, I actually like that way. Any website that tells you your password via email rather than making you set a new one is storing the passwords unhashed. If you encounter such a website, you should avoid it at all costs.
Websites that doesn't allow you to use certain characters for your password also give me the heebie-jeebies. It shouldn't matter what character I put into it as long as it's stored hashed and encrypted right? So why care what characters I use? It smells fishy to me.
reminds me that one meme about a website where user attempted to login and password is incorrect with error like "Your password is wrong, its XXX's password which is "<password>" try again with XXX account"
Problem is you can't always do that and in my case only recently we got a venue to report these, as those show they fail their duty to protect personal data.
i like how gamebanana does it: giving you a temporary password to log into your account and change the password, i used gamebanana with the temp passwords for weeks.
@@Wkaelx There are ways to keep systems safe and compatible even with the oldest of software you know.. For one thing, dropping 16-bit support as a whole was an massive mistake on Microsoft's part. Sure, nobody uses that today but still. Age of code has nothing to do with how it's written, so also how secure or unsecure it is. It doesn't make any sense whatsoever to argue that there is no point in keeping backwards compatibility even with NT era of things and before/after. Again: If Microsoft doesn't want to bother with making sure Windows can stay compatible all the way throughout it's history but ensure that it's done in an safe manner, then that's not the problem of old, messy code - It's the problem of an lazy, greedy company that doesn't want to bother with things that can absolutely be done.
@@LugiDergX Yes, it makes sense to be compatible with Windows 7, Even XP. But when you get into the NT, 95/98 era this is really concerning, the system has a good looking UI but behind it there is a outdated and unsafe mess of decades of coding.
To be fair, security is the biggest thing to worry about. Backwards compatibility with all this old code and software on the other hand though is incredibly useful to have. If people are getting so upset over backwards compatibility being available, even if it's kind of extreme, reaching back to some very old Windows versions, then I think you got other, far deeper and worse issues to worry about.
It drives me nuts how much old NT code is still in Windows. And it isn't just Windows that has that issue. I was using Microsoft Access last week and found a graphic from Windows 9x.
Man, I've heard a lot of stories of how NT/Windows are spaghetti at the extreme, Oracle DB levels of sapaghettiness, thats why I don't use it anymore, and now never again. This system is more than compromised.
@@mrfoxesite4482actually that's one of the ways computers get compromised. They start with a computer that is weaker on the network and then they try to spread through more secure computers.
that was a very slick transition into the normal intro, i don't think i've ever seen someone use a previous section of their intro song to extend the intro backwards
Wait... Can non-administrators access the sam/registry files? In theory, could they copy them from a "secure" corporate machine, to a USB and take it home, import the hives crack it at home?
Most corporate PC's have one local admin account for remote IT or troubleshooting.
@@Endermanch yeah thats why you use bitlocker, secure boot, prevent DMA Access and dissallow USB Sticks. If I have direct access to a PC without these things , I simply can do the old sticky shift trick to log in as system and then just set adminstrator password through the GUI.
@@Kippykip Someone (of at least average IQ) who wants to attack and steal passwords from a high-profile corporation’s central system would probe it for weaknesses and, if needed, install either a rootkit or a backdoor to ensure uninterrupted activity. In a sane world where security is taken seriously, there would be several defense layers to deter, detect and trace any unauthorized attempts to hack their mainframe.
… however, we do not live in a sane world… not anymore. If big corporations’ extreme cost cuttings bleed over to their server-side security, it’ll be only a matter of time before we see major leaks and significant damages.
@@Irongrip62 I meant for, hypothetically an attacker that wanted to access some confidential corporate data from the local machine. Local admin access is an entry point allowing you to extract the bitlocker key and browse all user profiles etc.
You need the administrator token + SeBackup privilege to access SAM. However, the SAM hive is simply a file in %windir%\system32\config, so you can dump it after booting using a USB stick or something along these lines...
Look at one of the Channel 9 history episodes, there is a NT 3 poster that says New Technology. Some people also claim it stands for "N Ten" (a CPU thing related to Cutler IIRC)
@@Xnoob545 it is but it has celebrated its 20th anniversary like a few years ago. macos modern versions are based on unix. the kernel can date back tot he 90s
@@Xnoob545AFAIK it's commonly known as either "NT File System" or "New Technology File System", but I've heard some people call it "NT Future Storage" also. I have zero idea what Microsoft calls it.
Not really. I'd argue that in some cases RAS syndrome even sounds more natural than the alternative, and it can be used intentionally for emphasis or clarity. Think PIN number or ATM machine.
@@markusTegelane i was curious and did some research, i found on the Wikipedia page for ntlm it says nt stands for new technology but does not provide a citation. the Wikipedia page for Windows nt has a citation under naming that points to a q&a with bill gates where he says "When we first released Windows NT in 1993...the letters stood for "New Technology."
But the letters have long since lost any specific meaning. Today, 'NT' is just a designation for our high-end version of Windows."
so yeah you're right it no longer officially has that meaning. still interesting to learn the history
There's plenty of policies to configure Kerberos in a domain setting. The threat model here is pretty limited; a stolen, powered off machine would ideally have bitlocker, which would first need to be compromised
@@TheTR0Nalt The part that gets me even more is the people who create videos talking about the disgusting videos getting taken down for the kind of content that the OTHER videos are showing from being highlighted. It's so backwards
I still cant believe all the things youtube does in the names of protecting kids (just one example, not an umbrella accusation) and then just leaves the elsagate type of content up for all to see. its disgusting and I dont like it
Just by definition a hash function with variable input length like a password will have collisions if the output length is fixed. You have unlimited inputs but only limited outputs
1:35 I feel the need to nitpick here. A hash function is not considered "compromised" because it has collisions. They have a fixed length output and can take inputs of arbitrarily large size, so you have an infinite number of inputs and a finite number of outputs. It is not possible for a hash function to never collide, and SHA-256 is still cryptographically secure. There is no better approach than brute force, and it is completely infeasible with today's technology to reliably find collisions.
@@DimkaTsv that's pretty much exactly what I was saying. See my response to radioactiveblueberry. Windows not using salt is bad in the first place, I was pointing out that hiding a key in some insane barely accessible field for no good reason is incredibly weird.
@@RadioactiveBlueberry first of all the dude above is absolutely right. Second of all, yes, a dll or whatever is fine. For some reason linux doesn't have to go through all that bullshit because it actually uses a sane methodology. The password hashes are stored in /etc/shadow and use salt. You can read it only if you have root rights. It works. So your point would be?
@@RadioactiveBlueberry The parts of the key are stored in separate locations in the registry which are also the same for every Windows installation. Enderman even points this out at 8:25. So, what is your point?
Edit: specified that the subkeys are stored in the registry.
Thank you soo much, I got a hard drive from my campus, they are updating their classroom hardware, it has an original windows xp professional on it but I didnt get the password for it, wich means all I can do is what it was intended for (openning power points and other class related stuff), they told me I should just format it anyway but I'm sucker for windows xp and I'm not giving up on it.
Hi Enderman, great video. I know what YT did to you, and you got 2 str-whatever. If YT t————— your channel, will you keep uploading on your “Andrew” account or just make a new YT account and just name it Enderman and just continue there? Just asking cause I love your channel. Just be sure to download your videos via YT studio to device (At least your 10 latest) so just incase anything happens, you have a little backup of videos. Just like to know. Love your channel. Have a good day❤
Much respect for you man. You made me learn something new to thi shitty windows world and definetly convincing me to pass to linux. Your channel is so underrated
This is done only for the basic Windows password on a local account right? And not for the Windows Hello PIN or (dare I mention it) a Microsoft account login? If not, that's probably why Microsoft hasn't fixed it. From their perspective they already have fixed it: just use a Microsoft account instead of a password.
As a Kerberos secret in the AAD service, not in the SAM. You might want to check these things before trying to spread FUD - especially to people who actually know how Windows works.
@@throwaway6478Bitlocker is also quite bypassable for external TPMs if you can find the LPC pins on the motherboard, or with a USB debug cable on Intel-based systems.
That amazing, never thought about that print function in the registry, seen print button a million times but never thought once of pushing it and seeing what happens, very clever of windows to do that.
Great video, I was not expecting to be this interesting. I tried your script on a windows 7 machine but it didn't work, it said something like "IV must be 16 bytes long", later I'll edit this. I think it's because the windows 7 registry is different from 11 because with your example reg I managed to run it fine. While scrolling both regs I found some differences like the amount of users and user types as well the security questions that kinda don't exist in 7, max it has is the password hint
I heard years ago that if you have a password over 14 characters then Windows uses a different hashing algorithm or something, can't really remember the details.
I mean, the last time we got a biggest hack to ever be, and few sidekicks. Also didnt FBI recently discovered that lots (really lots) of american computers were compromised by some very old, weird and sneaky russian virus?
The registry api does let you read the class name for the key. It's trivial to automate reading this obfuscated data. Spend an extra hour and add it to the script.
@@ZiedKammoun it works if you have a copy of the registry… or access to the disk or simply the guy is in a meeting and you use it meanwhile. Btw how often is the password used on pther devices as well?
as Soon as i see the "This video does not condone or promote hacking or any other illegal activities." Screen i get flashbacks from when enderman couldnt post and had trouble with youtube xD
Question: does windows hello use the same algorithm to store credentials? PINs aren't as secure passwords but if hello has updated the encryption then just checking "letters and symbols" makes it a password.
This attack requires you to practically already have access to the user folder contents (at that point just look at their chrome passwords in plain text), requiring some network exploit or physical access. Both can be thrawted by turning off your computer when not in use and using full disk encryption- if you don't trust bitlocker and tpms then veracrypt is fine, but bitlocker is inherently as secure as long as you have a password to get in. At that point keep your recovery key and password secure- if stored on your MS account then have 2fa on. It can take just one point breached to compromise multiple accounts of yours.
