Re: ntds.dit, john and pwdump2
To: <firstname.lastname@example.org> Date: Tue, 25 Jan 2005 13:00:09 +0100
Sorry for not answering your question. Perhaps some other answers on the
list are useful (have you tried Cain?).
I just want to make you (well... and everyone in the list) aware of
different flavours of pwdump.
All of them require administrative privileges (or SYSTEM, as far as I know
it works as well when we're speaking of the local machine).
First we have good old pwdump. It runs only on the local machine.
Then we have pwdump2, it runs also on the local machine, and solves some
issues present in pwdump (for example, it overcomes SYSKEY).
Then we have pwdump3, it runs remotely (administrative credentials still
needed, of course).
And the last one, not widely known, is pwdump4. It runs either locally or
remotely, overcomes some issues with pwdump3 (for example you can specify
the network share to use).
For your password cracking exercise, John is not your only option.
Lepton's Crack, of which I'm one of the proud "fathers" supports NTLM
hashes in the "stable" branch, and also LM hashes in the "development"
branch, as well as several other hashing algorithms.
It can be found at http://freshmeat.net/lcrack/
Cain also has a cracking module, and of course there're several other
Miguel Dilaj (Nekromancer)
Vice-President of IT Security Research, OISSG