Hey Soylent, thanks for the tip on Cain. Nice tool. However, for future
information, it wants a hashed txt file to crack as well. It's looking like
the only way to do this is to run pwdump2 on a syskey'd volume and export it
to a file that you can then crack using l0pht, john or cain.
Thanks for all the help.
dd
-----Original Message-----
From: the.soylent [mailto:the.soylent@gmail.com]
Sent: Monday, January 24, 2005 11:22 AM
To: ddyer@ciber.com
Cc: security-basics@securityfocus.com
Subject: Re: ntds.dit, john and pwdump2
*** PGP SIGNATURE VERIFICATION ***
*** Status: Good Signature from Invalid Key
*** Alert: Please verify signer's key before trusting signature.
*** Signer: soylent (the.soylent) <the.soylent@gmail.com> (0x10BDD9C8)
*** Signed: 1/24/2005 11:22:20 AM
*** Verified: 1/25/2005 9:44:35 AM
*** BEGIN PGP VERIFIED MESSAGE ***
hi!
have you tried cain?
in the online-manuel (http://www.oxid.it/ca25um/) theres the talk of a
cracker and a converter
here`s the link -> http://www.oxid.it/cain.html
cheers, soylent
Dave Dyer schrieb:
| Hello List,
|
| I am cracking a password file for a client, and have a copy of the
NTDS.DIT
| file from a domain controller (win2k/Active Directory). We do not have
| access to L0phtcrack currently, and I'm on a deadline. I was going to
| use John the Ripper with some plugins written by 3rd parties to crack
| the password file, but apparently the NTDS.DIT file isn't really a
| hashed file that John can read
|
| After some research, I found that you can use PWDUMP2 to actually
export the
| user/pw information on the DC to a hashed file that you can then crack
with
| John (even if syskey is used after SP2). However, in order for PWDUMP
| to work, you have to run it as an administrator from the DC itself,
| where it injects its own .dll into the lsass.exe process, which I no
| longer have access to. My question is this:
|
| Does anyone know if there is a way to extract the user/pw information
| from the NTDS.DIT file (rather than from lsass.exe on the server) into
| a hashed file that I can then crack with John?
|
| If not, does anyone have any other suggestions on what I can do with
| this NTDS.DIT file to crack it?
|
| Thanks in Advance,
|
| dave
|
| ***********
|
| Dave Dyer
|
| <mailto:ddyer@enspherics.com <mailto:ddyer@enspherics.com> >
|
| "So you'll bring experts in to water the company's plants but you'll
do the
| security thing yourself?"
|
| -QinetiQ in the Financial Times
|
|
|
*** END PGP VERIFIED MESSAGE ***
