Cracking Passwords Version 1.1
by: J. Dravet
February 15, 2010 Abstract
This document is for people who want to learn to the how and why of password cracking. There is a lot of information being presented and you should READ IT ALL BEFORE you attempted doing anything documented here. I do my best to provide step by step instructions along with the reasons for doing it this way. Other times I will point to a particular website where you find the information. In those cases someone else has done what I attempting and did a good or great job and I did not want to steal their hard work. These instructions have several excerpts from a combination of posts from pureh@te, granger53, irongeek, PrairieFire, RaginRob, stasik, and Solar Designer. I would also like to thank each of them and others for the help they have provided me on the BackTrack forum. I will cover both getting the SAM from inside windows and from the BackTrack CD, DVD, or USB flash drive. The SAM is the Security Accounts Manager database where local usernames and passwords are stored. For legal purposes I am using my own system for this article. The first step is to get a copy of pwdump. You can choose one from http://en.wikipedia.org/wiki/Pwdump. Update: I used to use pwdump7 to dump my passwords, however I have come across a new utility called fgdump from http://www.foofus.net/fizzgig/fgdump/ This new utility will dump passwords from clients and Active Directory (Windows 2000 and 2003 for sure, not sure about Windows 2008) where pwdump7 only dumps client passwords. I have included a sample hash.txt that has simple passwords and should be cracked very easily. NOTE: Some anti-virus software packages flag pwdump* and fgdump as trojan horse programs or some other unwanted program. If necessary, you can add an exclusion for fgdump and/or pwdump to your anti-virus package so it won't flag them. However it is better for the community if you contact your anti-virus vendor and ask them to not flag the tool as a virus/malware/trojan horse. You can find the latest version of this document at http://www.backtrack-linux.org/
1 LM vs. NTLM 2 Syskey 3 Cracking Windows Passwords 3.1 Extracting the hashes from the Windows SAM 3.1.1 Using BackTrack Tools 126.96.36.199 Using bkhive and samdump v1.1.1 (BT2 and BT3) 188.8.131.52 Using samdump2 v2.0.1 (BT4) 184.108.40.206 Cached Credentials 3.1.2 Using Windows Tools 220.127.116.11 Using fgdump 18.104.22.168 Using gsecdump 1 of 45
2/15/2010 3:48 PM
Cracking Passwords Version 1.1
22.214.171.124 Using pwdump7 126.96.36.199 Cached Credentials 3.2 Extracting the hashes from the Windows SAM remotely 3.2.1 Using BackTrack Tools 188.8.131.52 ettercap 3.2.2 Using Windows Tools 184.108.40.206 Using fgdump 3.3 Cracking Windows Passwords 3.3.1 Using BackTrack Tools 220.127.116.11 John the Ripper BT3 and BT4 18.104.22.168.1 Cracking the LM hash 22.214.171.124.2 Cracking the NTLM hash 126.96.36.199.3 Cracking the NTLM using the cracked LM hash 188.8.131.52.4 Cracking cached credentials 184.108.40.206 John the Ripper - current 220.127.116.11.1 Get and Compile 18.104.22.168.2 Cracking the LM hash 22.214.171.124.3 Cracking the LM hash using known letter(s) in known location(s) (knownforce) 126.96.36.199.4 Cracking the NTLM hash 188.8.131.52.5 Cracking the NTLM hash using the cracked LM hash (dumbforce) 184.108.40.206.6 Cracking cached credentials 220.127.116.11 Using MDCrack 18.104.22.168.1 Cracking the LM hash 22.214.171.124.2 Cracking the NTLM hash 126.96.36.199.3 Cracking the NTLM hash using the cracked LM hash 188.8.131.52 Using Ophcrack 184.108.40.206.1 Cracking the LM hash 220.127.116.11.2 Cracking the NTLM hash 18.104.22.168.3 Cracking the NTLM hash using the cracked LM hash 3.3.2 Using Windows Tools 22.214.171.124 John the Ripper 126.96.36.199.1 Cracking the LM hash 188.8.131.52.2 Cracking the NTLM hash 184.108.40.206.3 Cracking the NTLM hash using the cracked LM hash 220.127.116.11.4 Cracking cached credentials 18.104.22.168 Using MDCrack 22.214.171.124.1 Cracking the LM hash 126.96.36.199.2 Cracking the NTLM hash 188.8.131.52.3 Cracking the NTLM hash using...