Scribd
Upload
44 views3 pages

Password Cracking Guide for Windows

This document provides step-by-step instructions for cracking Windows passwords using various tools. It covers extracting password hashes from Windows SAM files, remotely capturing hashes, and cracking hashes using tools like John the Ripper, Ophcrack, rainbow tables and more. The document also discusses related topics like disabling LM hashes and using Syskey.

Uploaded by

Rog Don
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
44 views3 pages

Password Cracking Guide for Windows

This document provides step-by-step instructions for cracking Windows passwords using various tools. It covers extracting password hashes from Windows SAM files, remotely capturing hashes, and cracking hashes using tools like John the Ripper, Ophcrack, rainbow tables and more. The document also discusses related topics like disabling LM hashes and using Syskey.

Uploaded by

Rog Don
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd

Cracking Passwords Version 1.1by: J.

DravetFebruary 15, 2010AbstractThis document


is for people who want to learn to the how and why of password cracking. There isa
lot of information being presented and you should READ IT ALL BEFORE you
attempteddoing anything documented here. I do my best to provide step by step
instructions along with thereasons for doing it this way. Other times I will point
to a particular website where you find theinformation. In those cases someone else
has done what I attempting and did a good or great joband I did not want to steal
their hard work. These instructions have several excerpts from acombination of
posts from pureh@te, granger53, irongeek, PrairieFire, RaginRob, stasik, andSolar
Designer. I would also like to thank each of them and others for the help they have
providedme on the BackTrack forum.I will cover both getting the SAM from inside
windows and from the BackTrack CD, DVD, orUSB flash drive. The SAM is the Security
Accounts Manager database where local usernames andpasswords are stored. For legal
purposes I am using my own system for this article. The first stepis to get a copy
of pwdump. You can choose one from [Link] I
used to use pwdump7 to dump my passwords, however I have come across a new
utilitycalled fgdump from [Link] This new utility
will dump passwordsfrom clients and Active Directory (Windows 2000 and 2003 for
sure, not sure about Windows2008) where pwdump7 only dumps client passwords. I have
included a sample [Link] that hassimple passwords and should be cracked very
easily. NOTE: Some anti-virus software packagesflag pwdump* and fgdump as trojan
horse programs or some other unwanted program. Ifnecessary, you can add an
exclusion for fgdump and/or pwdump to your anti-virus package so itwon't flag them.
However it is better for the community if you contact your anti-virus vendor andask
them to not flag the tool as a virus/malware/trojan [Link] can find the latest
version of this document at [Link] LM vs. NTLM2
Syskey3 Cracking Windows Passwords 3.1 Extracting the hashes from the Windows SAM
3.1.1 Using BackTrack Tools [Link] Using bkhive and samdump v1.1.1 (BT2
and BT3) [Link] Using samdump2 v2.0.1 (BT4) [Link] Cached
Credentials 3.1.2 Using Windows Tools [Link] Using fgdump
[Link] Using gsecdumpCracking Passwords Version 1.1[Link] of
452/15/2010 3:48 PM
[Link] Using pwdump7 [Link] Cached Credentials 3.2 Extracting
the hashes from the Windows SAM remotely 3.2.1 Using BackTrack Tools
[Link] ettercap 3.2.2 Using Windows Tools [Link] Using fgdump 3.3
Cracking Windows Passwords 3.3.1 Using BackTrack Tools [Link] John
the Ripper BT3 and BT4 [Link].1 Cracking the LM hash
[Link].2 Cracking the NTLM hash [Link].3 Cracking the NTLM using the
cracked LM hash [Link].4 Cracking cached credentials [Link]
John the Ripper - current [Link].1 Get and Compile [Link].2
Cracking the LM hash [Link].3 Cracking the LM hash using known
letter(s) in known location(s) (knownforce) [Link].4 Cracking the NTLM
hash [Link].5 Cracking the NTLM hash using the cracked LM hash
(dumbforce) [Link].6 Cracking cached credentials [Link] Using
MDCrack [Link].1 Cracking the LM hash [Link].2 Cracking the
