the passwords for windows are hashed with MD4(?) which is implemented
depending on LM/NTLM settings. Kerberos is a different system. Once
the hashes have been created, they are encrypted with a DES variant
algorithm and saved in the SAM database. The key is conveniently
stored in a file called 'system' which is in the same directory.
if you have the SAM file, you should also have taken the system file.
system holds the boot key (syskey) which is needed to decrypt the
hashes.
Once you have decrypted the hashes, you can crack them using any
password attack tool.
I would recommend that you get hold of Cain & Abel from www.oxid.it
It is by far the best Windoze based tool for doing this kind of thing
In linux, you have tools like bkhive which can extract the boot key
from the system file, and samdump which will decrypt the hashes ready
for breaking.
later
On 9/27/06, Hari Sekhon <hpsekhon@googlemail.com> wrote:
Hi,
I've found cachedump to be reliable in the past, lsadump caused some
crashing problems for me at the time so I didn't use it.
Could somebody tell me how to go about retrieving the hashes from the
offline sam file. Is there a way? And if so what form do the hashes come
in, DES?
Thanks
-h
--
Hari Sekhon
On 9/25/06, s-williams@nyc.rr.com <s-williams@nyc.rr.com> wrote:
>> Or if you go to the %systemroot%repair in that folder you should see
>> a backup of the sam and the system file feed that to lcp, saminside,
>> lc5, anyone and you have your passwords.
>> Sent via BlackBerry from T-Mobile
>>
>> -----Original Message-----
>> From: okrehel@loews.com
>> Date: Mon, 25 Sep 2006 11:20:46
>> To:juanbabi@yahoo.com
>> Cc:listbounce@securityfocus.com, pen-test@securityfocus.com
>> Subject: Re: cracking Y2k DC Admin password
>>
>> try
>>
>> - rescue in windows folder and backup sam file from it, it has admin
>> credentials, johny the riper, LC, and ophcrack will do the job - with
>> hash
>> tables....
>> - use cachedump to dump cached credentials on that server, maybe
>> admin was
>> signed on (default is 5 accounts cached)
>> - use lsadump2 to dump passwords of running services, maybe some of
>> them is
>> running with the local admin credentials
>>
>> Ondrej Krehel, CISSP, CEH
>>
>>
>>
>>
>> juanbabi@yahoo.co
>> m
>> Sent
>> by: To
>> listbounce@securi pen-test@securityfocus.com
>>
>> tyfocus.com cc
>>
>>
>> Subject
>> 09/22/2006 08:45 cracking Y2k DC Admin password
>> PM
>>
>>
>>
>>
>> Hi,
>>
>>
>> for a pen test in doing I got control on the server and logged as the
>> local
>> admin. know I need to retrive the admin's password this is the goal
>> of the
>> pen test from the client side. I know an easy way to crack the sam file
>> with a live linux cd but I cant boot the server it needs to be
>> allways up.
>> I tried to use pwdump.exe but it tells me he cand find the local ADMIN$
>> shere. so it wont work.does someone knows a good way to retrive and
>> crack
>> the admin's password.I an really stuck on this...
>>
>>
>> thanks very much !
>>
>> Juan
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------
--
Lee J Lawson
leejlawson@gmail.com
leejlawson@hushmail.com
"Give a man a fire, and he'll be warm for a day; set a man on fire,
and he'll be warm for the rest of his life."
"Quidquid latine dictum sit, altum sonatur."
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------
