Penetration Testing mailing list archives
Re: [PEN-TEST] Cracking a Stolen SAM
From: "Deus, Attonbitus" <Thor () HammerofGod Com>
Date: Tue, 7 Nov 2000 16:07:44 -0800
The ShowCode.asp simply uses some InStr and Response.Writes from different printline statements as it is expecting some HTML or ASP source files. The sam._ in the repair dir is binary. You won't expose the hash this way. If they have the showcode vuln, I'm sure you can monkey around enought to execute some back end code to either copy the sam where you can get it or just ftp it to yourself. (the latter is more difficult, but works in a pinch.) Then import the sam into L0pht and go nuts. --------------------------------------------------------- Attonbitus Deus thor () hammerofgod com ----- Original Message ----- From: "Gallicchio, Florindo (2007)" <florindo.gallicchio () ESAVIO COM> To: <PEN-TEST () SECURITYFOCUS COM> Sent: Tuesday, November 07, 2000 11:25 AM Subject: [PEN-TEST] Cracking a Stolen SAM Friends: I'm currently performing a penetration test, and I was able to access the SAM file located in the WINNT/repair directory. Specifically, I exploited the showcode.asp vulnerability to "see" the sam._ file in the \WINNT\repair directory. I screen-scraped the relevant contents to a Notepad file, and saved it. Here's where I began to guess. First, I ran the file (I named it sam._) through l0phtcrack and through the cracker on CyberCop, but it didn't take. I then ran the file through the Windows "expand" command, and ran the resulting file through the tools. Still nothing. Here's where I'm stuck. I'm assuming that there are some funky control characters in the screen-scrape file that I don't know about. I tried some traffic analysis work on the file, but I quickly got a headache. Can anyone please help? Thanks. Florindo ________________________________________________ Florindo Gallicchio * Director, Security Services * esävio * 15 Corporate Place South * 3rd Fl. * Piscataway, NJ 08854 * 732.981.1991 x2007 * florindo.gallicchio () esavio com * Adding Our Strength To Yours *
Current thread:
- [PEN-TEST] Cracking a Stolen SAM Gallicchio, Florindo (2007) (Nov 08)
- Re: [PEN-TEST] Cracking a Stolen SAM Deus, Attonbitus (Nov 08)
- <Possible follow-ups>
- Re: [PEN-TEST] Cracking a Stolen SAM Dunker, Noah (Nov 08)
- Re: [PEN-TEST] Cracking a Stolen SAM Gallicchio, Florindo (2007) (Nov 08)