RE: ntds.dit, john and pwdump2

From: Dave Dyer (ddyer_at_enspherics.com)
Date: 01/25/05

  • Next message: Dave Dyer: "RE: ntds.dit, john and pwdump2" 
    To: "'Klotz, Brian'" <Brian_Klotz@heald.edu>, <ddyer@ciber.com>, <security-basics@securityfocus.com>
Date: Tue, 25 Jan 2005 09:29:46 -0700

    Thanks for the suggestion, Brian, but a couple of items:

    1. I don't normally make a habit of downloading standalone executables
    directly from the internet unless they're signed or from a trusted source.
    Nevertheless, my curiosity got the best of me, so I downloaded it to a
    non-sensitive machine to try it out.

    2. When I ran the executeable, samdump was looking for a file samexport.txt
    which it couldn't find. Turns out that samdump.exe needs samexport.txt to
    run. Samexport.txt seems to be an export of the registry "accounts" key
    which can then be turned into a hashed file by samdump. The following
    command can export the registry values:

    regedit.exe /E /A samexport.txt "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account"

    So, that being said, this doesn't really work for my purposes. I don't
    really want to crack the passwords on my machine, but from this file I have
    from the client. I even, as a lark and for want of some better option,
    tried to rename the NTDS.DIT file to samexport.txt (yes, I knew it wouldn't
    work, but I wanted to see what would happen), and ran samdump against it
    with no luck whatsoever. In fact, if you want a very subtle DOS, it crashed
    the hell out of an XP box I was running.

    Anyway, doesn't look like samdump is going to do the trick, unless I'm
    missing something?

    Any other suggestions?

    -----Original Message-----
    From: Klotz, Brian [mailto:Brian_Klotz@heald.edu]
    Sent: Monday, January 24, 2005 11:38 AM
    To: 'ddyer@ciber.com'; security-basics@securityfocus.com
    Subject: RE: ntds.dit, john and pwdump2

    Try samdump.exe

    http://www.insidepro.com/download/samdump.exe

    Brian Klotz - CCNA, CCAI, Network+, Security+, Linux+ Networking Instructor
    Heald College Portland Campus http://www.heald.edu
    503.229.0492

    -----Original Message-----
    From: Dave Dyer [mailto:ddyer@ciber.com]
    Sent: Thursday, January 20, 2005 10:28 AM
    To: security-basics@securityfocus.com
    Subject: ntds.dit, john and pwdump2

    Hello List,

    I am cracking a password file for a client, and have a copy of the NTDS.DIT
    file from a domain controller (win2k/Active Directory). We do not have
    access to L0phtcrack currently, and I'm on a deadline. I was going to use
    John the Ripper with some plugins written by 3rd parties to crack the
    password file, but apparently the NTDS.DIT file isn't really a hashed file
    that John can read

    After some research, I found that you can use PWDUMP2 to actually export the
    user/pw information on the DC to a hashed file that you can then crack with
    John (even if syskey is used after SP2). However, in order for PWDUMP to
    work, you have to run it as an administrator from the DC itself, where it
    injects its own .dll into the lsass.exe process, which I no longer have
    access to. My question is this:

    Does anyone know if there is a way to extract the user/pw information from
    the NTDS.DIT file (rather than from lsass.exe on the server) into a hashed
    file that I can then crack with John?

    If not, does anyone have any other suggestions on what I can do with this
    NTDS.DIT file to crack it?

    Thanks in Advance,

    dave

    ***********

    Dave Dyer

    <mailto:ddyer@enspherics.com <mailto:ddyer@enspherics.com> >

    "So you'll bring experts in to water the company's plants but you'll do the
    security thing yourself?"

    -QinetiQ in the Financial Times

    This communication may contain Heald College confidential and proprietary
    data.
    Any questions should be directed to a Heald College IT administrator.

  • Next message: Dave Dyer: "RE: ntds.dit, john and pwdump2"

    Relevant Pages

    • Re: ntds.dit, john and pwdump2
      ... | John the Ripper with some plugins written by 3rd parties to crack the ... but apparently the NTDS.DIT file isn't really a hashed file ... | user/pw information on the DC to a hashed file that you can then crack ... | Dave Dyer ...
      (Security-Basics)
    • ntds.dit, john and pwdump2
      ... I am cracking a password file for a client, and have a copy of the NTDS.DIT ... John the Ripper with some plugins written by 3rd parties to crack the ... but apparently the NTDS.DIT file isn't really a hashed file ...
      (Security-Basics)
    • RE: ntds.dit, john and pwdump2
      ... thanks for the tip on Cain. ... to a file that you can then crack using l0pht, john or cain. ... Subject: ntds.dit, john and pwdump2 ...
      (Security-Basics)
    • RE: ntds.dit, john and pwdump2
      ... I am cracking a password file for a client, and have a copy of the NTDS.DIT ... John the Ripper with some plugins written by 3rd parties to crack the ... I found that you can use PWDUMP2 to actually export the ...
      (Security-Basics)
    • RE: ntds.dit, john and pwdump2
      ... Lophtcrack and Windows XP/2000/NT Key can do domain account ... Subject: ntds.dit, john and pwdump2 ... it wants a hashed txt file to crack as well. ...
      (Security-Basics)
    • Quantcast