Re: cracking Y2k DC Admin password

["Lee Lawson" <leejlawson () gmail com>]

the passwords for windows are hashed with MD4(?) which is implemented
depending on LM/NTLM settings.  Kerberos is a different system.  Once
the hashes have been created, they are encrypted with a DES variant
algorithm and saved in the SAM database.  The key is conveniently
stored in a file called 'system' which is in the same directory.

if you have the SAM file, you should also have taken the system file.
system holds the boot key (syskey) which is needed to decrypt the
hashes.

Once you have decrypted the hashes, you can crack them using any
password attack tool.

I would recommend that you get hold of Cain & Abel from www.oxid.it
It is by far the best Windoze based tool for doing this kind of thing

In linux, you have tools like bkhive which can extract the boot key
from the system file, and samdump which will decrypt the hashes ready
for breaking.

later

On 9/27/06, Hari Sekhon <hpsekhon () googlemail com> wrote:
> Hi,
>    I've found cachedump to be reliable in the past, lsadump caused some
> crashing problems for me at the time so I didn't use it.
>
> Could somebody tell me how to go about retrieving the hashes from the
> offline sam file. Is there a way? And if so what form do the hashes come
> in, DES?
>
>
> Thanks
>
> -h
>
> --
> Hari Sekhon
>
>
> On 9/25/06, s-williams () nyc rr com <s-williams () nyc rr com> wrote:
> >> Or if you go to the %systemroot%repair in that folder you should see
> >> a backup of the sam and the system file feed that to lcp, saminside,
> >> lc5, anyone and you have your passwords.
> >> Sent via BlackBerry from T-Mobile
> >>
> >> -----Original Message-----
> >> From: okrehel () loews com
> >> Date: Mon, 25 Sep 2006 11:20:46
> >> To:juanbabi () yahoo com
> >> Cc:listbounce () securityfocus com, pen-test () securityfocus com
> >> Subject: Re: cracking Y2k DC Admin password
> >>
> >> try
> >>
> >> - rescue in windows folder and backup sam file from it, it has admin
> >> credentials, johny the riper, LC, and ophcrack will do the job - with
> >> hash
> >> tables....
> >> - use cachedump to dump cached credentials on that server, maybe
> >> admin was
> >> signed on (default is 5 accounts cached)
> >> - use lsadump2 to dump passwords of running services, maybe some of
> >> them is
> >> running with the local admin credentials
> >>
> >> Ondrej Krehel, CISSP, CEH
> >>
> >>
> >>
> >>
> >>              juanbabi () yahoo co
> >>              m
> >>              Sent
> >> by:                                                   To
> >>              listbounce@securi         pen-test () securityfocus com
> >>
> >> tyfocus.com                                                cc
> >>
> >>
> >> Subject
> >>              09/22/2006 08:45          cracking Y2k DC Admin password
> >>              PM
> >>
> >>
> >>
> >>
> >> Hi,
> >>
> >>
> >> for a pen test in doing I got control on the server and logged as the
> >> local
> >> admin. know I need to retrive the admin's password this is the goal
> >> of the
> >> pen test from the client side. I know an easy way to crack the sam file
> >> with a live linux cd but I cant boot the server it needs to be
> >> allways up.
> >> I tried to use pwdump.exe but it tells me he cand find the local ADMIN$
> >> shere. so it wont work.does someone knows a good way to retrive and
> >> crack
> >> the admin's password.I an really stuck on this...
> >>
> >>
> >> thanks very much !
> >>
> >> Juan
>
> ------------------------------------------------------------------------
> This List Sponsored by: Cenzic
>
> Need to secure your web apps?
> Cenzic Hailstorm finds vulnerabilities fast.
> Click the link to buy it, try it or download Hailstorm for FREE.
> http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
> ------------------------------------------------------------------------


--
Lee J Lawson
leejlawson () gmail com
leejlawson () hushmail com

"Give a man a fire, and he'll be warm for a day; set a man on fire,
and he'll be warm for the rest of his life."

"Quidquid latine dictum sit, altum sonatur."

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------