Cracking Passwords Version 1.1
by: J. Dravet
February 15, 2010 Abstract
This document is for people who want to learn to the how and why of password cracking. There is a lot of information being presented and you should READ IT ALL BEFORE you attempted doing anything documented here. I do my best to provide step by step instructions along with the reasons for doing it this way. Other times I will point to a particular website where you find the information. In those cases someone else has done what I attempting and did a good or great job and I did not want to steal their hard work. These instructions have several excerpts from a combination of posts from pureh@te, granger53, irongeek, PrairieFire, RaginRob, stasik, and Solar Designer. I would also like to thank each of them and others for the help they have provided me on the BackTrack forum. I will cover both getting the SAM from inside windows and from the BackTrack CD, DVD, or USB flash drive. The SAM is the Security Accounts Manager database where local usernames and passwords are stored. For legal purposes I am using my own system for this article. The first step is to get a copy of pwdump. You can choose one from http://en.wikipedia.org/wiki/Pwdump. Update: I used to use pwdump7 to dump my passwords, however I have come across a new utility called fgdump from http://www.foofus.net/fizzgig/fgdump/ This new utility will dump passwords from clients and Active Directory (Windows 2000 and 2003 for sure, not sure about Windows 2008) where pwdump7 only dumps client passwords. I have included a sample hash.txt that has simple passwords and should be cracked very easily. NOTE: Some anti-virus software packages flag pwdump* and fgdump as trojan horse programs or some other unwanted program. If necessary, you can add an exclusion for fgdump and/or pwdump to your anti-virus package so it won't flag them. However it is better for the community if you contact your anti-virus vendor and ask them to not flag the tool as a virus/malware/trojan horse. You can find the latest version of this document at http://www.backtrack-linux.org/
1 LM vs. NTLM 2 Syskey 3 Cracking Windows Passwords 3.1 Extracting the hashes from the Windows SAM 3.1.1 Using BackTrack Tools 188.8.131.52 Using bkhive and samdump v1.1.1 (BT2 and BT3) 184.108.40.206 Using samdump2 v2.0.1 (BT4) 220.127.116.11 Cached Credentials 3.1.2 Using Windows Tools 18.104.22.168 Using fgdump 22.214.171.124 Using gsecdump 1 of 45
2/15/2010 3:48 PM
Cracking Passwords Version 1.1
126.96.36.199 Using pwdump7 188.8.131.52 Cached Credentials 3.2 Extracting the hashes from the Windows SAM remotely 3.2.1 Using BackTrack Tools 184.108.40.206 ettercap 3.2.2 Using Windows Tools 220.127.116.11 Using fgdump 3.3 Cracking Windows Passwords 3.3.1 Using BackTrack Tools 18.104.22.168 John the Ripper BT3 and BT4 22.214.171.124.1 Cracking the LM hash 126.96.36.199.2 Cracking the NTLM hash 188.8.131.52.3 Cracking the NTLM using the cracked LM hash 184.108.40.206.4 Cracking cached credentials 220.127.116.11 John the Ripper - current 18.104.22.168.1 Get and Compile 22.214.171.124.2 Cracking the LM hash 126.96.36.199.3 Cracking the LM hash using known letter(s) in known location(s) (knownforce) 188.8.131.52.4 Cracking the NTLM hash 184.108.40.206.5 Cracking the NTLM hash using the cracked LM hash (dumbforce) 220.127.116.11.6 Cracking cached credentials 18.104.22.168 Using MDCrack 22.214.171.124.1 Cracking the LM hash 126.96.36.199.2 Cracking the NTLM hash 188.8.131.52.3 Cracking the NTLM hash using the cracked LM hash 184.108.40.206 Using Ophcrack 220.127.116.11.1 Cracking the LM hash 18.104.22.168.2 Cracking the NTLM hash 22.214.171.124.3 Cracking the NTLM hash using the cracked LM hash 3.3.2 Using Windows Tools 126.96.36.199 John the Ripper 188.8.131.52.1 Cracking the LM hash 184.108.40.206.2 Cracking the NTLM hash 220.127.116.11.3 Cracking the NTLM hash using the cracked LM hash 18.104.22.168.4 Cracking cached credentials 22.214.171.124 Using MDCrack 126.96.36.199.1 Cracking the LM hash 188.8.131.52.2 Cracking the NTLM hash 184.108.40.206.3 Cracking the NTLM hash using...