Now for the TPM that's a different story but tldr depending on your hardware theres really basic attacks you can execute to obtain the code the TPM sends to the is to decrypt. I haven't seen this for the firmware toms built into CPUs but regardless don't solely use the tpm- better security would require proof its you authorized signing in (the password) and that its signing in the right location (the TPM in theory).
you found yet another reason why you shouldn’t make a local user account and then linking to the MS account in Windows 11 (like imagine decrypting your password of Windows that is/was also used in other MS services (like Outlook, Office and so on…))
1. This video is about extracting passwords, not bypassing security, enderman literally mentions it 2. Not every windows computer, it is possible to disable CMD in recovery options
The question is, does this also kinda work with network/Domain accounts. Because if I am not connected with the network, I can still log on, so it has to be stored locally.
Next video: The Shocking Ease of Pressing Shift+Restart to Bypass Windows 11 Security Altogether (And the shocking ease of "decrypting" the ROT13 used by default in the UserAssist key, enabling WDigest authentication, etc.)
Bro has been changed the tile and thumbnail instantly After few days later of uploading this video 😅 I have been back up at this video on my channel so when YouTube has been deleted you can still see it 😂
Can the sethc bug and net user * username be considered password cracking?
Ive tried it out once, invoking the cmd via the sethc bug and then typing the net user * <user> to change the password but I'm curious, does that count or not. No I'm not preparing something nefarious.
I think I had that same motorcycle photo on a capcha before!
i guess physical access to a system or the unencrypted disk would allow to expose someone's password, which may be the same as various other of their passwords. I imagine password stealer malware is already using these methods, too.
Although I imagine this is only for local accounts? Also, what about for windows domains?
Enderman: THIS VIDEO IS MADE BY PROFFESIONALS AND SOLELY FOR EDUCATIONAL PURPOSES Me: WE ALL KNOW IS ENDERMAN A PROFFESIONAL WHY DO U SAY THIS?????????
For a company whose OS already takes telemetry to previously unimaginable levels and whose 'total' Recall does so again, why is anyone in the least bit surprised? In a parallel wholly fictional world one could conceive a scenario where hackers being able to bypass holey security was at best simply ignored and at worst built in with nefarious intentions.
Given the premise of this video is explicitly stated to be about cracking to find a working cleartext password and not just gaining access at the very start, it seems a little off-topic to backpedal to the "but I can gain access without cracking it" argument
@@throwaway6478 if you reset the password, you dont get to know the password. if you crack it you do, and a lot of people use the same passwords for multiple sites, computers etc
@@sasha-fe2bl that's windows trick also works only for Admin account or drive access. He's reading thr registry. Also, won't the pc decrypt the C drive to use the files, use some sense there
@@gabriledyt you need to understand that the highest level of hashing also cannot prevent fs removal of the file. Also, to read those codes, you'll need admin access, and that already means the pc is dead
It depends. Apparently, one user on stackoverflow observed a Mac using SHA-512. Linux's /etc/shadow file specifies one of many formats for each password (MD5, blowfish, Sha-256, SHA-512, and yescrypt). My debian installation uses yescrypt, which Wikipedia describes as "more resistant to offline password-cracking attacks than SHA-512" and is used on Fedora, Debian, Ubuntu, and Arch.
Ok, so I tried out the script on my own Windows 11 installation. I believe I followed all the steps correctly (although I had to modify the samreader file to make it compatible with Python 3.10). I got an NT hash output, but it doesn't seem to match the MD4 hash of my PIN. Is this supposed to give me the hash of the PIN or something else? (I'm not sure if I have a password set on my account).
@@Endermanch I just gave it some more thought and I think it is only possible if input data is shorter or equal in length to the hash value itself. If data is even one bit longer it is impossible. In ideal case, input data one bit longer that the hash value itself, would produce exactly two collisions, 4 colisions for 2 bit length difference, etc.
Sounds like you're just salty with Microsoft for a very old auth method (provided for compatibility with old business systems, not for actual use with your account). :P
You both are probably correct (btw Microsoft doesn't hide information about this)
It does in fact use CNG BCrypt AES256 on Windows Server 2016 / Windows 10 and later (previous versions use DES + RC4)
BUT!!! There is peculiar note here. Quote: "On domain members and workstations, local user account password hashes are stored in a local Security Account Manager (SAM) Database located in the registry. They are encrypted using the same encryption and hashing algorithms as Active Directory."
Key part here is "On Domain members and workstations". Meaning that it does not affect personal use systems without specific setup.
Neither you really should be panicking that much about possibility of bruteforcing hash of your Windows password. If perpetrator has this level of access to your system, you already is boned, as he can just reset said password and gain access anyways. Or use ton of other ways to work around. Moreover, you can do similar stuff on Linux (not bruteforcing, but resetting password)
@@Endermanch I'm sorry but current versions of Windows encrypt NT password hashes with DES + BCrypt (256) before storing them (before it was DES+RC4). So while the hash itself is potentially vulnerable, you won't have access to it. LM has been disabled as a storage method for a long time. Also, NT hashes draw from the entire unicode character range, not just ASCII, basically each character being chosen from 64k possible values. So you can't just discard NT hashes as being "just as vulnerable as LM" because they aren't.
What do you mean? It's used in production, right here. Windows 11 hashes your local passwords into NT hashes. LM hashes were provided for compatibility reasons, but later phased out. NT hashes must be obsolete too, because unsalted MD4 doesn't rhyme with security.
why steal the password, when you just can take a windows installer on usb and cmd into your system, replace accessibility.exe with cmd.exe, reboot, open the terminal, activate the local administrator and you are in. just call it a feature at this point, microsoft. as soon as someone has physical access to your pc, its jover anyway. this is a similar principle as chroot, but the execution is terrible.
That doesn't matter. If the hashing algorithm is insecure (better ways of guessing than brute force) and/or weak (small output and easy to compute) someone can find a weak password that produces the same hash as your strong one, given they have your hash.
@@wezu4972 oh right my bad, I tried with a PIN associated to my account (same as the video 9988) and it didn't work, but when I created a local account with password 9988 and 3 security questions it worked flawlessly
Чувак! Я сделал это!! Конечно в твоём коде было несколько недочётов и ошибок, например Crypto.Cipher и Crypto.Hasj и вместо sam.utils надо было просто utils, но в остальном всё работает!!
@@EndermanchДа, я проверил и понял что делал что-то поначалу не так - код полностью рабочий, просто сначала надо было обновить pip и установить библиотеки python
@@EndermanchЯ использовал последнюю версию python 3.13, но код очень хороший! И также хочу похвастаться - я конвертировал код на язык powershell, тебе было бы интересно увидеть этот же код но на powershell без python?
The hash decryption works 100% of the time if you supply correct LSA components. The dictionary attack depends on the hash database you're running the lookup against. Complex passwords will most of the time require a bruteforce/mask attack using hashcat. Your GPU will assist you well in that case.
And then there's Linux which is bold enough to store passwords in an easily found, unencrypted text file accessible by root, but that's ok because at least it uses strong hashes like sha512 and yescrypt plus it actually salts them.
back up password file change password log on and do what you like restore password file Done. At least Windows (and macOS, interestingly) has some protections against doing this - Linux has none.
@@0xfadead In addition to what was said, also see the point of the video - it's one thing to breach a system by forcibly changing its password, and whole another thing to breach it by retrieving the password. With the latter your entry into the system stays relatively hidden (whereas with the former it would be very clear), and you could use the password you retrieved to try entering other systems, accounts etc. as it's common (bad) practice for people to use the same password everywhere.
@@0xfadead In addition to @GeekIWG's response, see the point of this video - it's a very different thing to breach a system by forcibly changing a password, and a whole another thing to do it by retrieving the password. With the former not only you make your entry into the system very clear (whereas it would be much more hidden if you didn't change the password), at the end you don't know the password which means you can't use it to try logging into different systems, as reusing the same password is a pretty common (bad) practice.
@@0xfadead Just that Linux doesn't have to do all this weird obfuscation and encryption that Windows does to try to protect passwords since Linux does things properly with strong hashes and salts.
The techniques used in this video have been known for almost 30 years, and are far better documented elsewhere - including other Youtube videos that haven't been taken down in 10+ years.
hey bro can you make video of password hacking pls i cant execute exe files in a school computer cuz i downloaded vmware and bluestack to play android games pls bro
password method i like: reset password in cmd crack password vault safe change password in cmd remove password in cmd
@@EndermanchI watched your clickbait, especially the parts where: - You bypassed Microsoft Account (which would have stopped you doing this) - Disabled BitLocker (which prevents offline attacks on the SAM file and the sethc.exe trick) - Gave yourself admin privs (which you don't get by default, need a password for, and require to get online access to the SAM). All of these features are over a decade old - BitLocker is coming on 20 years old, and you had to specifically disable them all to mount your attack. Then you, and channels like yours, actually tell other people to disable them. If people are stupid enough to listen to you and your ilk, they deserve to be hacked by you and your ilk.
The techniques used in this video have been known for almost 30 years, and are far better documented elsewhere, including other Youtube videos that haven't been taken down in 10+ years.
The techniques used in this video have been known for almost 30 years, and are far better documented elsewhere, including other Youtube videos that haven't been taken down in 10+ years.
Windows 11 discourages the use of local accounts. Online Microsoft accounts are set up with two vector authentication and there isn't really a password.
Is there a variant of this exploit which can get access to the Microsoft account?
windows 12: featuring linux UI no u cant perform linux commands but u can make it look like linux hmmm oh 1% gaming performance yes that will be good hmm ahh same password encryption yep nobody gonna notice hm ye lets restrict people from using cmd in windows login menu so they cant perform magic. idk i was bored hey XD i downgraded to win 10 fk win 11 i hope win 12 will not be dissapointed (jk it will prob be garbage) idk why they push win 12 when they released win 11 :D thats not even like that optimized idk.
I figured out a way to get rid edge now. Go to HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge and set NoUpdate and NoRepair to 0. Do the same for EdgeUpdate. Then uninstall edge from settings. Locate to the install folder of edge and delete edge, edgecore, and edgeupdate (keeping the webview if you need it)
The best way to keep your computer safe from ppl trying to get into it are 1. Keeping it safe and secure at home, locked in your house, and 2. Not getting itraatted by downloading and running suspicious/malicious .exe files
/g/ is wild. Ignore security features like Syskey (invented 30 years ago) and Kerberos (been in Windows since 2000), then actively disable security features like Bitlocker (created nearly 20 years ago) and MS account (created over 10 years ago) bcuz YT ecelebs told you to - then complain that there's no security and you can hack it in seconds. 🤣
Yet won't work with MS account, because they want you to force to get the mark of the beast lol.
