Hacking For Beginners – Manthan Desai
2010
SAM (Security Account Manager)
The Security Accounts Manager is a database in the Windows operating system (OS) that contains user names andpasswords. SAM is part of the registry and can be found on the hard disk.
This service is responsible for making the connection to the SAM database (Contains available user-accounts andgroups). The SAM database can either be placed in the local registry or in the Active Directory (If available). Whenthe service has made the connection it announces to the system that the SAM-database is available, so otherservices can start accessing the SAM-database.
In the SAM, each user account can be assigned a Windows password which is in encrypted form. If someoneattempts to log on to the system and the user name and associated passwords match an entry in the SAM, asequence of events takes place ultimately allowing that person access to the system. If the name orpasswords do not properly match any entry in the SAM, an error message is returned requesting that theinformation be entered again.
When you make a New User Account with a Password, it gets stored in the SAM File.
Windows Security Files are located at
“C: \Windows\System32\Config\ SAM”
The moment operating system starts, the SAM file becomes inaccessible.
SRM (Security Reference Monitor)
The Security Reference Monitor is a security architecture component that is used to control user requests toaccess objects in the system. The SRM enforces the access validation and audit generation. Windows NT forbidsthe direct access to objects. Any access to an object must first be validated by the SRM. For example, if a userwants to access a specific file the SRM will be used to validate the request. The Security Reference Monitorenforces access validation and generation policy.
The reference monitor verifies nature of the request against a table of allowable access types for each processon the system. For example, Windows 3.x and 9x operating systems were not built with a reference monitor,whereas the Windows NT line, which also includes Windows 2000 and Windows XP, was designed with an entirelydifferent architecture and does contain a reference monitor.
Windows user account architecture
User account passwords are contained in the SAM in the Hexadecimal Format called Hashes.
Once the Passwords converted in Hashes, you cannot convert back to the Clear Text.
www.hackingtech.co.tv
Page 29