Re: ntds.dit, john and pwdump2

Hi Dave,

Sorry for not answering your question. Perhaps some other answers on the 
list are useful (have you tried Cain?).
I just want to make you (well... and everyone in the list) aware of 
different flavours of pwdump.
All of them require administrative privileges (or SYSTEM, as far as I know 
it works as well when we're speaking of the local machine).
First we have good old pwdump. It runs only on the local machine.
Then we have pwdump2, it runs also on the local machine, and solves some 
issues present in pwdump (for example, it overcomes SYSKEY).
Then we have pwdump3, it runs remotely (administrative credentials still 
needed, of course).
And the last one, not widely known, is pwdump4. It runs either locally or 
remotely, overcomes some issues with pwdump3 (for example you can specify 
the network share to use).

For your password cracking exercise, John is not your only option.
Lepton's Crack, of which I'm one of the proud "fathers" supports NTLM 
hashes in the "stable" branch, and also LM hashes in the "development" 
branch, as well as several other hashing algorithms.
It can be found at http://freshmeat.net/lcrack/
Cain also has a cracking module, and of course there're several other 
programs.
Kind regards,

Miguel Dilaj (Nekromancer)
Vice-President of IT Security Research, OISSG