<story><title>Ken Thompson&apos;s Unix Password</title><url>https://leahneukirchen.org/blog/archive/2019/10/ken-thompson-s-unix-password.html</url></story><parent_chain><item><author>lordlic</author><text>I was expelled from university for pulling off &lt;i&gt;the exact same exploit&lt;/i&gt; with the &amp;quot;workstation only&amp;quot; feature in Novell. In my case, they put a computer in every dorm room, and every single one of them had a domain-wide administrator account cached in its SAM file. It was inevitable that a student would find it. It&amp;#x27;s been almost 15 years now but I believe the password was rac3c4r or something trivial like that. I ran Ophcrack overnight and in the morning I had admin access to every machine on campus.&lt;p&gt;I also had the bright idea to try this on library computers and email kiosks around campus used by thousands of students. Rather than booting into Ophcrack I&amp;#x27;d just log in with the admin account and run pwdump from a USB stick to collect password hashes. I figured out how to enumerate Windows machines over the network using NetBIOS and ran the pwdump utility remotely using psexec, so that I could hit every computer in the library at once, or every computer in a computer lab, etc.&lt;p&gt;I ended up cracking credentials for most students and faculty on the entire campus. I was really young at the time and thought this was some real cool James Bond shit. I never once used it for evil: never read anyone&amp;#x27;s email, never viewed anyone&amp;#x27;s private files, never poked around the academic file shares for test solutions, never tried to steal credit card numbers or social security numbers from the finance office&amp;#x27;s file share. It was purely a hack for the thrill of breaking down barriers and outsmarting the security. But MONTHS later after I had long since grown tired of tinkering with this stuff, a couple of uniformed police officers pulled me out of Calculus class and took me downtown. They tossed my dorm room and confiscated my computer and my phone and every piece of digital storage I owned. The school threw the book at me, I guess because they were so embarrassed by their incompetence on display from being beaten by a 16 year old.&lt;p&gt;(Posting on my alt account for obvious reasons.)</text></item><item><author>whalesalad</author><text>I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crack. It was so simple that for weeks I didn’t even believe it to be true, and didn’t realize the name of the account was an admin.&lt;p&gt;I was expelled a few months later for all the fun I had after discovering this. Good times.</text></item></parent_chain><comment><author>minikites</author><text>&amp;gt;I never once used it for evil: never read anyone&amp;#x27;s email, never viewed anyone&amp;#x27;s private files, never poked around the academic file shares for test solutions, never tried to steal credit card numbers or social security numbers from the finance office&amp;#x27;s file share.&lt;p&gt;I don&amp;#x27;t understand this justification. The system owners can&amp;#x27;t know that to be true and have to proceed as if the systems are compromised. Would you still feel safe if a burglar broke into your house and left a note saying they didn&amp;#x27;t take anything?</text></comment>
<story><title>Ken Thompson&apos;s Unix Password</title><url>https://leahneukirchen.org/blog/archive/2019/10/ken-thompson-s-unix-password.html</url></story><parent_chain><item><author>lordlic</author><text>I was expelled from university for pulling off &lt;i&gt;the exact same exploit&lt;/i&gt; with the &amp;quot;workstation only&amp;quot; feature in Novell. In my case, they put a computer in every dorm room, and every single one of them had a domain-wide administrator account cached in its SAM file. It was inevitable that a student would find it. It&amp;#x27;s been almost 15 years now but I believe the password was rac3c4r or something trivial like that. I ran Ophcrack overnight and in the morning I had admin access to every machine on campus.&lt;p&gt;I also had the bright idea to try this on library computers and email kiosks around campus used by thousands of students. Rather than booting into Ophcrack I&amp;#x27;d just log in with the admin account and run pwdump from a USB stick to collect password hashes. I figured out how to enumerate Windows machines over the network using NetBIOS and ran the pwdump utility remotely using psexec, so that I could hit every computer in the library at once, or every computer in a computer lab, etc.&lt;p&gt;I ended up cracking credentials for most students and faculty on the entire campus. I was really young at the time and thought this was some real cool James Bond shit. I never once used it for evil: never read anyone&amp;#x27;s email, never viewed anyone&amp;#x27;s private files, never poked around the academic file shares for test solutions, never tried to steal credit card numbers or social security numbers from the finance office&amp;#x27;s file share. It was purely a hack for the thrill of breaking down barriers and outsmarting the security. But MONTHS later after I had long since grown tired of tinkering with this stuff, a couple of uniformed police officers pulled me out of Calculus class and took me downtown. They tossed my dorm room and confiscated my computer and my phone and every piece of digital storage I owned. The school threw the book at me, I guess because they were so embarrassed by their incompetence on display from being beaten by a 16 year old.&lt;p&gt;(Posting on my alt account for obvious reasons.)</text></item><item><author>whalesalad</author><text>I remember cracking the password from a Windows system in high school. There was a centralized login mechanism using Novell but everything was cached locally. So you could boot a Linux CD and copy the password file to a memory stick, and crack at home. I think I used lophtcrack? The head admin account for the entire school district (basically root) had the password “north”. It took like a fraction of a second to crack. It was so simple that for weeks I didn’t even believe it to be true, and didn’t realize the name of the account was an admin.&lt;p&gt;I was expelled a few months later for all the fun I had after discovering this. Good times.</text></item></parent_chain><comment><author>whalesalad</author><text>Yes! The SAM! It’s all coming back to me now.</text></comment>