Brute-forcing cached Windows login password hashes

Greetings all,

My question is regarding the encrypted password hashes that Windows stores in
the registry of the last 10 logins to a workstation.

I read the original white paper written by Arnaud Pilon and I've used his
cachedump tool to extract the password hashes from the registry. What I'm
wondering is what type of hash those passwords use. Is it straight MD4? I
know that each hash is salted with a machine-specific unique string. What I
am unclear on is what exactly the password hash is and how it can be
brute-forced. I know that there is a patch for John the Ripper, but every
mention I can find refers to a two year old version of John. Does anyone know
if the most recent version has this patch in it already? Also, is anyone
familiar with any rainbow tables for cracking these passwords? Are rainbow
tables possible for these hashes because of the salting?

Thanks all.

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • Re: Brute-forcing cached Windows login password hashes
    ... rainbow tables on freerainbowtables are much limited on mscache (since per login hash). ... Subject: SV: Brute-forcing cached Windows login password hashes ...
    (Pen-Test)
  • Re: Brute-forcing cached Windows login password hashes
    ... The hash algorithm is a salted MD4. ... it's mathematically infeasible) to use rainbow tables because of the ... My question is regarding the encrypted password hashes that Windows ... buy it or download a solution FREE today! ...
    (Pen-Test)
  • RE: Extracting NT password hashes from registry export file
    ... Extracting NT password hashes from registry export file ... This list is provided by the SecurityFocus Security Intelligence Alert Service. ...
    (Pen-Test)
  • Re: LM HASHES
    ... > 1) Will upgrading to SP3 automatically fix the LM Hash ... What the article is saying is that if you want to use this registry ... setting to remove the older LM-style password hashes from your user ... Note that in addition to the password hash format used to store password ...
    (microsoft.public.win2000.security)
  • Re: Extracting NT password hashes from registry export file
    ... Extracting NT password hashes from registry export file ... > This list is provided by the SecurityFocus Security Intelligence Alert ...
    (Pen-Test)