Lotus Notes .id file pw recover (Was Cached NT/W2k passwords)

From: Romes, Randall J. (Rromes_at_larsonallen.com)
Date: 06/10/04

  • Next message: NetExpress: "Multiple IP on the same server howo to idenfity" 
    Date: Thu, 10 Jun 2004 06:43:19 -0500
To: <pen-test@securityfocus.com>

    Any one familiar with a means of recovering/cracking the password for lotus
    notes which resides in the .id file?

    Any one know how the password is encrypted/hashed?

    Thanks
    Randy

    -----Original Message-----
    From: Nicolas RUFF (lists) [mailto:ruff.lists@edelweb.fr]
    Sent: Tuesday, May 25, 2004 10:17 AM
    To: pen-test
    Subject: Re: Cached NT/W2k passwords


    > Has anyone been able to decrypt the hash password from
    > the cached login on NT or W2K ?
    > We're is it located ? In the registry ? If so what's
    > the key....
    > I've been looking around the only thing I can find is
    > how to disable this feature :(

            Hi,

    If you're talking about the CachedLogonsCount registry key, there has been a
    thread 2 weeks ago on FOCUS-MS :

    http://www.securityfocus.com/archive/88/362946/2004-05-21/2004-05-27/0

    Basically, storage is either in LSA Secrets or NL$ registry keys (depending
    on Windows version), and there is no publicly available tool to decrypt the
    hash. The stored value is a salted hash : NTLM( username + NTLM(password)).
    This is hard to crack by brute-force if password > 6 chars.

    Regards,
    - Nicolas RUFF
    -----------------------------------
    Security Consultant
    EdelWeb (http://www.edelweb.fr/)
    -----------------------------------
    --------------------------------------------------------
     
    This message (including any attachments) may contain confidential client information. The information is intended only for the use of the individual or entity to whom it is addressed. If you are not the addressee or the employee or agent responsible to deliver this e-mail to its intended recipient, you are hereby notified that any review, use, dissemination, distribution, disclosure, copying or taking of any action in reliance on the contents of this information is strictly prohibited.

  • Next message: NetExpress: "Multiple IP on the same server howo to idenfity"

    Relevant Pages

    • Re: Cached NT/W2k passwords
      ... > Has anyone been able to decrypt the hash password from ... If you're talking about the CachedLogonsCount registry key, there has been a thread 2 weeks ago on ... there is no publicly available tool to decrypt the hash. ...
      (Pen-Test)
    • Re: Cached NT/W2k passwords
      ... > Has anyone been able to decrypt the hash password from ... If you're talking about the CachedLogonsCount registry key, there has been a thread 2 weeks ago on ... there is no publicly available tool to decrypt the hash. ...
      (Pen-Test)
    • RE: Lotus Notes .id file pw recover (Was Cached NT/W2k passwords)
      ... Try a program called DOMINO HASH BREAKER v1.0 ... It worked great for cracking hashes dumped from a lotus notes servers web ... Lotus Notes .id file pw recover (Was Cached NT/W2k passwords) ...
      (Pen-Test)
    • RE: Problem while decrypting
      ... Decrypt will decrypt ANY GARBAGE ... in CBC mode a block error affects only two ... simple hash: attach the hash value of the original data at the end, ... > i was encrypting the data using the pass phrase. ...
      (microsoft.public.platformsdk.security)
    • Re: Simple Question: Always the same cyphertext?
      ... > encrypt a file twice with the same key and obtain the same ciphertext does ... > if you are going to decrypt the file later. ... >> whereby I would like to verify the integrity of a file using a hash. ... I will encrypt the file ...
      (sci.crypt)