Seriously, it's amazing. Simply amazing. You were never forced to sign up for a spywaresoft account in previous windows versions, but in 11? SIGN THE FKING MS ACCOUNT UP, OR I FORBID YOU USING YOUR COMPUTER!!!
Well... That is if you don't know that the command prompt can be brought up in the OOBE. You can simply bypass it with the command prompt.
Or, even better: logging in to your supposed MS account, by typing "defaultuser0" in the username field. It gives a error, but it will move you to the local account creation screen! XD
Only with windows do you see such.... Technological wonders! XDDD
that's a reason everyone should use bitlocker. in this case only users admin will can to open regedit but user admin already can change any pass them want so
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! NOTICE NOTICE NOTICE NOTICE NOTICE !! !! I AM NOT AN EXPERT IN HASHING !! !! NOTICE NOTICE NOTICE NOTICE NOTICE !! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
In your explanation of hashing you say that any hashing technique with collisions is unsafe. How would not having collisions be possible, especially when these functions are fixed length? You can't compress arbituary amounts of data into 16 bytes without having collisions. Do you mean predicting collisions instead?
The SAM key cannot be accessed without PE or TI/System? LagLife made a vid abt NoMoreBugCheck 1 year ago you SO HAPPEN to make a vid abt NMBC a few weeks ago
The handling of passwords in a Microsoft OS is complex because they use passwords for many usages. The OS (or its domain controller) will store a hashed version of the password, but there are also values which are symmetrically encrypted with keys derived from the password or from the hash thereof. The authentication protocols do not include provisions for exchanging salts when some hashing must occur client side. It is difficult to alter the password processing algorithms without impacting a lot of subsystems and potentially breaking the backward compatibility, which is the driving force of the Windows ecosystem.
356 likesIt goes down to strategic priorities. Microsoft knows that altering password hashing and authentication protocols to include a salt will have some non-negligible costs which they would have to assume (by fixing all the components which are thus affected). On the other hand, not changing the password hashing is rather "free" for them, because a flaky hashing algorithm will not convince customers to switch to other non-Microsoft systems (the OS market is, in practice, a captive market); it takes a lot more to force potential customers to envision an OS switch which is very expensive. Also, password hashing can arguably be qualified as "defence in depth", a second layer which has any impact only once a breach already occurred; as such, it could be presented as being of secondary importance. Therefore, it is logical, if irritating, that Microsoft does not update its poor password processing practices.
Historically, Microsoft did only one update, when they switched from NTLM v1 to v2, and it was kind of necessary because the older LM hash was so weak that it was beginning to be embarrassing. My guess is that it involved a lot of internal hassle and they are not eager to do it again.
Replies (8)
@@pruina3395 if you got access to a drive, you don't have to have access to the users, but to all unencrypted files on this device. and the hashed passwords are probably not encrypted
0 likes@@Infisrael Correct me if I’m wrong, but this exploit also needs to be executed after the bad actor has already gotten access to the device, which can be done without the password being required. So the actual value of this exploit is (relatively) negligible because the bad actor already has access to the device itself right? (Assuming that the password they used is unique.)
0 likesTLDR: If the password can be bypassed, does that mean that reverse engineering the password is pointless?
If MS put as much effort into fixing their mistakes as they do making excuses, most of the world wouldn't be stuck with an OS that's an absolute dumpster fire.
8 likes@@𰻝 Not AI generated.
16 likesHello ChatGPT!
3 likesIt's worth keeping in mind users can change their passwords, thus whatever mechanisms are in place have to be able to handle this. Thus switching algorithms or adding a salt can't be too difficult since it could be done at the moment of a password change (which could be forced for all accounts when updating to a new version of Windows). The only problem I can think of is if you have accounts not intended for use by users but by software, changing those passwords would stop the software from working and the software may not have mechanisms in place to anticipate this and make it easy to get the software working again. But I would think this is a small concern.
13 likeseven if they fix it will just be targeted again and back to the same point
4 likesCool
3 likesYou know Enderman is fighting for his life with YouTube when he pulls out the longer intro with the disclaimer.
529 likesReplies (4)
@@TheTR0Nalt as an artist myself, I really agree with you. AI generated shit is not the same thing as a person making that same video/music/painting/any form of art, so yeah, imo, AI is only worth it when it helps you in your homework, other than that, it just makes no sense at all.
0 likes@@BrunoDantasS.5655 I'm don't like ai generated content like how tf are you able to sell ai art and the dog/cat whatever videos are just annoying the only one I like is text to speech Which is the only thing that works in ai
2 likes@@TheTR0Nalt Yeah, AI is really shit and it should be banned in stuff like this.
1 likeYouTube would rather become magenta than ban the ACTUAL BAD CREATORS and ACTUALLY WATCH These Quality videos & approve them
22 likesI'm downloading this video before it gets taken down by Youtube.
451 likesReplies (18)
Gotta download again as the video has changed lol.
0 likes@@Arctic123YT put it in Internet Archive!
0 likes@@gairisiuil where can i watch/download this video about TrustedInstaller?
0 likes@@gairisiuilthis has 3 disclaimers
0 likes@@masterofx32 Enderman got hit with a community guidelines strike multiple times couple years ago, for the reason of "teaching people how to crack social media accounts" in his video about... TrustedInstaller. It doesn't matter if this is already known - given Enderman's troubles with YouTube before (not only TrustedInstaller) this video has a good chance of being taken down for a similar reason, and people want it saved.
3 likesMe too
0 likes@@maxito9984but if you archieve u wont be able to watch the video
0 likesThis better not get taken down
0 likes10 hours and it still isnt taken down amazing
4 likesThis is not new information at all.
1 like@@maxito9984 and the Internet Archive is down
0 likesThe techniques used in this video have been known for almost 30 years, and are far better documented elsewhere - even on YouTube.
18 likesYeah, archive it please
3 likesSame
1 like@@AadiLMughal Maybe
1 likeBut plz if really this video taken down then u upload it from ur yt channel
4 likessame!
3 likesgood idea
4 likesThe disclaimer in the description LOL
723 likesReplies (22)
"PLEASE! OH GOD PLEASE YOUTUBE! PLEASE DON'T BAN ME!"
0 likesIt was necessary since... YouTube being YouTube
0 likes@@GigantTech yeah that sounds like something he would do. Also i just saw he has a channel called seedling that farms indian subs
1 like@@羴 nope, he password guesses ancient YouTube account (he showed it to me once)
1 like@@GigantTech that channel was gifted to him though
0 likesyeah yt did a bad a while ago
0 likes@@GigantTech he gained it naturally, but now youtube legal team is after him cuz of stuff he's done
1 likeShut up seedtech, imagine buying YouTube channels for a checkmark
1 likeI was about ready to start hacking, but gave up when I saw the disclaimer.
0 likeshe has to put it there, even with this yet could remove this vid, it happened before multiple times
1 like@@XaneMyers It might still help prevent some 12 year old who is a bit more clever with tech but not so much with life from making a bad judgment and potentially getting in a lot of trouble.
2 likesWe meet once again Seed.
0 likesThat's the password to the zip file@@thatoneglitchpokemon
0 likeshe also leaked his password im the description... totally...
2 likesThis is a CYA to keep youtube from taking it down.
5 likesyoutube: quick mods ban him there is a warning at the beginning of the video
4 likesHow is it funny
1 likeFBI is calling...
2 likesImagine if it still does get taken down..
7 likesAlthough disclaimers like this absolutely shouldn't be required, and "risky" videos like this should not be taken down for insane reasons, these disclaimers are always a sign that the video is gonna be good!
58 likes"I DO NOT CONDONE NOR SUPPORT ANY OF THE OPINIONS EXPRESSED ON THIS CHATROOM" aah 😭
59 likesLmao.
7 likesMD4 was already known to be insecure in 1991 and got retired in 2011...
203 likesReplies (6)
@@theairaccumulator7144 This, if some attacker got far enough to reach the registry the PC is beyond compromised.
0 likes@@theairaccumulator7144 yes
0 likes@theairaccumulator7144 they shouldn't but it's not good for ppl who use the same password in many places. a better hash function could prevent further damage.
0 likesain't no one care about the security of your windows password, if an attacker got to that point you're already cooked
4 likes11s login screen is basically based mostly on 8.0. it has ties to even vista/xp and even windows nt 4 login screen. wild.
5 likes11s login screen is just 10s with a fresh coat of paint that from 22000.65. 10d is fresh coat of paint from 8s and then 8s is fresh coat of paint from 7s and then vista. your 11 login screen is quite similar to 8.0. it has the same user account password. same welcome screen with same loading circle. i wouldn't be surprised. 8.0 development started before 2011. some parts of 11 login screen can be dated back to vista/xp
13 likesWhat the heck, MD4 AND unsalted??
106 likesAs a wise man once said...
"WHAT!?? (pause.) WHAT THE F***"
Replies (1)
ah yes, Mr Jaunt R. On himself. one of the wisest people known to mankind, it's a shame what happened to him on December 15th, 2015, the world will never recover
3 likesLet's hope YouTube doesn't take this video down.
193 likesReplies (3)
@@soundspark Bruh 😂😂😂
1 likeHe's probably hoping YouTube does take it down, especially with the false disclaimer, where while it's a felony to hack someone's computer in the USA, it's more patriotic in Russia.
4 likesYeah
0 likesenderman: uses voice, puts calm music
46 likesalso enderman: uses textbox and intense music
Replies (1)
I liked the old style, got me hooked
2 likesAnother day, another video of Enderman showing us why Windows security is mostly a joke.
149 likesReplies (4)
@@LugiDergX I run windows, but need linux for some dev stuff. Linux is just straight up better than windows, its smaller, faster, less resources heavy and more secure. The only real downside is that most software is Windows exclusive and that's not a os issue.
0 likes@@LugiDergXyeah I am sorry but no windows is not ''the best'' you have a pretty closed mind. What you mean to say is they are THE BIGGEST (in the pc market). Windows has a lot of issues with it and has gotten pretty clunky but they don't have to fix anything because they effectively have a monopoly.
