Re: No LM Hash - no really

From: Ian Boyd (admin_at_SWIFTPA.NET)
Date: 08/22/04 

Date: Sun, 22 Aug 2004 07:34:25 -0400

Both your shows Guest and Admistrator accounts there have no LM password.
The others do.

> One way to also test your environment is to create password that is longer
> then 14 characters (15 will be fine). In this case password can not be
> stored as LM "Hash" due to LM design.

That doesn't test the domain controller not storing the LM hash in the first
place.

> Next thing to check would be did your client get new policy. At what level
> did you set it? Domain, OU, ... ?

It is set on the Domain (Default domain group policy)

My workstation has the policy inherited ( i can see it in the workstation's
own group policy).

Yet i change my password to some uber shocking non-sense, and in 2 minutes i
can have it cracked because the LM Hash is still being stored.

***

> I have few passwords to reset now :-)

i guess.

> I have dumped some information on this URL... Can you check this and
compare
> to your results.

a:91c7ae7122196b5eaad3b435b51404ee:passwd
c:8b0ea5a7df135b03aad3b435b51404ee:p
f:3b61b03f29f1c479818d2672d8e13550:.......tugmsee
g:8c6f5d02deb21501aad3b435b51404ee:abc
h:89a8d8845f8d04f8aad3b435b51404ee:geslo_
i:91c7ae7122196b5eaad3b435b51404ee:passwd

Administrator and Guest:aad3b435b51404eeaad3b435b51404ee:<empty>

Quantcast