Hacking into VMWare images

Last week I posted a question asking how I could recover or change the password for a VMware guest operating system (Windows 2000) that I had forgotten the password for. After receiving no useful suggestions, this week I allocated some time to solving the problem.

Windows password recovery tools usually consist of a bootable CD image containing a version of Linux that will overwrite the NT password with a known value or will extract the hashed password from the filesystem.

To boot your virtual machine from a CD, you must change the boot order in the virtual machine’s BIOS. Press F2 while the VM is starting up to access the BIOS.

I used the free software available from Windows XP Login Recovery. This is good because it does not try to write to your file system, it just retrieves the hashed password value.

Once you have the password hash, you enter it in a form on their website and they look up the hash value in their database and give you a password that matches the hash. Note that even though they ask for your email address the password is displayed on a web page rather than being sent to your inbox.

After all that effort, I discovered that my password was blank.

Published On: October 19, 2006Tags: migrated, security

11 Comments

Anon October 19, 2006 at 5:43 pm

Google for “forgot the adminstrator password”

http://www.petri.co.il has several links.
- neil December 30, 2013 at 2:38 pm
  
  vmware workstation 8 has a “power on to bios” option I have a p/w recovery cd I booted to followed the regular prompts all good.
Stuart Moncrieff October 27, 2006 at 5:30 pm

Previous post:

Confession time. I have several VMWare images (Windows 2000) on my laptop which I was using for software development earlier in the year. I can no longer remember the password for any of these images.

Does anyone have any tips on recovering the passwords?

Note that Google says plenty about recovering Windows passwords, but nothing about recovering passwords from an operating system running inside a Virtual Machine.

Any help is appreciated.

Cheers,
Stuart.
Stuart Moncrieff May 24, 2007 at 10:05 am

The loginrecovery.com website now requires an email address to send you the plaintext password. Try ophcrack instead.

http://lasecwww.epfl.ch/~oechslin/projects/ophcrack/
charlotte June 12, 2007 at 11:33 am

i forgot my password of my adminstrator please lr\et me change it now
Matthew July 8, 2008 at 1:08 pm

I thought this might be useful to someone

http://nova-security-research.blogspot.com/2007/11/debugging-vmware-systems.html
Jim Sifferle December 27, 2008 at 12:02 pm

Nice idea. I used the concept but substituted the Gentoo based System Rescue CD instead of the Windows XP Login Recovery program. SysRescueCD has a built-in ntpasswd boot option to reset Windows passwords.
sarach March 17, 2010 at 4:21 pm

Some days ago, i just got a windows password recovery tool http://www.anypasswordrecovery.com/ which can bypass windows password easily,and it can be burnt onto a cd as recovery disk.If you need,then get it.
Ironic! December 26, 2011 at 4:24 am

I swear to you that my password was blank too! When I read it on your page, I thought, “Let me try that…”

Thanks!
Dave June 21, 2012 at 1:09 am

Last month , I lost my windows vista administrator password. I solved my problem with the help of Reset Windows Password utility. It not only supports Windows Vista , I have personally tested it with Windows 7 . It worked perfectly to reset any local user account to a blank password. Just an easy to use bootable CD/DVD . It can also be used on a USB Flash Drive. You can download it from: http://www.top-password.com/reset-windows-password.html
Jennifer June 4, 2014 at 4:20 am

Thanks for the post. We had a 2000 server VM running on VMWare and it lost its trust with the domain. No one could remember the password so we had to hack it. We used Ophcrack at first but it didnt work so we dug out another password reset software and wallah! We have the server back on the domain! Thanks again for the post.