Re: ntds.dit, john and pwdump2

miguel.dilaj_at_pharma.novartis.com
Date: 01/25/05

  • Next message: routerg: "Re: tool for mount a dd image"
    To: <security-basics@securityfocus.com>
    Date: Tue, 25 Jan 2005 13:00:09 +0100
    
    

    Hi Dave,

    Sorry for not answering your question. Perhaps some other answers on the
    list are useful (have you tried Cain?).
    I just want to make you (well... and everyone in the list) aware of
    different flavours of pwdump.
    All of them require administrative privileges (or SYSTEM, as far as I know
    it works as well when we're speaking of the local machine).
    First we have good old pwdump. It runs only on the local machine.
    Then we have pwdump2, it runs also on the local machine, and solves some
    issues present in pwdump (for example, it overcomes SYSKEY).
    Then we have pwdump3, it runs remotely (administrative credentials still
    needed, of course).
    And the last one, not widely known, is pwdump4. It runs either locally or
    remotely, overcomes some issues with pwdump3 (for example you can specify
    the network share to use).

    For your password cracking exercise, John is not your only option.
    Lepton's Crack, of which I'm one of the proud "fathers" supports NTLM
    hashes in the "stable" branch, and also LM hashes in the "development"
    branch, as well as several other hashing algorithms.
    It can be found at http://freshmeat.net/lcrack/
    Cain also has a cracking module, and of course there're several other
    programs.
    Kind regards,

    Miguel Dilaj (Nekromancer)
    Vice-President of IT Security Research, OISSG


  • Next message: routerg: "Re: tool for mount a dd image"