1 likeMan, I wish it wasn't. Windows is one of the better systems out there, security aside. And no, no amount of fanboy talk will ever convince anyone that MacOS or Linux are somehow better, where that pretty much isn't the case, and yet, users of those systems will always make claims saying otherwise.
1 like*absolutely
8 likesWhen I was a teenager in my early days of computer enthusiasm, I was annoyed that websites would make me set a new password if I forgot it, rather than tell you what it is via email. However, now that I'm far more knowledgeable about this stuff, I actually like that way. Any website that tells you your password via email rather than making you set a new one is storing the passwords unhashed. If you encounter such a website, you should avoid it at all costs.
149 likesReplies (11)
@@LMiranic damn..
0 likes@@brianbuddy2ACP most websites just have you set a new password though.
0 likes@@LMiranic I wouldn't know about it, never had to reset my password via mail.
0 likesWebsites that doesn't allow you to use certain characters for your password also give me the heebie-jeebies. It shouldn't matter what character I put into it as long as it's stored hashed and encrypted right? So why care what characters I use? It smells fishy to me.
2 likes@@Griffonki Steam doesn't send you your password when you ask for it, in fact you can't. You just set a new password instead.
13 likes@@LMiranic too bad I will still use Steam lol.
0 likes@@AffectionateLocomotive If they send you your password over email it means they know it, which they shouldn't. So yes, even Steam.
3 likesreminds me that one meme about a website where user attempted to login and password is incorrect with error like "Your password is wrong, its XXX's password which is "<password>" try again with XXX account"
20 likeseven steam?
0 likesProblem is you can't always do that and in my case only recently we got a venue to report these, as those show they fail their duty to protect personal data.
3 likesi like how gamebanana does it: giving you a temporary password to log into your account and change the password, i used gamebanana with the temp passwords for weeks.
0 likesThis is giving me flashbacks to my family members losing their windows login passwords and making me retrieve them in high school
28 likesSo glad for the disclaimer I wouldn't be able to support you if you were an illegal hacker.
37 likesAh yes. Old NT code starting to bite back. Surely this can't get any worse, right? Right???
40 likesReplies (6)
@@Dumb_Killjoy ODBC Data Sources has a directory explorer from Windows 3.1, so...
0 likes@@Wkaelx There are ways to keep systems safe and compatible even with the oldest of software you know.. For one thing, dropping 16-bit support as a whole was an massive mistake on Microsoft's part. Sure, nobody uses that today but still. Age of code has nothing to do with how it's written, so also how secure or unsecure it is. It doesn't make any sense whatsoever to argue that there is no point in keeping backwards compatibility even with NT era of things and before/after. Again: If Microsoft doesn't want to bother with making sure Windows can stay compatible all the way throughout it's history but ensure that it's done in an safe manner, then that's not the problem of old, messy code - It's the problem of an lazy, greedy company that doesn't want to bother with things that can absolutely be done.
0 likes@@LugiDergX Yes, it makes sense to be compatible with Windows 7, Even XP.
1 likeBut when you get into the NT, 95/98 era this is really concerning, the system has a good looking UI but behind it there is a outdated and unsafe mess of decades of coding.
To be fair, security is the biggest thing to worry about. Backwards compatibility with all this old code and software on the other hand though is incredibly useful to have. If people are getting so upset over backwards compatibility being available, even if it's kind of extreme, reaching back to some very old Windows versions, then I think you got other, far deeper and worse issues to worry about.
1 likeIt drives me nuts how much old NT code is still in Windows. And it isn't just Windows that has that issue. I was using Microsoft Access last week and found a graphic from Windows 9x.
3 likesMan, I've heard a lot of stories of how NT/Windows are spaghetti at the extreme, Oracle DB levels of sapaghettiness, thats why I don't use it anymore, and now never again.
7 likesThis system is more than compromised.
The computers at my school all have the password "0"
71 likesYea very secure, i know
Replies (7)
@@mrfoxesite4482actually that's one of the ways computers get compromised. They start with a computer that is weaker on the network and then they try to spread through more secure computers.
0 likes💀
0 likesits school name but what data does it contain? to have such passwords. nothing. just ppts and programs
1 likeIKR?
0 likes@@marcusjohansson668Throw in a special character to make "p@ssword1234" and it’s the most secure password known to mankind !
1 like@@GarfieldtheDestroyer But but... What if I combine them together? "password1234" is safe riiiiiight? xD
9 likesArguably better than "password" or the classic "1234"
17 likesDo not use Windows, Linux, OS X or any X86/ARM/RISC/PPC OS. Do not use PC at all. It's bloat
222 likesReplies (14)
Dont exist, its bloat. Also templeos
0 likes@@saveliyivanov9943 So, MIPS is still in thd table?
0 likesgo go gadget 6502!!
2 likesWhat about SPARC
3 likesI use a TI84 for all my daily computing
2 likes@@halfhalf622 6502 gang
5 likesGot it. Instead of using x86, ARM, RISC, or PPC, I will use the Motorola 68060.
9 likeshumans are worthless and a bloat to my earth right click and select all humans, and Shift click Delete to permanently delete humans
0 likes@@saveliyivanov9943, don't live. It doesn't worth it.
11 likesNo I use macOS on a laptop
0 likesdo not let your mom give birth to you. You will have so many responsibilities and taxes in the future. It's not worth it
33 likesAn exception will be made for TempleOS.
54 likes@@GeekIWG try not signing up on earth, it's full of bloat and paywalls, it's bloat
70 likesDo not use a house. Homes are bloat, plus they usually come with windows.
146 likesextended endermanch intro dropped
68 likesReplies (5)
@@someidiot4311 yes
0 likes@@someidiot4311 He also used this identical "piracy discouraged" intro on Activating Windows 95 with ChatGPT.
0 likeshes done it before. i think on either sulfoxide or solaris he added a warning for flashing lights.
2 likesthat was a very slick transition into the normal intro, i don't think i've ever seen someone use a previous section of their intro song to extend the intro backwards
3 likesSong is called "Landscaping" by "Windows 96"
9 likesWait... Can non-administrators access the sam/registry files?
51 likesIn theory, could they copy them from a "secure" corporate machine, to a USB and take it home, import the hives crack it at home?
Most corporate PC's have one local admin account for remote IT or troubleshooting.
Replies (7)
@@Endermanch yeah thats why you use bitlocker, secure boot, prevent DMA Access and dissallow USB Sticks. If I have direct access to a PC without these things , I simply can do the old sticky shift trick to log in as system and then just set adminstrator password through the GUI.
0 likes@@Irongrip62 which is why the disk should always be encrypted and delete the contents if you try too many times
1 like@@Endermanch Ah I see, welp there goes the BitLocker bypass idea.
3 likes@@Kippykip
7 likesSomeone (of at least average IQ) who wants to attack and steal passwords from a high-profile corporation’s central system would probe it for weaknesses and, if needed, install either a rootkit or a backdoor to ensure uninterrupted activity. In a sane world where security is taken seriously, there would be several defense layers to deter, detect and trace any unauthorized attempts to hack their mainframe.
… however, we do not live in a sane world… not anymore. If big corporations’ extreme cost cuttings bleed over to their server-side security, it’ll be only a matter of time before we see major leaks and significant damages.
@@Irongrip62 I meant for, hypothetically an attacker that wanted to access some confidential corporate data from the local machine. Local admin access is an entry point allowing you to extract the bitlocker key and browse all user profiles etc.
14 likes...In minecraft of course.
If you have physical access you can just remove the harddrive and image it.
21 likesYou need the administrator token + SeBackup privilege to access SAM. However, the SAM hive is simply a file in %windir%\system32\config, so you can dump it after booting using a USB stick or something along these lines...
44 likesOfficially, NT is short for Windows NT.
27 likesAnd the NT in Windows NT doesn't really mean anything according to Microsoft.
Replies (11)
@@WndSks it literally means new technology.
0 likesLook at one of the Channel 9 history episodes, there is a NT 3 poster that says New Technology. Some people also claim it stands for "N Ten" (a CPU thing related to Cutler IIRC)
0 likes@@Xnoob545 it is but it has celebrated its 20th anniversary like a few years ago. macos modern versions are based on unix. the kernel can date back tot he 90s
0 likes@@Xnoob545AFAIK it's commonly known as either "NT File System" or "New Technology File System", but I've heard some people call it "NT Future Storage" also. I have zero idea what Microsoft calls it.
0 likesI mean isn't NTFS "New Technology File System"?
0 likes@@Zooiest ATM machine I can understand, but PIN number just sounds so dumb, I can't with that one
0 likesPIN code makes more sense ig, or just PIN
windows 2000? windows nt 3.1 is from 1991 and it means new tech. new tech from 1991. 😂
0 likesNot really. I'd argue that in some cases RAS syndrome even sounds more natural than the alternative, and it can be used intentionally for emphasis or clarity. Think PIN number or ATM machine.
0 likes@@lmnk "Not even Tried"
2 likes@@markusTegelane i was curious and did some research, i found on the Wikipedia page for ntlm it says nt stands for new technology but does not provide a citation. the Wikipedia page for Windows nt has a citation under naming that points to a q&a with bill gates where he says "When we first released Windows NT in 1993...the letters stood for "New Technology."
0 likesBut the letters have long since lost any specific meaning. Today, 'NT' is just a designation for our high-end version of Windows."
so yeah you're right it no longer officially has that meaning. still interesting to learn the history
NT stands for "noobs team"
6 likesShe crack my password till I windows
145 likesReplies (14)
@@ArinStitch disproven i found dat shi funny
0 likes@@HaryanviKashmiri if it's funny to you then you lack a proper sense of humour.
0 likes@@ArinStitchits funny
0 likes0 likes
@@pundauoun [EXTREMELY LOUD INCORRECT BUZZER]
0 likesUNFUNNY COMMENT ALERT GO WEEEEWOOOOWEEEEEWOOOO
5 likes@@Bernardoskau hell nah
0 likesThank god it's not "she crack my password till she 11" 💀
13 likes@@pundauoun [EXTREMELY LOUD INCORRECT BUZZER]
0 likes@@dadarkmatterdudeyou people are behaving like boomers, so miserable
0 likes@@dadarkmatterdude same.
