Domain account password offline resetting method

Abstract

The invention relates to an off-line resetting method for a domain account password. The method comprises the following steps: S0, acquiring a mirror image file of a target system; s1, generating a virtual machine file according to the mirror image file; s2, extracting historical login data of a domain account from a system partition of the virtual machine file; s3, constructing an identity authentication data structure of the domain account based on the historical login data, filling a password field into an empty character string, and further updating a hash verification field of the identity authentication data structure; and S4, writing the updated identity authentication data structure into a first registry file to reset a password of the domain account, wherein the first registry file is used for storing configuration information related to system security. According to the method and the device, the domain account password can be reset under the off-line condition.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic data forensics, and in particular to an offline domain account password resetting method. Background Art

[0002] In most enterprises, computers are usually added to a domain for centralized management. Such computers need to connect to a domain control server for login operations, or know the user account information of the domain account in advance, such as SID, user name, etc. When electronic data forensics personnel handle evidence involving domain accounts, they often encounter the following problems:

[0003] The operating system cannot be logged in because the sample cannot connect to the domain controller server;

[0004] When the forensic personnel obtain the domain account specimen and there is a local cache of user authentication information, the domain account password needs to be cracked.

[0005] Therefore, a method is needed to reset the domain account password offline. Summary of the invention

[0006] The technical problem to be solved by the present invention is to provide a method for resetting a domain account password offline, which can reset the domain account password in an offline state.

[0007] The technical solution adopted by the present invention to solve the technical problem is: to provide an offline domain account password reset method, comprising the following steps:

[0008] S0 obtains the image file of the target system;

[0009] S1 generates a virtual machine file according to the image file;

[0010] S2 extracts historical login data of the domain account from the system partition of the virtual machine file;

[0011] S3 constructs the identity authentication data structure of the domain account based on the historical login data, fills the password field with an empty string, and then updates the hash check field of the identity authentication data structure;

[0012] S4 writes the updated identity authentication data structure into a first registry file to reset the password of the domain account, where the first registry file is used to store configuration information related to system security.

[0013] Furthermore, the extracting of the historical login data of the domain account from the system partition of the virtual machine file is achieved by reading the second registry file.

[0014] Furthermore, the second registry file includes:

[0015] Windows / System32 / config / SOFTWARE.

[0016] Furthermore, before step S1, the following steps are also included:

[0017] Traversing each partition of the image file to search for the first registry file;

[0018] If the first registry file does not exist, the offline reset process ends, otherwise, step S1 is executed.

[0019] Furthermore, before step S1, the following steps are also included:

[0020] Reading the domain policy key in the first registry file to obtain working domain information;

[0021] It is determined whether the working domain information includes the set working domain. If not, the offline reset process is terminated. Otherwise, step S1 is executed.

[0022] Furthermore, the domain policy key in the first registry file includes Policy\\PolPrDmN\\@.

[0023] Furthermore, the setting working domain is WORKGROUP.

[0024] Furthermore, before step S2, the method further includes mounting the system partition of the virtual machine file in a read-write state.

[0025] Furthermore, the first registry file includes:

[0026] Windows / System32 / config / SECURITY.

[0027] Furthermore, the check field is a hash check field.

[0028] Beneficial Effects

[0029] Due to the adoption of the above technical solution, the present invention has the following advantages and positive effects compared with the prior art: The existing technical solution for resetting domain account passwords is to reset the password on the domain control server, and then obtain the latest password from the domain control server after the client is turned on. The problem with the existing solution is that it is necessary to connect to the domain control server, and it is not possible to connect to the domain control server in all cases when doing electronic data forensics analysis. The present invention extracts the logged-in domain account information from the registry file of the system image, and then constructs a new domain account authentication data structure, and writes it into the registry file used to store system security-related configuration information, thereby realizing offline resetting of domain account passwords. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a flow chart of an embodiment of the present invention. DETAILED DESCRIPTION

[0031] The present invention will be further described below in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art can make various changes or modifications to the present invention, and these equivalent forms fall within the scope limited by the appended claims of the application equally.

[0032] The embodiment of the present invention relates to an offline reset method of a domain account password, such as Figure 1 As shown, the following steps are included:

[0033] (1) Identify and parse hard disk image file formats, such as dd, E01, vmdk, qcow, vdi,

[0034] vhdi etc;

[0035] (2) Identify and parse the partitions and file systems in the image. Different operating systems use different file systems, such as the NTFS file system commonly used in Windows, the APFS file system commonly used in macOS, and the .

[0036] Ext4 and XFS file systems;

[0037] (3) Traverse the partitions one by one and try to open and read the Windows / System32 / config / SECURITY registry file. If the file does not exist, the reset process ends, otherwise proceed to the next step;

[0038] (4) Read the registry Policy\\PolPrDmN\\@ to obtain the work domain information. If the work domain is WORKGROUP, execute the next step; otherwise, end the reset process.

[0039] (5) Generate a virtual machine file based on the hard disk image, convert the hard disk image file into a vmdk file, and create

[0040] vmx file;

[0041] (6) Mount the system partition in read-write state;

[0042] (7) Read the registry file Windows / System32 / config / SOFTWARE to obtain the domain account information that has logged in before. This registry file contains system and application installation information, configuration settings, and some local user information related to group policies;

[0043] (8) Construct a domain account identity authentication data structure based on the read domain account information, wherein the password field is filled with an empty string, and finally update the hash check field of the domain account identity authentication data structure.

[0044] (9) Write the obtained authentication data structure to the Windows / System32 / config / SECURITY registry.

Claims

1. A method for resetting a domain account password offline, characterized in that: The following steps are involved: S0 obtains the image file of the target system; S1 generates a virtual machine file according to the image file; S2 extracts historical login data of the domain account from the system partition of the virtual machine file; S3 constructs the identity authentication data structure of the domain account based on the historical login data, fills the password field with an empty string, and then updates the verification field of the identity authentication data structure; S4 writes the updated identity authentication data structure into a first registry file to reset the password of the domain account, where the first registry file is used to store configuration information related to system security.

2. The method according to claim 1, characterized in that The extracting of the historical login data of the domain account from the system partition of the virtual machine file is achieved by reading the second registry file.

3. The method according to claim 2, characterized in that The second registry file includes: Windows / System32 / config / SOFTWARE.

4. The method according to claim 1, characterized in that: Before step S1, the method further includes: Traversing each partition of the image file to search for the first registry file; If the first registry file does not exist, the offline reset process ends, otherwise, step S1 is executed.

5. The method according to claim 4, characterized in that Before step S1, the method further includes: Reading the domain policy key in the first registry file to obtain working domain information; It is determined whether the working domain information includes the set working domain. If not, the offline reset process is terminated. Otherwise, step S1 is executed.

6. The method according to claim 5, characterized in that The domain policy key in the first registry file includes Policy\\PolPrDmN\\@.

7. The method according to claim 5, characterized in that The set working domain is WORKGROUP.

8. The method according to claim 1, characterized in that Before step S2, the method also includes the step of mounting the system partition of the virtual machine file in a read-write state.

9. The method according to claim 1, characterized in that: The first registry file includes: Windows / System32 / config / SECURITY.

10. The method according to claim 1, characterized in that The check field is a hash check field.

Images