NTLM hash [Link].3 Cracking the NTLM hash using the cracked LM hash
[Link] Using Ophcrack [Link].1 Cracking the LM hash
[Link].2 Cracking the NTLM hash [Link].3 Cracking the NTLM hash using
the cracked LM hash 3.3.2 Using Windows Tools [Link] John the Ripper
[Link].1 Cracking the LM hash [Link].2 Cracking the NTLM hash
[Link].3 Cracking the NTLM hash using the cracked LM hash [Link].4
Cracking cached credentials [Link] Using MDCrack [Link].1
Cracking the LM hash [Link].2 Cracking the NTLM hash
[Link].3 Cracking the NTLM hash using the cracked LM hash [Link] Using
Ophcrack [Link].1 Cracking the LM hash [Link].2 Cracking
the NTLM hash [Link].3 Cracking the NTLM hash using the cracked LM hash
[Link] Using Cain and Abel 3.3.3 Using a Live CD [Link] Ophcrack4.
Changing Windows Passwords 4.1 Changing Local User Passwords 4.1.1 Using
BackTrack Tools [Link] chntpw 4.1.2 Using a Live CDCracking Passwords
Version 1.1[Link] of 452/15/2010 3:48 PM
[Link] chntpw [Link] System Rescue CD 4.2 Changing Active
Directory Passwords5 plain-text.info6 Cracking Novell NetWare Passwords7 Cracking
Linux/Unix Passwords8 Cracking networking equipment passwords 8.1 Using BackTrack
tools 8.1.1 Using Hydra 8.1.2 Using Xhydra 8.1.3 Using Medusa
8.1.4 Using John the Ripper to crack a Cisco hash 8.2 Using Windows tools
8.2.1 Using Brutus9 Cracking Applications 9.1 Cracking Oracle 11g (sha1) 9.2
Cracking Oracle passwords over the wire 9.3 Cracking Office passwords 9.4
Cracking tar passwords 9.5 Cracking zip passwords 9.6 Cracking pdf passwords10
Wordlists aka Dictionary attack 10.1 Using John the Ripper to generate a wordlist
10.2 Configuring John the Ripper to use a wordlist 10.3 Using crunch to generate
a wordlist 10.4 Generate a wordlist from a textfile or website 10.5 Using
premade wordlists 10.6 Other wordlist generators 10.7 Manipulating your
wordlist11 Rainbow Tables 11.1 What are they? 11.2 Generating your own
11.2.1 rcrack - obsolete but works 11.2.2 rcracki 11.2.3 rcracki - boinc
client 11.2.4 Generating a rainbow table 11.3 WEP cracking 11.4 WPA-PSK
11.4.1 airolib 11.4.2 pyrit12 Distributed Password cracking 12.1 john 12.2
medussa (not a typo this is not medusa)13 using a GPU 13.1 cuda - nvidia 13.2
stream - ati14 example hash.txt1 LM vs. NTLMThe LM hash is the old style hash used
in MS operating systems before NT 3.1. It converts the password toCracking
Passwords Version 1.1[Link] of 452/15/2010 3:48 PM
uppercase, null-pads or truncates the password to 14 characters. The password is
split into two 7 characterhalves and uses the DES algorithm. NT 3.1 to XP SP2
supports LM hashes for backward compatibility and isenabled by default. Vista
supports LM hashes but is disabled by default. Given the weaknesses in the LMhash
it is recommended to disable using LM hashes for all MS operating systems using the
steps in[Link] was introduced in NT 3.1 and
does not covert the password to uppercase, does not break the passwordapart, and
supports password lengths greater than 14. There are two versions of NTLM v1 and
v2. Do to aweakness in NTLM v1 is should not be used. Microsoft has included
support for NTLM v2 for all of itsoperating systems either via service pack or the
Directory Services client (for windows 9X). You enableNTLM v2 by following the
instructions at [Link] For maximum securityyou
should set the LMCompatibility to 3 for Windows 9X and LMCompatibilityLevel to 5
for NT, 2000, XP,and 2003. Of course you should test these changes BEFORE you put
them into a production [Link] LM hashes are disabled on your system the
output of pwdump and/or the [Link].pwdump text file willlook
like:Administrator:500:NO
PASSWORD*********************:00AB1D1285F410C30A83B435F2CA798D:::Guest:501:NO
PASSWORD*********************:31A6CAE0D36AD931B76C59D7E1C039C0:::HelpAssistant:1000
:NO
PASSWORD*********************:BF23C2595478A6279F7CB53EF76E601F:::SUPPORT_3845a0:100
2:NOPASSWORD*********************:0C8D62E10A6240BACD910C8AB295BB79:::ASPNET:1005:9F
07AE96CA4310752BDC083AAC960496:A99C1C3DB39E3C732EF5C2F63579AF96:::The first field
is the username. The second field is the last four numbers of the SID for that
username. TheSID is a security identifier that is unique to each username. The