0 likes@@Player-fg4ub, gen alpha memes. Neither i understand it.
11 likes@@pundauoun, i think the last part should be like "till i windows" or something.
2 likesi don get it
3 likesThere's plenty of policies to configure Kerberos in a domain setting. The threat model here is pretty limited; a stolen, powered off machine would ideally have bitlocker, which would first need to be compromised
12 likesbro didn't get hired 💀
38 likesReplies (1)
😭
0 likesYouTube would rather be magenta and delete enderman's videos but wouldnt ban the elsagate content
14 likesReplies (6)
@@whamer100 IK FR
0 likes@@TheTR0Nalt YEAH I REMEMBER THAT
0 likes@@whamer100 yeah like someone named themisterepic got taken down covering this content (it was censored I think) but the original videos are still up
1 like@@TheTR0Nalt The part that gets me even more is the people who create videos talking about the disgusting videos getting taken down for the kind of content that the OTHER videos are showing from being highlighted. It's so backwards
1 like@@whamer100 I don't think anyone does as it is revolting I can't stand it without reporting it 5 times
1 likeI still cant believe all the things youtube does in the names of protecting kids (just one example, not an umbrella accusation) and then just leaves the elsagate type of content up for all to see. its disgusting and I dont like it
1 likeJust by definition a hash function with variable input length like a password will have collisions if the output length is fixed. You have unlimited inputs but only limited outputs
4 likes1:35 I feel the need to nitpick here. A hash function is not considered "compromised" because it has collisions. They have a fixed length output and can take inputs of arbitrarily large size, so you have an infinite number of inputs and a finite number of outputs. It is not possible for a hash function to never collide, and SHA-256 is still cryptographically secure. There is no better approach than brute force, and it is completely infeasible with today's technology to reliably find collisions.
7 likesAlright, bet that YouTube will takedown one of the videos again, and we'll have the fiasco again. 💀
8 likesHiding the key in the registry is like... Just what? This is like a crutch of crutches. Who is that even for? What does it protect? From whom?
21 likesReplies (5)
@@DimkaTsv that's pretty much exactly what I was saying. See my response to radioactiveblueberry. Windows not using salt is bad in the first place, I was pointing out that hiding a key in some insane barely accessible field for no good reason is incredibly weird.
0 likes@@mike_diz Isn't main difference here is salt?
1 likeBecause you can excalate to Trusted Installer priveleges by using external OS to tamper with hive.
Same as you can use new Linux install to access file from another one.
So it doesn't matter much where passwords are stored. Main issue is fact that hash is unsalted.
@@RadioactiveBlueberry first of all the dude above is absolutely right. Second of all, yes, a dll or whatever is fine. For some reason linux doesn't have to go through all that bullshit because it actually uses a sane methodology. The password hashes are stored in /etc/shadow and use salt. You can read it only if you have root rights. It works. So your point would be?
1 like@@RadioactiveBlueberry
2 likesThe parts of the key are stored in separate locations in the registry which are also the same for every Windows installation. Enderman even points this out at 8:25. So, what is your point?
Edit: specified that the subkeys are stored in the registry.
Where would you hide it instead? On a DLL that's same for every installation?
6 likesThank you soo much, I got a hard drive from my campus, they are updating their classroom hardware, it has an original windows xp professional on it but I didnt get the password for it, wich means all I can do is what it was intended for (openning power points and other class related stuff), they told me I should just format it anyway but I'm sucker for windows xp and I'm not giving up on it.
3 likesMaybe I just haven’t seen an Enderman video in a while but I’ve never heard them voiced before
6 likesEnderman is so brave man like he got 2-3 strikes AND HE STILL DID THIS VIDEO
2 likesyeees voiceovers are back! thank you!!
5 likesA other enderman video? Christmas came early!
2 likesHi Enderman, great video.
5 likesI know what YT did to you, and you got 2 str-whatever.
If YT t————— your channel, will you keep uploading on your “Andrew” account or just make a new YT account and just name it Enderman and just continue there? Just asking cause I love your channel. Just be sure to download your videos via YT studio to device (At least your 10 latest) so just incase anything happens, you have a little backup of videos. Just like to know.
Love your channel. Have a good day❤
Lets hope Youtube doesn’t take this down despite there being a warning
2 likesHaven’t seen the long landscaping intro in a while, it’s amazing lol
1 like"Security is not about preventing every attack, but about delaying attackers long enough for you to react."
9 likesYou know the videos good when it starts with “This video is for educational purposes only”
1 likeWhen the long intro rolled, i already knew it was good.
1 likebtw, the nostalgia when the intro rolled....
if one singular person hits that report button this video will 100% be no more
2 likesMuch respect for you man. You made me learn something new to thi shitty windows world and definetly convincing me to pass to linux. Your channel is so underrated
0 likesThis is done only for the basic Windows password on a local account right? And not for the Windows Hello PIN or (dare I mention it) a Microsoft account login? If not, that's probably why Microsoft hasn't fixed it. From their perspective they already have fixed it: just use a Microsoft account instead of a password.
18 likesReplies (7)
@@throwaway6478 you mean you can crack bitlocker as well?
0 likesAs a Kerberos secret in the AAD service, not in the SAM. You might want to check these things before trying to spread FUD - especially to people who actually know how Windows works.
8 likes@@throwaway6478Bitlocker is also quite bypassable for external TPMs if you can find the LPC pins on the motherboard, or with a USB debug cable on Intel-based systems.
0 likesThe last password used to login to a MS account is saved to allow logging in when a system is offline.
3 likesGuess where that password is stored?
@@lmnkCorporate is using AD with Kerberos.
0 likesNo one sane in the corpoate segment would use login through a MS account. This is not an excuse.
9 likesYep. It's also screwed if you have a syskey or Bitlocker.
8 likesBrilliant! Love the way you explain things. Someone once said - if you can’t explain it to a five year old then you don’t understand it.
0 likesAnd that’s exactly how you explain things. So simply. That’s very rare in the IT world.
My only negative is you said wallah instead of voila 12:54 😉
I love how the intro screen is basically "Youtube for the love of god dont take this down im not teaching people to hack the fbi"
1 likeThat amazing, never thought about that print function in the registry, seen print button a million times but never thought once of pushing it and seeing what happens, very clever of windows to do that.
0 likesDon’t keep complaining about Windows, he needs to create his own OS at this point
2 likesGreat video, I was not expecting to be this interesting. I tried your script on a windows 7 machine but it didn't work, it said something like "IV must be 16 bytes long", later I'll edit this. I think it's because the windows 7 registry is different from 11 because with your example reg I managed to run it fine. While scrolling both regs I found some differences like the amount of users and user types as well the security questions that kinda don't exist in 7, max it has is the password hint
0 likesI heard years ago that if you have a password over 14 characters then Windows uses a different hashing algorithm or something, can't really remember the details.
0 likesEnderman once again breaking Windows and asking YouTube not to take it down
0 likesi too love cracking passwords legally!
4 likesYOUR CHESS ELO IS 2000!?!?
3 likesI loooove your videos, nice that you are restoring the vid schedule 🔥🔥 Keep it up! ❤
0 likesWell, you know what they say: "Windows security keeps only the honest people out"...
0 likesjust realized there's a small "easter egg" in VMware window at 11:49, there's a VM called "Windows 12" :p
16 likesReplies (1)
Its from April 1st video
2 likesIf a random guy on the internet did it imagine what the three letter agencies aren't doing rn.
1 likeReplies (1)
I mean, the last time we got a biggest hack to ever be, and few sidekicks. Also didnt FBI recently discovered that lots (really lots) of american computers were compromised by some very old, weird and sneaky russian virus?
0 likes4:25 i can imagine there arent exactly technicians who love their jobs working there
0 likesyou know a video's gonna be good when it has the extended intro
0 likesBing bong enderman gone
5 likesThe registry api does let you read the class name for the key. It's trivial to automate reading this obfuscated data. Spend an extra hour and add it to the script.
0 likesThis is why i have no friends.
1 likeSo , you can't crack the password ONLY if you are logged to the owner's computer , so what's so special ?
2 likesReplies (1)
@@ZiedKammoun it works if you have a copy of the registry… or access to the disk or simply the guy is in a meeting and you use it meanwhile. Btw how often is the password used on pther devices as well?
0 likesthat class name trick is insane lol. security through obscurity and not through, yknow, actual security
0 likesALL Hash functions WILL theoretically have collision(s) - if the bit length of the source(s) is greater than the bit length of the hash.
0 likesas Soon as i see the "This video does not condone or promote hacking or any other illegal activities." Screen i get flashbacks from when enderman couldnt post and had trouble with youtube xD
0 likesyo Andrew, did you ever think abt going to linux or ever did?
0 likesthis same experiment with unix-based operating systems would be interesting
0 likesdisclaimer, dah
3 likesneed save a pc with a idiot password installed on it from your little brother/friend/any family member(actual situation of many users)
Replies (1)
Uh...what about the sethc bug? Weren't it like, easier i suppose?
1 likereally interesting video, also lmao so many disclaimers, hope u won't get banned again
0 likesbro really said: "Yeah Im not getting another strike, Im going all in on the disclaimers" 😂
0 likesthats very interesting, I've always wondered if it was possible to crack windows passwords but i did NOT anticipate MD4 of all things...
0 likesDoes this work if the account has a PIN or are PINs stored differently?
4 likesReplies (1)
nah it doesn't work with microsoft account
0 likesI wonder how windows hello PIN works (I've used my microsoft account and a bit scared, although i have 2FA enabled)
1 likeAmazing that "show file extensions" is STILL deafult off.
0 likesAh yes, feeling Kirky, when I wish to boldy go where no one has gone before!
0 likesQuestion: does windows hello use the same algorithm to store credentials? PINs aren't as secure passwords but if hello has updated the encryption then just checking "letters and symbols" makes it a password.
