Re: Password Audits

[Jeff Ferris <beeritarian () gmail com>]

Hi Jair,

LC cracks the Lanman protocol. That is why it has a limit of 14
characters, that is what Lanman uses (2 sections of 7).
For backwards compatibility with NT the SAM stores Lanman hashes, but
if the password length exceeds 15, the hash isn't stored correctly,
and it will just read NULL in LC.

The passwords in a win 2k and XP domain are hashed with  HMAC-MD5
instead of lanman, which may be supported by tools like John the
Ripper and Rainbox crack, but I'm not certain. If they do, use a tool
like PWDUMP and then run john on the output. Either way, it would take
a super long time to brute force a password of that length, so you
would probably just run a dictionary against it.

That's my understanding at least,
Jeff

On 4/22/05, Jair <jairgerald () hotmail com> wrote:
> Hi Fellows,
>
> I am using LC5 tool for audit windows 2000 users passwords and look like it
> only work with 14 characters passwords or less, I know some users have some
> long passwords over 14 characters and LC5 doesn't show me information about
> them.
>
> do you guys know if is a tool who can break long passwords ?
>
> Thanks for you help