third field is the LM hash. The forth field isthe NTLM [Link] you do not have a
ASPNET user account do not worry about it. If you do have a ASPNET user account
doNOT change the password as I am told that will break something. What I did was
delete the account and thenrecreate it using: systemroot
%\[Link]\Framework\v1.1.4322\aspnet_regiis.exe /i2 SyskeyTo make it more
difficult to crack your passwords, use syskey. For more information on syskey
see[Link] The short version is syskey encrypts the
SAM. The weakest optionbut most convenient is to store a system generated password
locally; locally means the registry. The up side isthe SAM gets encrypted and you
can reboot the server remotely without extra equipment. The next option ispassword
startup. This is slightly more difficult to get around, but if you remotely reboot
the server, it willstop and wait for someone to enter the password. You will need a
KVM over IP or a serial port concentratorso you can enter the password remotely.
The most secure option is the system generated password stored on afloppy disk. The
downside to this option is floppy disks fail, you misplace the floppy disk, newer
equipmentdoes not have a floppy disk drive, no remote reboots, and you will
probably leave the floppy in the drive soyou can remote reboot and that defeats
security. I use a system generated password stored locally, weak butbetter than not
doing it. To disable syskey use chntpw and follow its instructions.3 Cracking
Windows Passwords3.1 Extracting the hashes from the Windows SAM3.1.1 Using
BackTrack ToolsCracking Passwords Version 1.1[Link] of
452/15/2010 3:48 PM
[Link] Using bkhive and samdump2 v1.1.1 (BT2 and BT3)# mount /dev/hda1
/mnt/XXXmount your windows partition substituting hda1 for whatever your windows
partition [Link] the syskey password is stored locally you need to extract it from
the registry so you can decrypt theSAM. If syskey is setup to prompt for a password
or the password is on a floppy, stop now and read thesyskey documentation in this
document for more information about syskey. If you installed windows tosomething
other C:\WINDOWS please substitute the correct path. WARNING the path is
casesensitive. The filenames of sam, security, and system are case sensitive. On my
system these files arelowercase. I have come across other XP systems where they are
uppercase. On the Vista system I haveused the filenames are [Link] 2
users use the following:# bkhive-linux /mnt/XXX/WINDOWS/system32/config/system
[Link] 3 users use the following:# bkhive
/mnt/XXX/WINDOWS/system32/config/system syskey.txt2.# samdump2
/mnt/XXX/WINDOWS/system32/config/sam [Link] >hash.txtsamdump2 will dump the SAM
to the screen and the > character redirects the output to a file [Link]
can also run samdump2 with the -o parameter to write the output to a file# samdump2
-o [Link] /mnt/XXX/WINDOWS/system32/config/sam syskey.txt3.[Link] Using new
samdump2 v2.0 (BT4)The current version is 2.0.1 and has the benefit of being able
to extract the syskey on its own. This meansdumping the hashes in now a 1 step
process instead of two. To upgrade and run sampdump2 v2.0.1:download the current
sampdump2 from [Link] tar
-xjvf [Link].bz22.# cd samdump2-2.0.13.# make4.# cp samdump2
/usr/local/bin/samdump20this will keep the existing version. If you want to
overwrite the existing version do:# cp samdump2 /usr/local/bin/[Link] your windows
partition substituting hda1 for whatever your windows partition is# mount /dev/hda1
/mnt/[Link] the syskey password is stored locally samdump2 v2.0 will extract it
from the registry so it can decryptthe SAM. If syskey is setup to prompt for a
password or the password is on a floppy, stop now and readthe syskey documentation
in this document for more information about syskey. If you installedwindows to
something other C:\WINDOWS please substitute the correct path. WARNING the path
iscase sensitive. The filenames of sam, security, and system are case sensitive. On
my system these filesare lowercase. I have come across other XP systems where they
are uppercase. On the Vista system Ihave used the filenames are uppercase.7.#
samdump2 /mnt/XXX/WINDOWS/system32/config/system /mnt/XXX/WINDOWS/sy