0 likesThis attack requires you to practically already have access to the user folder contents (at that point just look at their chrome passwords in plain text), requiring some network exploit or physical access. Both can be thrawted by turning off your computer when not in use and using full disk encryption- if you don't trust bitlocker and tpms then veracrypt is fine, but bitlocker is inherently as secure as long as you have a password to get in. At that point keep your recovery key and password secure- if stored on your MS account then have 2fa on. It can take just one point breached to compromise multiple accounts of yours.
Now for the TPM that's a different story but tldr depending on your hardware theres really basic attacks you can execute to obtain the code the TPM sends to the is to decrypt. I haven't seen this for the firmware toms built into CPUs but regardless don't solely use the tpm- better security would require proof its you authorized signing in (the password) and that its signing in the right location (the TPM in theory).
"Nobody stores passwords in plain text". Hahaha, I wish.
0 likesGreat Video And Interesting. I hope YouTube Doesn't Take It Down
0 likesI sure hope nobody uses this to get into the NSA servers
2 likesyou found yet another reason why you shouldn’t make a local user account and then linking to the MS account in Windows 11 (like imagine decrypting your password of Windows that is/was also used in other MS services (like Outlook, Office and so on…))
0 likescan't wait for microsoft to release MD4NT
0 likeswhere is store the hash of the passwors ? in regsitry?
1 likeI wonder if you could get the class name through powershell
1 likeMe who forgot my password: this is very useful information
0 likesYou can literally get admin access to any computer by going to recovery options and using the CMD, along with some clever batchfile & regedit
0 likesReplies (3)
@KSPAtlas I made this comment before I watched the video, still thanks! OvO/<3\
0 likes@@KSPAtlas You can use bootable USB in windows installer press shift + F10 or press buttons to get cmd
0 likes1. This video is about extracting passwords, not bypassing security, enderman literally mentions it
3 likes2. Not every windows computer, it is possible to disable CMD in recovery options
The question is, does this also kinda work with network/Domain accounts. Because if I am not connected with the network, I can still log on, so it has to be stored locally.
0 likesBro knows his way around the NT Kernel more than some kernel devs at M$
0 likesPhysical access to your computer = gg
0 likesAlways rubbed me the wrong way how Windows stores the length of your Hello PIN to enable automatic check once you entered the last digit/character.
0 likesto do this you only need to have the full unencrypted disk content and the password used must be already hashed.
0 likeswhat;s the intro song called, i have nostalgia from watching enderman break windows for 2 years straight. i need my dose of intro song
2 likesReplies (3)
@@StealthTrooper36_ np
0 likes@@phruz9212 thank you
0 likesLandscaping by Windows96
0 likesBabe wake up new Enderman upload.
0 likesDoes this work with Microsoft accounts too? Or just local accounts
1 likeAt this point windows 11 feels like a joke to me
22 likesReplies (3)
@@Skillnoob_and the overfilling the os with telemetry, cant forget that
0 likesIt is a joke, Microsoft only cares about money and not actually making a good OS that isn't bloated with 200 useless AI features.
9 likesright esp with how soon W12 is
3 likesNext video: The Shocking Ease of Pressing Shift+Restart to Bypass Windows 11 Security Altogether
0 likes(And the shocking ease of "decrypting" the ROT13 used by default in the UserAssist key, enabling WDigest authentication, etc.)
so this is what dave meant when talking about hidden registry keys
0 likesIt's ok enderman, to be fair, illegal or not, it'd better to share so maybe Microsoft start fixing their os
0 likesI love videos in which you explain things like these to us!
0 likesBro has been changed the tile and thumbnail instantly
1 likeAfter few days later of uploading this video 😅
I have been back up at this video on my channel so when YouTube has been deleted you can still see it 😂
Can the sethc bug and net user * username be considered password cracking?
7 likesIve tried it out once, invoking the cmd via the sethc bug and then typing the net user * <user> to change the password but I'm curious, does that count or not. No I'm not preparing something nefarious.
Replies (2)
@@ellie_is_jellie Oh, thanks.
0 likesyou're not cracking the password, you're just changing it
9 likesI think I had that same motorcycle photo on a capcha before!
0 likesi guess physical access to a system or the unencrypted disk would allow to expose someone's password, which may be the same as various other of their passwords. I imagine password stealer malware is already using these methods, too.
Although I imagine this is only for local accounts? Also, what about for windows domains?
I think he is a russian using english to entertain a korean person who uses english more than korean.
1 likeI have an issue with Sam module
0 likesI have installed via pip install Sam but says cannot find f2tdt
I didn't find a solution on the internet
enderman whats your favorite minecraft mob
0 likesNow we know the real reason why you need TPM 2.0 for Windows 11.
0 likesEnderman: THIS VIDEO IS MADE BY PROFFESIONALS AND SOLELY FOR EDUCATIONAL PURPOSES
0 likesMe: WE ALL KNOW IS ENDERMAN A PROFFESIONAL WHY DO U SAY THIS?????????
Edit: I mean Enderman is a legend♥
For a company whose OS already takes telemetry to previously unimaginable levels and whose 'total' Recall does so again, why is anyone in the least bit surprised? In a parallel wholly fictional world one could conceive a scenario where hackers being able to bypass holey security was at best simply ignored and at worst built in with nefarious intentions.
2 likesBro has been change the title in the thumbnail to something else
1 likeYouTube doesn't cabinet is a crime 😂
Replies (1)
Lol 😂
1 likeI knew a bunch of the parts how they worked, but never seen it documented (I hadn't really searched for it)
0 likesIt won't work if you use your Microsoft account
1 likeHere before the video gets taken down
0 likesIf I get it right, you have to have the access to the computer unlocked to unlock it, right?
0 likesThank you gru for teaching us
1 likeMicrosoft runs on Linux. That’s their dirtiest little secret.
0 likesFor a second I thought you would be talking abut decrypting ROT13.
0 likesDoes this Technique also work to find the Admin password?
0 likesif this is actually crackable (which I'm sure it's still not) this still feels illegal by any means (not at my pc to try it and doing it)
0 likestry running minecraft while malware and MEMZ is running hope this will be an video soon!
0 likesLinux isn't any safer it's the /etc/passwd and /etc/shadow
3 likesReplies (11)
@@cinderwolf32 Agreed but given the fact that ppl have the reaction, linux doesn't have such an issue makes this fact being known
0 likesGiven the premise of this video is explicitly stated to be about cracking to find a working cleartext password and not just gaining access at the very start, it seems a little off-topic to backpedal to the "but I can gain access without cracking it" argument
1 like@@throwaway6478 if you reset the password, you dont get to know the password. if you crack it you do, and a lot of people use the same passwords for multiple sites, computers etc
0 likes@@sasha-fe2bl that's windows trick also works only for Admin account or drive access. He's reading thr registry. Also, won't the pc decrypt the C drive to use the files, use some sense there
0 likes@@ahq_founder not if the drive is encrypted like i said. also if you already have root access or access to the physical drive it's too late anyway.
1 like@@gabriledyt you need to understand that the highest level of hashing also cannot prevent fs removal of the file. Also, to read those codes, you'll need admin access, and that already means the pc is dead
0 likes@@gabriledytI like how you pretend that it matters somehow. The result is the same: unrestricted access to the machine.
2 likes@@ahq_founderthis is not reset , it's cracking
1 like@@sasha-fe2bl If I can literally remove the file and login without any pass, that doesn't mater if its sha512 or blowfish or even gibberish
2 likes@@sasha-fe2bl pretty sure you need admin acc perms before accessing those hash
0 likesexcept it's salted SHA512 or yescrypt, also LUKS
2 likesNow I wanna know how does MacOS and some popular Linux distros store them?
0 likesReplies (1)
It depends. Apparently, one user on stackoverflow observed a Mac using SHA-512. Linux's /etc/shadow file specifies one of many formats for each password (MD5, blowfish, Sha-256, SHA-512, and yescrypt). My debian installation uses yescrypt, which Wikipedia describes as "more resistant to offline password-cracking attacks than SHA-512" and is used on Fedora, Debian, Ubuntu, and Arch.
0 likes(Video idea) Why dont you try to fill up the windows clipboard (or you cant do that)
0 likesthis is quite old thing as of 2013 disabling legacy crypto functions is performed by almost everyone
0 likeshere before yt deletes the video
0 likesHey man! i was wondering... whats the music name in the intro?
0 likes10:32 Bro made his VM at 1:51 AM 💀
0 likesThey gotta be doing this on purpose because ain’t no way a company that big is making a mistake this easy to fix. 😂
0 likesOk, so I tried out the script on my own Windows 11 installation. I believe I followed all the steps correctly (although I had to modify the samreader file to make it compatible with Python 3.10). I got an NT hash output, but it doesn't seem to match the MD4 hash of my PIN. Is this supposed to give me the hash of the PIN or something else? (I'm not sure if I have a password set on my account).
0 likesthis is actually really surprising, like what, my little hello world php program has better security then
0 likesLooks like Microsoft trows your passwords trough the windows...
0 likesNot related but i can assess file in Windows by using Linux based OS and it works (no bitlocker) and can read all files
0 likesDoes this also crack microsoft account password since it's the default option?
0 likesI wonder if it is mathematically or even logically possible for collision-free hash function to exist.
0 likesReplies (2)
@@Endermanch I just gave it some more thought and I think it is only possible if input data is shorter or equal in length to the hash value itself. If data is even one bit longer it is impossible. In ideal case, input data one bit longer that the hash value itself, would produce exactly two collisions, 4 colisions for 2 bit length difference, etc.
0 likesI don't think so, you can minimize the probability of collisions to the point where they pretty much won't occur, though.
0 likesYo endermanch! What kind of wallpaper do you use if its from wallpaper engine? Or did you make it yourself?
0 likesMicrosoft, no... Not security through obfuscation...
0 likesOK so how did you FIND this?
0 likesim starting to think that windows passwords are unsecure on purpose
0 likescan i ask what programming languages do you know?
0 likescracking passwords is wild 💀💀💀💀
0 likesdownloading it before YouTube takes it down
0 likesSounds like you're just salty with Microsoft for a very old auth method (provided for compatibility with old business systems, not for actual use with your account). :P
3 likesReplies (3)
You both are probably correct (btw Microsoft doesn't hide information about this)
0 likesIt does in fact use CNG BCrypt AES256 on Windows Server 2016 / Windows 10 and later (previous versions use DES + RC4)
BUT!!! There is peculiar note here. Quote:
"On domain members and workstations, local user account password hashes are stored in a local Security Account Manager (SAM) Database located in the registry. They are encrypted using the same encryption and hashing algorithms as Active Directory."
