RE: LC4 (L0phtCrack) error "Couldn't open SAM\Domains\Account\Use rs in SAM file. Possibly improper format."

From: MACRIDES,NATHAN (HP-Australia,ex3) (nathan.macrides@hp.com)
Date: 04/17/03

  • Next message: Jimi Thompson: "Re: False-negatives in several Vulnerability Assessment tools"
    From: "MACRIDES,NATHAN (HP-Australia,ex3)" <nathan.macrides@hp.com>
    To: flexicon33@yahoo.com, pen-test@securityfocus.com
    Date: Thu, 17 Apr 2003 10:24:25 +1000
    
    

    Have you tried using regback to export the SAM? you should give it a try and
    see if you get any different results.

    Regards

    Nathan

    -----Original Message-----
    From: flexicon33@yahoo.com [mailto:flexicon33@yahoo.com]
    Sent: Wednesday, April 16, 2003 2:25 PM
    To: pen-test@securityfocus.com
    Subject: LC4 (L0phtCrack) error "Couldn't open SAM\Domains\Account\Users in
    SAM file. Possibly improper format."

    Hi,
    I'm trying to import some SAM files into LC4, and for some reason LC4
    doesn't like the format. I get the above error for any of 5 SAM files I'm
    trying.

    For a pen test, I got these sam files by senging a 'tptp put' command to
    the SQL server (had no 'sa' password) so the SAM files were sent to my tftp
    server. There were 5 of these servers, so I got 5 SAM files to try. LC4
    doesn't like any of them.

    However, LC4 works for other SAM files... I tested with my own SAM file
    (w2k) and also another I downloaded from a machine via an http exploit...
    LC4 had no problems opening those 2 and working on them.

    Why does LC4 complain about these other SAM files? Does some other sam
    format exist or did they get mangled somehow?
    Thanks...
    Flexicon33, CISSP

    ---------------------------------------------------------------------------
    Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the
    world's premier event for IT and network security experts. The two-day
    Training features 6 hand-on courses on May 12-13 taught by professionals.
    The two-day Briefings on May 14-15 features 24 top speakers with no vendor
    sales pitches. Deadline for the best rates is April 25. Register today to
    ensure your place. http://www.securityfocus.com/BlackHat-pen-test
    ----------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the
    world's premier event for IT and network security experts. The two-day
    Training features 6 hand-on courses on May 12-13 taught by professionals.
    The two-day Briefings on May 14-15 features 24 top speakers with no vendor
    sales pitches. Deadline for the best rates is April 25. Register today to
    ensure your place. http://www.securityfocus.com/BlackHat-pen-test
    ----------------------------------------------------------------------------


  • Next message: Jimi Thompson: "Re: False-negatives in several Vulnerability Assessment tools"

    Relevant Pages

    • Re: Syskey on Win2k
      ... > that you can't copy the sam data when windows is running. ... LC4 get passwords in minutes. ...
      (Security-Basics)
    • RE: LC4 (L0phtCrack) error "Couldnt open SAMDomainsAccountUsers in SAM file. Possibly improper
      ... LC4 error "Couldn't open ... Possibly improper format." ... I'm trying to import some SAM files into LC4, ... Training features 6 hand-on courses on May 12-13 taught by professionals. ...
      (Pen-Test)
    • RE: LC4 (L0phtCrack) error "Couldnt open SAMDomainsAccountUsers in SAM file. Possibly improper
      ... LC4 error "Couldn't open SAM\Domains\Account\Users ... I'm trying to import some SAM files into LC4, ... Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the ... Training features 6 hand-on courses on May 12-13 taught by professionals. ...
      (Pen-Test)
    • Re: Moving SAM for Exchange 5.5 move to SW2k
      ... Technically you dont move the SAM. ... ADC in, the users have been replicated, and you have no other issues, you ... > two SAM files, do I just take the SAM file ... > into the SW2k directories? ...
      (microsoft.public.exchange.setup)
    • Re: NT Sam Hashes
      ... > You cant access local SAM files while the OS is running, ... Correct...this was one of the first ways to grab the sam file. ... >> I've been learning about some of the sam hash dump programs out there ... >> the sam hash of the machine they are run on locally. ...
      (Security-Basics)