Method for acquiring logged-on user password from memory mirroring documents of 64-bit Windows operation system

Abstract

The invention provides a method for acquiring the logged-on user password from memory mirroring documents of a 64-bit Windows operation system. The method comprises the following steps: (a) acquiring version information of a system; (b) acquiring the value of a PEB structure variable from aCR3 register and a process environment block of lsass.exe process; (c) dumping execution samples of dynamic link library lsasrv.dll and tspkg.dll; (d) acquiring key related data; (e) acquiring user information from lsasrv.dll; (f) acquiring a login user master certificate from the tspkg.dll dumping document; and (g) acquiring the password. The method for acquiring the logged-on user password plaintext is accurate and efficient, has the analysis effect not influenced by password complexity, and is an important means for acquiring user login information from a physical memory mirroring document; and the acquired login user password is an important evidence in computer online evidence collection.

Description

technical field [0001] The invention relates to a method for obtaining the plaintext of the password of the logged-in user, more specifically, a method for obtaining the plaintext of the password of the logged-in user from the memory image file of the 64-bit Windows operating system. This method will be applied in the field of computer forensics, mainly for the investigation and evidence collection of information security incidents and various computer crime cases. Background technique [0002] There are some information in the physical memory of the computer that can describe the state of the system when it is under attack, such as the information of the currently running process, the information of the dynamic link library loaded by the process, the name and password of the user currently logged in to the system, the information of the opened file, and the information of the network. connection information, etc. This information disappears with the shutdown of the compute...

AI Technical Summary

Problems solved by technology

Since then, the analysis and acquisition of physical memory has become a hotspot in computer forensics research. However, when users log in to the computer system, their passwords are stored in ciphertext. We can obtain the corresponding NThash value or LM through memory analysis. Hash value, for the acquisition of password plaintext, it needs to be completed with the help of related decryption software such as SamInside, but for passwords with high complexity, the time required for decryption software will be correspondingly longer

Images