Mastering Windows Network Forensics and Investigation, 2nd Edition

Chapter 4

Windows Password Issues

A favorite trick of network attackers is to compromise existing accounts by learning the appropriate username/password combination. Once attackers have a valid account on the system, they are able to come and go at will using normal entry points, in effect hiding in plain sight. You saw in earlier chapters how attackers can create their own accounts on a compromised system. In this chapter, we will examine ways in which an attacker can learn the names and passwords of accounts that already exist on a victim system. By learning this information, the attacker can gain access to the system without having to alter the number of accounts that exist on the target, thereby providing increased stealth for the attacker. ...