Re: Brute-forcing cached Windows login password hashes

["Mathieu CHATEAU" <gollum123 () free fr>]

hello,

rainbow tables on freerainbowtables are much limited on mscache (since per 
login hash). Mainly only for the well known "administrator" account

Cordialement,
Mathieu CHATEAU
http://lordoftheping.blogspot.com


----- Original Message ----- 
From: "Per Thorsheim" <putilutt () online no>
To: "'Ben Greenberg'" <Ben.Greenberg () senet-int com>; 
<pen-test () securityfocus com>
Sent: Thursday, July 26, 2007 7:50 AM
Subject: SV: Brute-forcing cached Windows login password hashes



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Download Cain & Abel from www.oxid.it, that should enable you to
crack the password hashes in question.

Rainbow tables are available at www.freerainbowtables.com, where you
can also participate in generating tables by running their
distributed table generator.

Regards,
Per Thorsheim



- -----Opprinnelig melding-----
Fra: listbounce () securityfocus com
[mailto:listbounce () securityfocus com] På vegne av Ben Greenberg
Sendt: 25. juli 2007 15:19
Til: pen-test () securityfocus com
Emne: Brute-forcing cached Windows login password hashes

Greetings all,

My question is regarding the encrypted password hashes that Windows
stores in the registry of the last 10 logins to a workstation.

I read the original white paper written by Arnaud Pilon and I've used
his cachedump tool to extract the password hashes from the registry.
What I'm wondering is what type of hash those passwords use. Is it
straight MD4? I know that each hash is salted with a machine-specific
unique string. What I am unclear on is what exactly the password hash
is and how it can be brute-forced. I know that there is a patch for
John the Ripper, but every mention I can find refers to a two year
old version of John. Does anyone know if the most recent version has
this patch in it already? Also, is anyone familiar with any rainbow
tables for cracking these passwords? Are rainbow tables possible for
these hashes because of the salting?

Thanks all.

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBRqg2GrF5fmPQ0K72EQK+lwCdFhhO1vnEPsRlVypc8dfh0jGRYq0AoJtD
LwrQU1xtVCirq6krNfp2Mr+5
=9sEy
-----END PGP SIGNATURE-----



------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------



------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------