RE: Windows 2003 - Dumping Service Passwords

Jason,

For domain credentials, you may want to use Cachedump.

Follow the instructions on how to patch John.

Kind Regards,
Scott Ramsdell


-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx]
On Behalf Of Jason
Sent: Tuesday, November 21, 2006 6:19 AM
To: pen-test@xxxxxxxxxxxxxxxxxxxxxxx
Subject: Windows 2003 - Dumping Service Passwords

I am currently conducting a penetration test and have compromised a
Windows 2003 server which is a domain member server and have admin
privs. I have noticed the system has numerous services which are running
through domain accounts and some of those accounts are domain admins.

I understand the passwords for the services are stored in the LSA and I
would like to dump them. I have tried lsadump2 and this just hangs and
finally reboots the server. What other tools can I use on W2K3 to dump
these passwords?

I would prefer to use something that does not need to be installed with
an installer and does not require the server to be rebooted if that is
possible.

Any help appreciated.

J



________________________________________________________________________
____________
Sponsored Link

Online degrees - find the right program to advance your career.
www.nextag.com

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=7016
00000008bOW
------------------------------------------------------------------------


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------

Relevant Pages

  • Re: Capturing Windows Login Name
    ... annoyance of typing their user names and passwords again. ... that among other protocols supports NTLM. ... server in the last step, ... a site under the same Windows controller domain, ...
    (comp.lang.php)
  • RE: Windows 2003 - Dumping Service Passwords
    ... Windows 2003 - Dumping Service Passwords ... 2003 server which is a domain member server and have admin privs. ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • RE: Rights issues with renamed server
    ... passwords, please refer to: ... Windows http://support.microsoft.com/?id=325850 ... The Netdom tool is in the Support Tool of Windows server, ... computer and send me the .cab file for analyze. ...
    (microsoft.public.windows.server.sbs)
  • RE: Windows 2003 - Dumping Service Passwords
    ... Windows 2003 - Dumping Service Passwords ... Windows 2003 server which is a domain member server and have admin ... I understand the passwords for the services are stored in the LSA and I ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • RE: Windows 2003 - Dumping Service Passwords
    ... I am currently conducting a penetration test and have compromised a Windows ... 2003 server which is a domain member server and have admin privs. ... I understand the passwords for the services are stored in the LSA and I ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)