Re: cracking Y2k DC Admin password

the passwords for windows are hashed with MD4(?) which is implemented
depending on LM/NTLM settings. Kerberos is a different system. Once
the hashes have been created, they are encrypted with a DES variant
algorithm and saved in the SAM database. The key is conveniently
stored in a file called 'system' which is in the same directory.

if you have the SAM file, you should also have taken the system file.
system holds the boot key (syskey) which is needed to decrypt the
hashes.

Once you have decrypted the hashes, you can crack them using any
password attack tool.

I would recommend that you get hold of Cain & Abel from www.oxid.it
It is by far the best Windoze based tool for doing this kind of thing

In linux, you have tools like bkhive which can extract the boot key
from the system file, and samdump which will decrypt the hashes ready
for breaking.

later

On 9/27/06, Hari Sekhon <hpsekhon@xxxxxxxxxxxxxx> wrote:
Hi,
I've found cachedump to be reliable in the past, lsadump caused some
crashing problems for me at the time so I didn't use it.

Could somebody tell me how to go about retrieving the hashes from the
offline sam file. Is there a way? And if so what form do the hashes come
in, DES?


Thanks

-h

--
Hari Sekhon


On 9/25/06, s-williams@xxxxxxxxxx <s-williams@xxxxxxxxxx> wrote:
>> Or if you go to the %systemroot%repair in that folder you should see
>> a backup of the sam and the system file feed that to lcp, saminside,
>> lc5, anyone and you have your passwords.
>> Sent via BlackBerry from T-Mobile
>>
>> -----Original Message-----
>> From: okrehel@xxxxxxxxx
>> Date: Mon, 25 Sep 2006 11:20:46
>> To:juanbabi@xxxxxxxxx
>> Cc:listbounce@xxxxxxxxxxxxxxxxx, pen-test@xxxxxxxxxxxxxxxxx
>> Subject: Re: cracking Y2k DC Admin password
>>
>> try
>>
>> - rescue in windows folder and backup sam file from it, it has admin
>> credentials, johny the riper, LC, and ophcrack will do the job - with
>> hash
>> tables....
>> - use cachedump to dump cached credentials on that server, maybe
>> admin was
>> signed on (default is 5 accounts cached)
>> - use lsadump2 to dump passwords of running services, maybe some of
>> them is
>> running with the local admin credentials
>>
>> Ondrej Krehel, CISSP, CEH
>>
>>
>>
>>
>> juanbabi@xxxxxxxx
>> m
>> Sent
>> by: To
>> listbounce@securi pen-test@xxxxxxxxxxxxxxxxx
>>
>> tyfocus.com cc
>>
>>
>> Subject
>> 09/22/2006 08:45 cracking Y2k DC Admin password
>> PM
>>
>>
>>
>>
>> Hi,
>>
>>
>> for a pen test in doing I got control on the server and logged as the
>> local
>> admin. know I need to retrive the admin's password this is the goal
>> of the
>> pen test from the client side. I know an easy way to crack the sam file
>> with a live linux cd but I cant boot the server it needs to be
>> allways up.
>> I tried to use pwdump.exe but it tells me he cand find the local ADMIN$
>> shere. so it wont work.does someone knows a good way to retrive and
>> crack
>> the admin's password.I an really stuck on this...
>>
>>
>> thanks very much !
>>
>> Juan

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------




--
Lee J Lawson
leejlawson@xxxxxxxxx
leejlawson@xxxxxxxxxxxx

"Give a man a fire, and he'll be warm for a day; set a man on fire,
and he'll be warm for the rest of his life."

"Quidquid latine dictum sit, altum sonatur."

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------

Relevant Pages

  • Re: cracking Y2k DC Admin password
    ... I've found cachedump to be reliable in the past, lsadump caused some crashing problems for me at the time so I didn't use it. ... Could somebody tell me how to go about retrieving the hashes from the offline sam file. ... a backup of the sam and the system file feed that to lcp, saminside, lc5, anyone and you have your passwords. ... cracking Y2k DC Admin password ...
    (Pen-Test)
  • Re: Windows XP / 2K3 Default Users
    ... Since NT4 SP3 the password hashes in the SAM file have been ... If you are to use Rainbow Tables, the disk space required for LM is ... > Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: Password hashes
    ... There are only two hashes used for storing passwords in the Microsoft ... and there is no dedicated NTLM hash for stored passwords. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Unchangeable passwords
    ... It is difficult to store hashes, ... > If somebody discloses private keys, ... demonstrated, the hard way, that about 10% of the passwords on almost ... urging to my successors to flush the variety of root access means they ...
    (comp.os.linux.security)
  • [TOOL] SQL Server Password Auditing Tool
    ... The hashes are easy to retrieve allthough you need a priviliged account to ... To perform a dictionary attack on the retrieved hashes: ... This will try to brute force the passwords by using the supplied ...
    (Securiteam)