search

gentilkiwi / mimikatz

A little tool to play with Windows security
http://blog.gentilkiwi.com/mimikatz
19.3k stars 3.7k forks source link

EFS files - Masterkey with empty user password in windows login #443

Closed Kitamiss closed 6 months ago

Kitamiss commented 6 months ago

Hi, I am trying to extract a certificate to decrypt the efs file in windows. The encrypted file belongs to an HDD of another PC that cannot log in as a user.
I have no problems recovering the masterkey if the user password exists, but when the user did not enter a Windows access password when running mimikatz in these 2 ways it does not work:

  1. at the end of the line /password: (I leave the password empty).

  2. at the end of the line do not use /password:

How can I get the sha1 masterkey if the user who encrypts the file does not have a login password?

Thank you

Kitamiss commented 6 months ago

Solo había que añadir sha1 pass en blanco: da39a3ee5e6b4b0d3255bfef95601890afd80709