pwClean: Cleaning your password dump file

Windows app helping you to sort out the relevant parts from your favorite Windows hash dumping tool (Metasploit, PWdumpX, fgdump, etc.). pwClean can remove systems, history and built-in accounts, as well as select admin accounts only.

There many tools available with same and more feature and most of them are free. Still.

Penetrtion testers can use this tool for example while doing a pentest and got several system rooted, maybe even a domain controller. One of the steps after compromise is getting the password hashes to get them cracked. Knowing the passwords in stead of only the hashes is an important step as it
 can for example provide you with access to that important financial application that is not AD-integrated.

But now you have got this text file with over 100K lines of password hashes. Sorting of the hashes before cracking is essential as your favorite tool dumps the hashes of many, many accounts that you are not interested in (system accounts, built-in, history, etc).

You can filter by hand or use your favorite text editor. But you need it to be faster, easier.

Features of pwClean

•  independent for password dumping tool used (support for pwdump, pwdumpX, gsecdump, fgdump);
• graphical user interface for easy clicky-click (I know you windows pentesters like that); can select administrative accounts identified by *adm*;
• lets you select your domain specific ‘admin’ tag, e.g. if the naming convention uses ‘oper_’ you enter ‘oper_’ as the admin identifier;
• can remove system accounts (the accounts with the trailing $);
• an remove built-in accounts like Guest, krbtgt, SUPPORT_388945a0, HelpAssistant, TSInternetUser, IWAM_* and IUSR_*;
•  can remove history accounts (_hist or _1) and wil remove the ‘(current)’ tag; supports multiple input files.

Features coming soon.

   1. removal of accounts of which only the SID is know and not the name (orphaned/deleted accounts with

       the long numbers instead of an account name)
   2. drag ‘n drop

Download from here: Download

11 Steps to Remove the Active Recovery Partition:

Nature of the Dell recovery partition and how to remove it while still enabling Windows 7 to boot.
The Recovery Partition and little Dell diagnostic partition may have been working on the newly cloned drive, but certainly weren't after resizing and adding partitions, so both those partitions were basically just sitting there taking up space, except for one important thing: The 11GB Recovery Partition is an active system partition, contains the boot files, and Win7 will not boot without it unless you make some changes. Since I have 2 1TB drives, and do my own regular scheduled backups, I wanted to get these partitions off my drive. Here is what I did:

1. To be safe, I made backup images of all partitions, just in case it didn't work.

2. I downloaded and burned BootIt NG (AKA BING). Note: You cannot install BING in Win7. You just burn it to a bootable CD/DVD by clicking the makedisk.exe from the unzipped files.

3. From Win7, open Regedit, under HKEY_LOCAL_MACHINE, unload BCD00000000 from
the registry by highlighting it, click File/Unload Hive, Yes - or the following boot files will be in use and won't copy. (Note: If you don't have BCD00000000 under HKEY_LOCAL_MACHINE, which was the case for me, just proceed to the next step.)

4. In Disk Management, right click the Recovery partition, click Change Drive Letter and Paths..., click Add, dot in Assign the following drive letter, OK.

5. In Folder and search options, View tab, put a dot in "Show hidden files, folders and drives". Also, remove the tick from "Hide protected operating system files (Recommended)". OK.

6. In Computer, Recovery partition, open and copy the "Boot" folder and "bootmgr" and paste them into the C: drive. (Copy, do not Move these files)

7. In Folder and search options, View tab, put a tick in "Hide protected operating system files (Recommended)". OK.

8. In Disk Management, right click the Recovery Partition, click Change Drive Letter and Paths..., click Remove, Yes.In Disk Management, right click the C: drive, click Mark Partition as Active, Yes.

9. Restart the computer with a BING CD in the drive. If necessary, set boot order to boot from CD drive first.) In BING (Partition Work), delete the Recovery partition (and the other little diagnostic partition, if you want to). You can also move and resize partitions to use the new space, or do this later with your own partition software.

10. In BING, do a BCD Edit on Win7. Follow instructions at http://www.terabyteunlimited.com/kb/article.php?id=318

11. Reboot

This method worked perfectly for me, and it's not as difficult at all once you get started and follow all the instructions carefully. I hope this helps others who want to remove these partitions.