Penetration Testing mailing list archives
SV: Brute-forcing cached Windows login password hashes
From: "Per Thorsheim" <putilutt () online no>
Date: Thu, 26 Jul 2007 07:50:18 +0200
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Download Cain & Abel from www.oxid.it, that should enable you to crack the password hashes in question. Rainbow tables are available at www.freerainbowtables.com, where you can also participate in generating tables by running their distributed table generator. Regards, Per Thorsheim - -----Opprinnelig melding----- Fra: listbounce () securityfocus com [mailto:listbounce () securityfocus com] På vegne av Ben Greenberg Sendt: 25. juli 2007 15:19 Til: pen-test () securityfocus com Emne: Brute-forcing cached Windows login password hashes Greetings all, My question is regarding the encrypted password hashes that Windows stores in the registry of the last 10 logins to a workstation. I read the original white paper written by Arnaud Pilon and I've used his cachedump tool to extract the password hashes from the registry. What I'm wondering is what type of hash those passwords use. Is it straight MD4? I know that each hash is salted with a machine-specific unique string. What I am unclear on is what exactly the password hash is and how it can be brute-forced. I know that there is a patch for John the Ripper, but every mention I can find refers to a two year old version of John. Does anyone know if the most recent version has this patch in it already? Also, is anyone familiar with any rainbow tables for cracking these passwords? Are rainbow tables possible for these hashes because of the salting? Thanks all. -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBRqg2GrF5fmPQ0K72EQK+lwCdFhhO1vnEPsRlVypc8dfh0jGRYq0AoJtD LwrQU1xtVCirq6krNfp2Mr+5 =9sEy -----END PGP SIGNATURE----- ------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------
Current thread:
- Brute-forcing cached Windows login password hashes Ben Greenberg (Jul 25)
- Re: Brute-forcing cached Windows login password hashes Jerome Athias (Jul 26)
- RE: Brute-forcing cached Windows login password hashes Ben Greenberg (Jul 26)
- SV: Brute-forcing cached Windows login password hashes Per Thorsheim (Jul 26)
- Re: Brute-forcing cached Windows login password hashes Mathieu CHATEAU (Jul 26)
- Re: Brute-forcing cached Windows login password hashes Carl Livitt (Jul 26)
- Re: Brute-forcing cached Windows login password hashes Mathieu CHATEAU (Jul 27)
- Re: Brute-forcing cached Windows login password hashes Carl Livitt (Jul 27)
- SV: Brute-forcing cached Windows login password hashes Per Thorsheim (Jul 27)
- Re: Brute-forcing cached Windows login password hashes Mathieu CHATEAU (Jul 27)
- <Possible follow-ups>
- Re: Brute-forcing cached Windows login password hashes wymerzp (Jul 26)
- Re: Brute-forcing cached Windows login password hashes Jerome Athias (Jul 26)