lytithwyn / owper Goto Github PK

It looks like we aren't properly detecting blank passwords. We are looking to see if the hash length is 0, which works if we set it that way. Some passwords are blank, yet have a proper length of 16. My guess is that these are passwords that have been cleared in Windows. We need to look to see if there is/are a certain hash(es) that denote(s) a blank password.

It would be awesome if owper provided some sample data in the repository (perhaps in a data or fixtures type directory, or as a separate download in GitHub) for use for testing for those who don't have access to a Windows machine to nab the required files.

We need to add a routine that checks to see if a user is in the Admin group. See chntpw.c:291

We'll store the results of this in samUser so the user's Admin status can be displayed in the GUI.

We need to go back and add byte-swapping in the proper areas to support running owper on big endian systems. Thankfully, bkhive and samdump2 have good examples of what to do.