OpenSeSAM

Hi there! Welcome to OpenSeSAM. This is a forensic tool written in Go, designed to help you explore the Windows Security Account Manager (SAM) database.

Here is what it helps you do:

1. Extract NTLM and LM password hashes directly from a registry export.
2. Create password reset packets to modify user settings by injecting them back into the registry.

How It Works

Windows keeps user passwords (hashes) safe inside the Registry hive at HKEY_LOCAL_MACHINESAM. You can't just read them because they are encrypted with a system-specific key called the Boot Key (also known as SysKey).

OpenSeSAM handles the decryption process for you by:

1. Reading a text-based .reg export of the SAM hive.
2. Reconstructing the Boot Key from hidden parts in the System hive.
3. Decrypting the AES-encrypted user data.
4. Unlocking the NTLM hashes using the user's unique RID (Relative ID).

How Windows Hides the Keys

To get to the hashes, we have to get rid of a few layers of security.

1. The Hidden "Boot Key" Parts

Windows hides the master key inside the Class Names of four specific registry keys. Most tools ignore "Class Names" because they are usually just metadata, but they are actually important here.

These keys are located in HKLMSYSTEM\CurrentControlSet\Control\Lsa:

• JD
• Skew1
• GBG
• Data

Each key's Class Name contains 8 characters of hex code (4 bytes). When we combine them, we get a 16-byte scrambled key.

2. The LSA Scramble

That 16-byte key isn't quite ready yet. It is scrambled, so we have to rearrange it using this specific pattern:

Input Indices:  [ 0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 15]
Output Indices: [ 8,  5,  4,  2, 11,  9, 13,  3,  0,  6,  1, 12, 14, 10, 15,  7]

And there we go! Now we have the LSA Key.

3. Unlocking "F"

Inside the SAM hive (SAM\Domains\Account), there is a value named F. This binary blob holds the actual AES-256 encrypted Boot Key.

We use the LSA Key from the previous step to unlock F. This finally gives us the System Boot Key.

4. Getting the Hashes

Finally, each user's hash is encrypted with:

1. The System Boot Key.
2. The user's RID (Relative ID).

OpenSeSAM does the math to get the RID-specific DES keys and unlocks the final NTLM hash. simple as that!

How to Use It

First: Get the Data

Since standard .reg exports don't include "Class Names," you need to use a little trick in Regedit to see them.

Step 1: Export the SAM Hive

1. Open regedit.exe.
2. Go to HKEY_LOCAL_MACHINE\SAM\SAM.
3. Right-click SAM -> Export.
4. Save it as sam.reg (make sure you select the "Text" format, not the Binary one!).

Step 2: Extract LSA Class Names (The PDF Method)

1. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.
2. You will see JD, Skew1, GBG, and Data.
3. Right-click on JD.
4. It might sound strange, but the easiest way to see the Class Name is to PRINT the key.
   • Select JD.
   • Press Ctrl + P (Print).
   • Choose "Microsoft Print to PDF".
   • Save the file.
5. Open the PDF and look for "Class Name". It will be a hex string (like 37557b3a).
6. Repeat this for Skew1, GBG, and Data.

Build It

# Clone the repository  
git clone https://github.com/rokybeast/opensesam.git  
cd opensesam

# Build the reader  
go build -o samreader ./cmd/samreader

# Build the reset generator  
go build -o resetgen ./cmd/resetgen

Run samreader

Run the tool with your .reg file and the 4 hex strings you found in the PDFs.

./samreader   
  --reg sam.reg\
  --jd <JD_HEX>\
  --skew1 <SKEW1_HEX>\
  --gbg <GBG_HEX>\
  --data DATA_HEX>\

What the output looks like:

Registry parsed.
Domain Creation Time: 2023-10-27 10:00:00 +0000 UTC
LSA Key: 1a2b3c...
Boot Key: 9f8e7d...

User: Administrator (RID: 500)
  NT Hash: 8846f7eaee8fb117ad06bdd830b7586c
  LM Hash: None
—————————————————————————————————————
User: Guest (RID: 501)
  NT Hash: None
  LM Hash: None
—————————————————————————————————————

Run resetgen

Use this tool if you want to clear the security questions for a user.

./resetgen

1. Enter the Target RID (like 1F4 for decimal 500).
2. It will generate a file called reset.reg.
3. Import reset.reg on the target machine, and it will overwrite the ResetData.

Disclaimer

Please use this responsibly! This tool is for educational purposes, forensic analysis, and authorized auditing ONLY. If you use this on systems you don't own, you are on your own. I ain’t responsible for stuff twin! ✌️