EFS Crack
Printed From: CertCities.com Forums
Forum Name: Security Certs
Forum Discription: Discuss CISSP, SANS and other security certifications here.
URL: http://certcities.com/forums/forum_posts.asp?tid=1646
Printed Date: 20 October 2007 at 4:34am
Topic: EFS Crack
Posted by: derspot
Subject: EFS Crack
Date Posted: 27 January 2005 at 1:04pm
Hi,
I lost the private key i used to encrypt some files using EFS Encryption. I use WinXP SP2.
Is there any way ( cracking tools ) i can use to decrypt these files using brute force ? How long could that take ? |
Replies:
Posted by: TranscenderMike
Date Posted: 27 January 2005 at 1:36pm
If you log on as the local administrator account, you should be able to access and decrypt the files. On a standalone XP box, the local admin account is the Recovery Agent for that computer. However, on a domain, the Recovery Agent is the Domain Admin.
-------------
MCSE+I, MCSA: Security, MCDST, MCDBA, OCP, CCNP, CCDP, CNE, SCSA, CCSA, Security+, Linux+, Server+, Network+, A+ |
Posted by: derspot
Date Posted: 27 January 2005 at 11:15pm
| I do not use Recovery Agent. Just thought someone might know some other way .. |
Posted by: TranscenderMike
Date Posted: 28 January 2005 at 1:28am
Nope... if you refuse to do it the way Microsoft designed it, you're pretty much out of luck.
-------------
MCSE+I, MCSA: Security, MCDST, MCDBA, OCP, CCNP, CCDP, CNE, SCSA, CCSA, Security+, Linux+, Server+, Network+, A+ |
Posted by: rflemen
Date Posted: 28 January 2005 at 4:21am
The admin is a recovery agent by default...unless you deleted it. Then your screwed....
http://support.microsoft.com/default.aspx?scid=kb;en-us;2597 32&sd=tech - EFS Recovery
-------------
-rob |
Posted by: derspot
Date Posted: 28 January 2005 at 10:27am
| unfortunately i do not have the recovery option. I need brute force. I've read somewehre it takes pretty long to crack EFS |
Posted by: swishard
Date Posted: 28 January 2005 at 10:32am
Your done. There is nothing further you can do.
Always back up your keys when using EFS!
-------------
Scott W. MCSE:Security, CCNA & others |
Posted by: derspot
Date Posted: 28 January 2005 at 11:02am
oh really ? then what about this - http://www.crackpassword.com/products/prs/mswin/efs/
|
Posted by: HiOTW
Date Posted: 28 January 2005 at 7:45pm
Now now people lets play nice. You've discovered a tool now the next step could be to google for a software crack or patch thereby allowing you to decrypte the files. There is an method to recover EFS but I can't remimber the steps. Visiting openwall or doing a good google search should turn it up.
An alternative method which may or may not be successful is to run some data recovery software on the partition where the data is/was stored. The logic I gain is the original (unencrypted) files are only deleted and replaced with the encrypted files. If you run the data recovery software you could restore the original files thus allowing access to your precious data.
Good luck. :insert smiley:
-------------
On an exciting journey to Net+, CCNA, and A+ world |
Posted by: TranscenderMike
Date Posted: 29 January 2005 at 10:30pm
derspot wrote:
oh really ? then what about this - http://www.crackpassword.com/products/prs/mswin/efs/
|
|
|
If you already knew about that...
...then why did you ask the question in the first place?
-------------
MCSE+I, MCSA: Security, MCDST, MCDBA, OCP, CCNP, CCDP, CNE, SCSA, CCSA, Security+, Linux+, Server+, Network+, A+
|
Posted by: derspot
Date Posted: 02 February 2005 at 5:26am
well Mike , as you know it is all about Time. Given enough time you can become everything - a president , everything, there is no limit - so this means Time is the most valuable asset ever. Having this in mind you can ask the same question every single person who ever asked something here ot anywere.
Googling and finding a site which advertises something is only one thing. Having someone tell you - yeah i downloaded that , it works , try it ! This is different thing. Because ... Yes :) it saves time ! |
Posted by: swishard
Date Posted: 02 February 2005 at 7:39am
Well, I learned something new here. The MS line has always been, no key, no recovery is possible.
$99 isn't bad for what it can do.
-------------
Scott W. MCSE:Security, CCNA & others |
Posted by: Toivonen
Date Posted: 20 February 2005 at 1:36pm
derspot wrote:
oh really ? then what about this - http://www.crackpassword.com/products/prs/mswin/efs/
|
|
|
Wow, what a wonderfull software! It decrypts a 256 bit public / private key encryption <i>instantly</i> and <i>effectively</i>.
That probably decrypts PGP also!!
NSA ja FBI would love to get their hands on this software, but they are just too damn stupid to buy a license for one and start reading terrorist emails...
PS. I'm being sarcastic. That software does not decrypt EFS folders if both private key and recovery key are lost.
|
Posted by: cronoknight
Date Posted: 23 June 2006 at 3:56pm
| hmm, what would be one's option if one formatted the harddrive with the system stuff on, and left encrypted files on the other harddrive, and never backed up anything....some othere forum some dude tried to show a way using hex editor on backups and algorithmic stuff like that...cant some hacker person just make it easier for ppl....sheesh...newer windows are coming out, ms doesnt have to be so protective of xp anything... |
Posted by: Wildcat_Dude
Date Posted: 23 June 2006 at 7:26pm
So your point is? I take it you're not very familiar with EFS, read up on how it works.
Sounds like you want cracks to everything so you don't have to buy anything. hex editors isn't the end all of anything or everything nifty tools for everything protected.
So try invoking EFS on a folder and its contents, delete the keys & admin account, then reinstall the OS and what's the result? If you format the system drive and left the EFS protected files & folder on the other harddrive, what's the end result? Why not just take the drive out and put it in another machine, thats the same as formatting the system drive that you're suggesting. Can you unencrypt the files/folders? Think about it.
-------------
MCSE:Security & MCSA:Security, MCDST, MCP XP, CompTIA Sec+, A+ & N+
USAF (68-77) SP K9 Vietnam Vet 1969-DaNang, 1970-Tuy Hoa, Retired Police Detective/Narcotics/K9
|
Posted by: Markoni
Date Posted: 20 September 2006 at 6:22pm
Hello:
I'm having a problem with EFS. I inadvertently encrypted a directory under Windows 2000. I backed up the 'Documents and Settings' folders (but did not export any keys) before reformatting the hard drive, and was left with quite a number of encryption keys in various locations. I've now switched to XP, and am unable to decrypt the encrypted files (which are still on another drive - I've not been able to move them). Advanced EFS Recovery doesn't do the trick, and I've tried moving the old key files to the XP locations where I presume they should be, but again without success. Is there any way around this problem?
Many thanks for any advice. |
Posted by: tfrazier
Date Posted: 02 May 2007 at 12:36pm
I was amazed at how well the software worked.
-------------
Kyshia |
|