Still Chntpw and OPHcrack work with Windows 11?

Still Chntpw and OPHcrack work with Windows 11?

January 29, 2023 3 min read 3 views 0 discussions
Table of Contents

    Previously, we tested to check, if we could bypass Windows 10 login screen using Chntpw and OPHcrack, and we succeeded. In this video, we will be going to take a look at, if we could bypass Windows 11 logon screen using chntpw and OPHcrack.

    Before that, we will have to Boot the computer using Kali Live bootable CD or USB drive that contains chntpw and OPHcrack.

    If you have not yet created a bootable USB drive then click on the below link:

    Firstly, let’s take a look if we could crack the Windows 11 login passwords using OPHcrack

    Using OPHCrack

    To learn more about OPHcrack click the below link:


    Shut down your Windows 11 PC and then Boot Kali Linux with the help of Live USB Persistence.

    Now, we have to copy SAM and SYSTEM files from the Windows Hard Disk Partition. So, Click on the Windows system partition on the desktop screen and Open the terminal from Here.

    Change the directory to the Windows system configuration file where the SYSTEM and SAM files are stored.

    ┌──(kali㉿kali)-[/media/kali/8c76EFA67EF8F70]
    └─$ cd Windows/System32/config
    ┌──(kali㉿kali)-[/media/.../8c76EFA67EF8F70/Windows/System32/config]
    └─$ 

    Now copy these two files to the Desktop.

    ┌──(kali㉿kali)-[/media/.../8c76EFA67EF8F70/Windows/System32/config]
    └─$cp SAM SYSTEM /home/kali/Desktop

    Now we have to convert SAM and SYSTEM files to Windows password hashes using the SAMdump2 command line utility.

    ┌──(kali㉿kali)-[~/Desktop]
    └─$ samdump2 SYSTEM SAM -o windowskey.txt

    Once the Dump file is created, launch OPHCrack.

    Click on load, and Load the Password Dump file from the Desktop.


    Since the NT password section is showing empty, which means it is not possible to crack passwords using OPHCrack.

    Next, we will try to take a look, if we could reset Windows 11 password using chntpw

    Using chntpw

    If you don’t know what is it, then watch this video now.

    Firstly, Boot Kali Linux with the help of Live USB Persistence, and Open the terminal from the Windows system partition.

    Change the directory to the Windows system configuration file where the SAM file is stored.

    ┌──(kali㉿kali)-[/media/kali/8c76EFA67EF8F70]
    └─$ cd Windows/System32/config
    ┌──(kali㉿kali)-[/media/.../8c76EFA67EF8F70/Windows/System32/config]
    └─$ 

    Run chntpw in interactive mode.

    ┌──(kali㉿kali)-[/media/.../8c76EFA67EF8F70/Windows/System32/config]
    └─$sudo chntpw -i SAM

    Similar to the previous, type 1, to edit user data and password

    Next, enter the user number, which we want to remove. 

    Type 1, to clear or Blank the user password.

    Type 2, to unlock and enable the user account. 

    Type q to back to user select. 

     Type q to close the session and also save the file. 

    Once done, Remove the USB drive and reboot the computer.

    Now, Log in to Windows with the user account you just reset the password for, and you will be able to access the system without entering a password.

    From this, we understood that chntpw still works with Windows 11, but both these two tools are the most powerful forensic tools and pretty much useful in recent days.

    Community Q&A