Key part here is "On Domain members and workstations". Meaning that it does not affect personal use systems without specific setup.
Neither you really should be panicking that much about possibility of bruteforcing hash of your Windows password. If perpetrator has this level of access to your system, you already is boned, as he can just reset said password and gain access anyways. Or use ton of other ways to work around. Moreover, you can do similar stuff on Linux (not bruteforcing, but resetting password)
@@Endermanch I'm sorry but current versions of Windows encrypt NT password hashes with DES + BCrypt (256) before storing them (before it was DES+RC4). So while the hash itself is potentially vulnerable, you won't have access to it. LM has been disabled as a storage method for a long time. Also, NT hashes draw from the entire unicode character range, not just ASCII, basically each character being chosen from 64k possible values. So you can't just discard NT hashes as being "just as vulnerable as LM" because they aren't.
2 likesWhat do you mean? It's used in production, right here. Windows 11 hashes your local passwords into NT hashes. LM hashes were provided for compatibility reasons, but later phased out. NT hashes must be obsolete too, because unsalted MD4 doesn't rhyme with security.
1 likeNow THATS why i use Temple os
0 likesDoes this work on Windows 10?
0 likesmy SAM in registry was empty?
0 likesis the password stored the same for domain accounts as well?
0 likesPlease can you make a video looks like Destroying Windows 10 OOBE
0 likesWhy would you let the world know about this...
0 likes10:07 ill print it out as a PDF file
0 likeswhy steal the password, when you just can take a windows installer on usb and cmd into your system, replace accessibility.exe with cmd.exe, reboot, open the terminal, activate the local administrator and you are in.
0 likesjust call it a feature at this point, microsoft. as soon as someone has physical access to your pc, its jover anyway. this is a similar principle as chroot, but the execution is terrible.
Replies (1)
i like bitlocker more
0 likesYoutube boutta send this video to god
0 likesThis most secure version of Windows.
0 likesThank god my password is strong
1 likeReplies (2)
That doesn't matter. If the hashing algorithm is insecure (better ways of guessing than brute force) and/or weak (small output and easy to compute) someone can find a weak password that produces the same hash as your strong one, given they have your hash.
0 likesBut the encryption algorithm is unsicure
3 likesI love microsoft and people trying to force me to use it. It clearly is way better than linux!
0 likesHow can such an insecure system still be the most popular OS?
0 likesAnyway is much more secure than Windows 9x security.
0 likesPassword? Cancel button
Does this affect only local accounts, or are domain accounts on W11 machines compromised too?
0 likesReplies (3)
@@wezu4972 oh right my bad, I tried with a PIN associated to my account (same as the video 9988) and it didn't work, but when I created a local account with password 9988 and 3 security questions it worked flawlessly
0 likes@@alexteles9968 I'm obviously talking about the exploit in the video that let's you get the actual password, not just bypassing the NTLM
0 likesLocal accounts afaik you can remove the password fairly easily with an installation media
0 likesI mean, technically I own my vms so i can crack the passwords on that...
0 likesbro literally put 3 disclaimer in his video
0 likes(1 description 2 video)
Ms will argue when you install windows and connect to the ms mothership…. Ya all be secure!
0 likesЧувак! Я сделал это!! Конечно в твоём коде было несколько недочётов и ошибок, например Crypto.Cipher и Crypto.Hasj и вместо sam.utils надо было просто utils, но в остальном всё работает!!
0 likesReplies (4)
@@EndermanchДа, я проверил и понял что делал что-то поначалу не так - код полностью рабочий, просто сначала надо было обновить pip и установить библиотеки python
0 likes@@EndermanchЯ использовал последнюю версию python 3.13, но код очень хороший! И также хочу похвастаться - я конвертировал код на язык powershell, тебе было бы интересно увидеть этот же код но на powershell без python?
0 likes@@Endermanch Ну пиши на русском, чел
0 likesThere are no mistakes in my code. You're probably using the wrong library and Python verison.
1 likedownloading a copy of this video before it gets taken down
0 likescant wait for this to be taken down by youtube - yeah im gonna archive this 😭
0 likes@endermanch there is a channel named 10G tech that is stealing your content
0 likesguys im gay
18 likesReplies (10)
@@Levroxxie, ew gay
0 likesmwreow
0 likeswacky
0 likesHi gay I'm Joe
4 likesI’m not but good on you for coming out
2 likesme too <333
0 likessame
1 likei found out that im going to turn into arab and recreating 18/22
4 likesSame. ❤
4 likesguys im not an ally
3 likes1:01 geometry dash:
0 likeswe be getting taken down with this one 🔥
0 likesDoes this apply if you use a Microsoft account?
0 likesI watch it before it’s taken down
0 likesi used,and it not encrypt my NT
0 likes2 videos in a week?!?!?!
0 likesEasier and quicker: boot to a tool able to reset administrator password.
0 likes"More secure and realible"
0 likesWith Kernel Level Spyware And More Shity Bloat
now do that to every other windows version
0 likesDoes this work for all passwords? I got some hashes through the scripts but none of them ended up working...
0 likesReplies (2)
@@Endermanch thanks. Another question, this works for pins as well as passwords, right? I'd assume they use the same technology for both
0 likesThe hash decryption works 100% of the time if you supply correct LSA components. The dictionary attack depends on the hash database you're running the lookup against. Complex passwords will most of the time require a bruteforce/mask attack using hashcat. Your GPU will assist you well in that case.
0 likesAndrew's channel demise coming in 3, 2, 1
0 likesWhat do you use for your wallpaper?
0 likesReplies (1)
Wallpaper Engine is one of, if not, the most popular choice for having an animated wallpaper on your desktop.
1 likeAfter searching a bit more on the web, you can also find Lively Wallpaper, which is a free alternative as in both price and freedom.
WE LOSING OUR CHANNEL WITH THIS ONE 💔💔💔
0 likesShe windows on my windows till I windows
0 likesYou're getting locked up
0 likesThanks for the information!
1 likeFor me it looks like Microsoft does it on purpose for alphabet boys
0 likesPlease send me links to all Enderman videos that YT has taken down :)
1 likeBig YOUTUBE is watching
0 likesElon musk's computer: "Its over... 😢"
2 likesHere before the inevitable strikedown
0 likesenderman is my fav mob in minecraft
0 likesHuh... Interesting.
0 likesThanks for the video!
in macos you can just reboot and reset password in terminal when you use recovery mode LOL
0 likes8:12 where is the perfect bedwars gameplay by a "closet cheter with 5 blocks reatch" that claims to be legit the the background fr
0 likes10:05 this new trend gave me a fright man, whos the pdf file /j
0 likesdownloading this video with yt-dlp before youtube tacks it down 😭
0 likesAnd then there's Linux which is bold enough to store passwords in an easily found, unencrypted text file accessible by root, but that's ok because at least it uses strong hashes like sha512 and yescrypt plus it actually salts them.
3 likesReplies (13)
@@throwaway6478
0 likesCopy registry hive
Change password
Profit!!!
Restore registry hive
@@throwaway6478 Yep, at least assuming you have physical access to the computer and it's unencrypted, or already have root.
0 likesback up password file
5 likeschange password
log on and do what you like
restore password file
Done. At least Windows (and macOS, interestingly) has some protections against doing this - Linux has none.
@@ahq_founder Yes, the /etc/shadow file.
2 likesWell, you just need to change one file in the ext4 file system, and the password of the user gets gone
3 likes@@maya20484 I mean you could also just save the registry hive, change the password and do your nefarious activities and then restore from the backup.
0 likes@@maya20484 Exactly!
0 likes@@0xfadead Ah, no worries!
0 likes@@0xfadead In addition to what was said, also see the point of the video - it's one thing to breach a system by forcibly changing its password, and whole another thing to breach it by retrieving the password. With the latter your entry into the system stays relatively hidden (whereas with the former it would be very clear), and you could use the password you retrieved to try entering other systems, accounts etc. as it's common (bad) practice for people to use the same password everywhere.
1 like@@0xfadead In addition to @GeekIWG's response, see the point of this video - it's a very different thing to breach a system by forcibly changing a password, and a whole another thing to do it by retrieving the password. With the former not only you make your entry into the system very clear (whereas it would be much more hidden if you didn't change the password), at the end you don't know the password which means you can't use it to try logging into different systems, as reusing the same password is a pretty common (bad) practice.
0 likes@@GeekIWG Oh sorry, I read it wrong.
1 likeSorry again!
@@0xfadead Just that Linux doesn't have to do all this weird obfuscation and encryption that Windows does to try to protect passwords since Linux does things properly with strong hashes and salts.
3 likesRoot can change the password of other users anyway, what's your point?
1 likeSecurity through obfuscation.
0 likesVideo previous title is cracking windows 11 passwords
0 likeswait a minute? endermanch loves comments? thats nice? no big creator does that because obviously they dont have time to read comments duh
0 likesYou pay much more attention to how Windows works than Microsoft
7 likesIf YouTube takes this down, I’m gonna explode
1 likeReplies (1)
The techniques used in this video have been known for almost 30 years, and are far better documented elsewhere - including other Youtube videos that haven't been taken down in 10+ years.
3 likesU r living my life😂bcz i always wanted to be just like u ❤
0 likeshey bro can you make video of password hacking pls i cant execute exe files in a school computer cuz i downloaded vmware and bluestack to play android games pls bro
1 likepassword method i like:
reset password in cmd
crack password vault safe
change password in cmd
remove password in cmd
Replies (1)
lmao
1 likefeds gon love this
2 likesReplies (1)
Feds already upset their secret is exposed 😂
6 likesHopefully this video stays
0 likesyt-dlp ing this before it gets taken down
4 likesReplies (1)
same
0 likesmy pc doesnt have anythiong in hkey_local_machine/sam/sam???????
0 likesLet's hope this doesn't end like the TrustedInst***r video...
