Security Basics mailing list archives
RE: ntds.dit, john and pwdump2
From: "Dave Dyer" <ddyer () enspherics com>
Date: Tue, 25 Jan 2005 09:29:46 -0700
Thanks for the suggestion, Brian, but a couple of items: 1. I don't normally make a habit of downloading standalone executables directly from the internet unless they're signed or from a trusted source. Nevertheless, my curiosity got the best of me, so I downloaded it to a non-sensitive machine to try it out. 2. When I ran the executeable, samdump was looking for a file samexport.txt which it couldn't find. Turns out that samdump.exe needs samexport.txt to run. Samexport.txt seems to be an export of the registry "accounts" key which can then be turned into a hashed file by samdump. The following command can export the registry values: regedit.exe /E /A samexport.txt "HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account" So, that being said, this doesn't really work for my purposes. I don't really want to crack the passwords on my machine, but from this file I have from the client. I even, as a lark and for want of some better option, tried to rename the NTDS.DIT file to samexport.txt (yes, I knew it wouldn't work, but I wanted to see what would happen), and ran samdump against it with no luck whatsoever. In fact, if you want a very subtle DOS, it crashed the hell out of an XP box I was running. Anyway, doesn't look like samdump is going to do the trick, unless I'm missing something? Any other suggestions? -----Original Message----- From: Klotz, Brian [mailto:Brian_Klotz () heald edu] Sent: Monday, January 24, 2005 11:38 AM To: 'ddyer () ciber com'; security-basics () securityfocus com Subject: RE: ntds.dit, john and pwdump2 Try samdump.exe http://www.insidepro.com/download/samdump.exe Brian Klotz - CCNA, CCAI, Network+, Security+, Linux+ Networking Instructor Heald College Portland Campus http://www.heald.edu 503.229.0492 -----Original Message----- From: Dave Dyer [mailto:ddyer () ciber com] Sent: Thursday, January 20, 2005 10:28 AM To: security-basics () securityfocus com Subject: ntds.dit, john and pwdump2 Hello List, I am cracking a password file for a client, and have a copy of the NTDS.DIT file from a domain controller (win2k/Active Directory). We do not have access to L0phtcrack currently, and I'm on a deadline. I was going to use John the Ripper with some plugins written by 3rd parties to crack the password file, but apparently the NTDS.DIT file isn't really a hashed file that John can read After some research, I found that you can use PWDUMP2 to actually export the user/pw information on the DC to a hashed file that you can then crack with John (even if syskey is used after SP2). However, in order for PWDUMP to work, you have to run it as an administrator from the DC itself, where it injects its own .dll into the lsass.exe process, which I no longer have access to. My question is this: Does anyone know if there is a way to extract the user/pw information from the NTDS.DIT file (rather than from lsass.exe on the server) into a hashed file that I can then crack with John? If not, does anyone have any other suggestions on what I can do with this NTDS.DIT file to crack it? Thanks in Advance, dave *********** Dave Dyer <mailto:ddyer () enspherics com <mailto:ddyer () enspherics com> > "So you'll bring experts in to water the company's plants but you'll do the security thing yourself?" -QinetiQ in the Financial Times This communication may contain Heald College confidential and proprietary data. Any questions should be directed to a Heald College IT administrator.
Current thread:
- ntds.dit, john and pwdump2 Dave Dyer (Jan 24)
- Re: ntds.dit, john and pwdump2 the.soylent (Jan 24)
- RE: ntds.dit, john and pwdump2 Dave Dyer (Jan 25)
- <Possible follow-ups>
- RE: ntds.dit, john and pwdump2 Beauford, Jason (Jan 24)
- RE: ntds.dit, john and pwdump2 Klotz, Brian (Jan 24)
- RE: ntds.dit, john and pwdump2 Dave Dyer (Jan 25)
- Re: ntds.dit, john and pwdump2 miguel . dilaj (Jan 25)
- RE: ntds.dit, john and pwdump2 Roger A. Grimes (Jan 26)
- RE: ntds.dit, john and pwdump2 Roger A. Grimes (Jan 27)
- Re: ntds.dit, john and pwdump2 the.soylent (Jan 24)