Common questions

Powered by AI

Storing passwords in cached credentials on Windows systems allows users to log in without a network connection to the domain controller. However, it introduces security risks as these cached credentials can be extracted and potentially cracked, granting unauthorized access to system resources. The caching mechanism, if not properly managed, can augment the attack surface by providing additional ways to extract user authentication data, risking unauthorized access if these hashes are successfully cracked .

The primary difference between LM and NTLM hashes lies in how they handle passwords. The LM hash converts passwords to uppercase, truncates them to 14 characters, splits them into two 7-character halves, and uses the DES algorithm. In contrast, NTLM does not convert passwords to uppercase, supports passwords longer than 14 characters, and doesn't split the password. NTLM is generally more secure than LM, primarily because it doesn’t have the weaknesses associated with truncation and case conversion .

John the Ripper differentiates between cracking LM and NTLM hashes by utilizing the properties of each hash type. For LM hashes, since they convert passwords to uppercase and split them into two halves, the cracking process can exploit these characteristics to simplify brute force attacks. For NTLM, John the Ripper focuses on its lack of character limitations and case sensitivity, which generally involves handling longer password lengths and more complex character sets. This tailored approach for each hash type allows the tool to effectively manage the intricacies of different hash algorithms .

The advantage of using syskey with a locally stored system-generated password is that it encrypts the SAM, allowing for remote reboots without extra equipment, and provides some level of security by encrypting stored passwords. However, it is the weakest form of syskey because the encryption key is stored locally, making it susceptible to extraction and decryption by attackers. Despite this, it is more convenient than other syskey options, such as password startup or using a floppy disk, which can complicate remote system management .

fgdump provides several benefits over pwdump, including its ability to dump both local client passwords and Active Directory passwords, which pwdump typically does not support. Additionally, fgdump has enhanced compatibility with various Windows versions, providing broader applicability in extracting password hashes effectively. These capabilities make fgdump a more versatile and powerful tool for administrators and penetration testers dealing with multiple Windows systems and configurations .

Distributed password cracking enhances the efficiency of hash cracking by leveraging multiple computing resources to perform password guessing tasks in parallel. This approach divides the workload among several machines, reducing the time needed to crack passwords significantly compared to single-system efforts. Distributed systems like those using John the Ripper can incorporate the processing power of a network of computers, allowing for simultaneous attempts on different parts of the solution space, which greatly improves speed and efficiency in cracking complex password hashes .

bkhive and samdump2 play crucial roles in extracting Windows password hashes by allowing administrators or attackers to access the SAM database where Windows stores user credentials. bkhive extracts the system key, which is necessary for decrypting the SAM database, and samdump2 uses this key to pull the actual password hashes from the SAM. This process is vital for password recovery or cracking attempts, as it provides the necessary hash data required to begin cracking operations .

Rainbow tables are precomputed tables used in cryptanalysis to reverse cryptographic hash functions, particularly for cracking password hashes. They work by storing massive amounts of possible plaintext passwords and their corresponding hash values. When a hash value is obtained, it can be quickly matched against a rainbow table to find the original plaintext password, significantly speeding up the cracking process compared to brute force methods, which require generating hashes for each guess on-the-fly .

Disabling antivirus software may be necessary when using password dumping tools like fgdump or pwdump because these tools are often flagged as malicious due to their ability to extract sensitive information from the system. Antivirus programs classify such tools as potential threats, often mislabeling them as trojans or viruses, which can prevent them from executing properly. By disabling antivirus software, users ensure these tools can run as intended for legitimate testing or recovery purposes, though it comes with increased risk of exposing the system to other threats temporarily .

Disabling LM hashes on modern Windows operating systems is recommended because they are inherently insecure. LM hashes convert passwords to uppercase, which significantly reduces the complexity of potential password combinations. Additionally, truncating passwords to 14 characters and dividing them into two parts further weakens security. By contrast, NTLM hashes do not have these vulnerabilities. Therefore, disabling LM hashes increases the overall security of the system against password cracking attempts .

You might also like