0 likesSo it's still basically impossible to crack passwords in Windows. :)
3 likesReplies (3)
@@EndermanchI watched your clickbait, especially the parts where:
1 like- You bypassed Microsoft Account (which would have stopped you doing this)
- Disabled BitLocker (which prevents offline attacks on the SAM file and the sethc.exe trick)
- Gave yourself admin privs (which you don't get by default, need a password for, and require to get online access to the SAM).
All of these features are over a decade old - BitLocker is coming on 20 years old, and you had to specifically disable them all to mount your attack. Then you, and channels like yours, actually tell other people to disable them. If people are stupid enough to listen to you and your ilk, they deserve to be hacked by you and your ilk.
@@Endermanch Someone hasn't checked his own video idea. =)
3 likesSomeone hasn't watched the video
3 likesThanks good now I can crack my dad's PC password 😁🔑
0 likesGood luck man
0 likesYOU USED MICROSOFT EDGE IN THE VIDEO???
0 likesReplies (2)
@@aadarshroy3216 yeah but its an inside joke that he doesn't like MS edge
0 likeswdym it comes with the windows installation
0 likesThe death of windows
0 likesWindows is a joke.
0 likesTime to pobierz this video.
0 likesthat wasn't easy for me :(
0 likesHmmm JD in registry, if you say it in Poland, you are insulting a Polish YouTuber XD
0 likestl;dr NTLM rainbow table brute force?
0 likesHi enderman
0 likesalready downloaded to repost just in case :D
0 likesBig Ahh L for microsoft 😭
0 likesthis is already illegal
0 likesI can finally get admin rights of my school laptop /jk
0 likesLet's go. Excited to see Windows crumble.
1 likeI use Arch btw
0 likesI like the voice videos
0 likesI backed up this video on a ytb channel
0 likesWatch this get taken down lol
0 likesIm downloding it before it gets taken down lmao
0 likesAh what happened
0 likes@Enderman i think you should remove this before you get terminated
2 likesWhat you should do is make a new account, lie and say your in the US, then upload the risky videos on that account
Replies (4)
@@throwaway6478and yet, youtube removed activating windows with chatgpt
0 likes@@throwaway6478 then again, activating windows with chatgpt got removed
0 likes@@throwaway6478YouTube is biased though. I won’t be surprised if they do take it down
0 likesThe techniques used in this video have been known for almost 30 years, and are far better documented elsewhere, including other Youtube videos that haven't been taken down in 10+ years.
1 likee dur sihdir da heckim se qoz qoymur da
0 likesQuick! Archive this video before it gets taken down!
2 likesBro is going to get the vido taken down 😢
0 likesjust a hint RegQueryInfoKey
0 likesOk
1 likeendermanch can you teleport
0 likesI know zero about computers. But don't you need the password to get into the machine you want to find the password for?
0 likesMmm.
=====
Have to put the following or my commentary gets cut by the YT AI Robocop:
For entertainment/educational purposes only.
Replies (1)
He literally said "Why would anyone crack a windows password when it's so easy to force your way in without knowing the password."
0 likesEveryone, did you sync your clocks when it is October 27th 2024?
1 likeReplies (2)
@@samsunggalaxynote3868 Wait, didn't you sync your clock? It's normal time right now.
0 likesWhat?
0 likesWow, ok.
0 likesI’m downloading as well
0 likesWHAT THE HECK?!
0 likesTITLE CHANGE ANDREW!!!!!!!!!
0 likesReplies (1)
Yes!!!!! 😎
1 likei download this video
0 likesImagine seeing this video taken diwn, even with the disclaimer. Pure Windows removed once again for no reason.
0 likesReplies (1)
The techniques used in this video have been known for almost 30 years, and are far better documented elsewhere, including other Youtube videos that haven't been taken down in 10+ years.
2 likesStop lying to me, bro
0 likes98% of viewers won't be able to reproduce these steps. How is that "easy"? 😂
0 likeshow to NOT download adobe photoshop for free/how to avoid downloading free adobe photoshop for free
2 likesnoted
0 likeslinux
0 likeseveryone archive this video in some way before youtube does the opposite!
1 likeFor me it's always funny how easy it is to simply remove password from Windows account using tools builtin for example in Hiren's Boot CD.
0 likesI should've gone Linux instead of paying $200 for Microsoft Windows. God damn it.
4 likesReplies (7)
@@throwaway6478how, doesn't linux actually salt its password hashes?
0 likesEvery technique demonstrated here (and several more) work just as well against a Linux target.
2 likes@@dabster291 sadly yes
0 likes@@imaguyyesmale still technically paid extra for the windows license
0 likesIt came preinstalled with my laptop
0 likes@@weizkuleMSA? I just download the ISOs from Microsoft (IDK what MSA is)
0 likeswtf 200€ for windows????¿¿ i just use MSA and call it a day
1 likehmmmmmmmmmmmmmmmmmmmm
1 likeWindows 11 discourages the use of local accounts. Online Microsoft accounts are set up with two vector authentication and there isn't really a password.
0 likesIs there a variant of this exploit which can get access to the Microsoft account?
Hack password 😢😅
0 likesInsane...
0 likesLol
0 likes🎉
0 likesприкольно
0 likesomg
0 likeswe gettin striked with this one 🔥
0 likesHoly
0 likesReplies (1)
first comment
0 likesMicrosoft is actually dangeorus
0 likeswhat grudge do you have against microsoft
1 likeReplies (2)
man FUCK microsoft
0 likesit's microsoft
3 likesOphcrack does that automatically? Asks only for Sam reg dump
0 likesTutorial how to crack/hack :(
1 likeFor educational purposes :)
I sent this to my dad. I don't think he'll understand, but I'll send him it anyways.
0 likesNow crack a password on something like Ubuntu.
0 likesI just live boot Linux from usb
0 likesYoutube would still take this down, but it's a truth windows isn't secure.
0 likes👎👎👎👎👎👎👎👎👎👎👎👎
0 likeswindows 12: featuring linux UI no u cant perform linux commands but u can make it look like linux hmmm oh 1% gaming performance yes that will be good hmm ahh same password encryption yep nobody gonna notice hm ye lets restrict people from using cmd in windows login menu so they cant perform magic. idk i was bored hey XD i downgraded to win 10 fk win 11 i hope win 12 will not be dissapointed (jk it will prob be garbage) idk why they push win 12 when they released win 11 :D thats not even like that optimized idk.
0 likesReplies (2)
Much of the appeal of Windows (and macOS for that matter) is that it isn't Linux.
5 likesWSL and WSA: am I a joke to you?
2 likessee looks like my password never mattered
0 likes@Microsoft fix yo shit
0 likesMicrosoft doesn't care about local accounts anymore, so they will gladly allow them to be hacked.
0 likesThat's because Windows 10 and upwards aren't operating system anymore
0 likesthey have become giant spying devices . . look for their new owners
Remember... If Microsoft asks you to work at Microsoft be an asshole and don't accept
0 likesFor some reason for me my hash won't get craked, i only get "Result Not found." on crakcstation. Maybe is because i'm logged with my MS account?
0 likesso the TPM chip requirement is just B@llshit?
0 likesi love illegal crime hacking tutorials to exploit ppl
1 likeI figured out a way to get rid edge now. Go to HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge and set NoUpdate and NoRepair to 0. Do the same for EdgeUpdate. Then uninstall edge from settings. Locate to the install folder of edge and delete edge, edgecore, and edgeupdate (keeping the webview if you need it)
0 likesWinhoes is straight nsa spyware
0 likestrustedinstaller
0 likesthats why i use ✨linux✨
0 likesThis is why security by obscurity NEVER works. "Oh they will not figure out how to get the key anyway, we don't need salting" guess what
0 likesThe best way to keep your computer safe from ppl trying to get into it are 1. Keeping it safe and secure at home, locked in your house, and 2. Not getting itraatted by downloading and running suspicious/malicious .exe files
0 likesRip enderman idk-2024
0 likesProbably shot by microsoft any time soon
So. Why do people still use passwords on windows anymore? Use WIndows Hello or FIDO2 keys instead and always encrypt your drives . NTLM is antiquated.
0 likestry out on joined windows domain vm to crack password
0 likes/g/ is wild. Ignore security features like Syskey (invented 30 years ago) and Kerberos (been in Windows since 2000), then actively disable security features like Bitlocker (created nearly 20 years ago) and MS account (created over 10 years ago) bcuz YT ecelebs told you to - then complain that there's no security and you can hack it in seconds. 🤣
1 likethe intro sound lmao
0 likesYet won't work with MS account, because they want you to force to get the mark of the beast lol.
0 likesSeriously, it's amazing. Simply amazing. You were never forced to sign up for a spywaresoft account in previous windows versions, but in 11? SIGN THE FKING MS ACCOUNT UP, OR I FORBID YOU USING YOUR COMPUTER!!!
Well... That is if you don't know that the command prompt can be brought up in the OOBE. You can simply bypass it with the command prompt.
Or, even better: logging in to your supposed MS account, by typing "defaultuser0" in the username field. It gives a error, but it will move you to the local account creation screen! XD
Only with windows do you see such.... Technological wonders! XDDD
Cfgh vcc. C vc
0 likesBgv b bb g my bn gbb h hnh tfg h hg
0 likesthat's a reason everyone should use bitlocker. in this case only users admin will can to open regedit but user admin already can change any pass them want so
0 likesWhy do you do this when you know it is risky and they will BAN YOU. XD
1 like!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1 like!! NOTICE NOTICE NOTICE NOTICE NOTICE !!
!! I AM NOT AN EXPERT IN HASHING !!
!! NOTICE NOTICE NOTICE NOTICE NOTICE !!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
In your explanation of hashing you say that any hashing technique with collisions is unsafe. How would not having collisions be possible, especially when these functions are fixed length? You can't compress arbituary amounts of data into 16 bytes without having collisions. Do you mean predicting collisions instead?
The SAM key cannot be accessed without PE or TI/System?
0 likesLagLife made a vid abt NoMoreBugCheck 1 year ago
you SO HAPPEN to make a vid abt NMBC a few weeks ago
Problem Solved: just store it in piFS!
0 likes