Many cracking tools, such as RainbowCrack, Hashcat, L0phtCrack and Cain, now incorporate similar attacks and make cracking of LM hashes fast and trivial. Workarounds edit To address the security weaknesses inherent in LM encryption and authentication schemes, Microsoft introduced the NTLMv1 protocol in 1993 with Windows NT 3.1. May 03, 2020 Windows NT/XP/2000/2003/LM hash. Also, Password stored in MySQL, LDAP, and others. John The Ripper is a combination of the number of password crackers in one package makes it one of the best password testing and breaking program which autodetects password hashes and customizable password cracker.
Background – The SAM
The Windows registry contains a lot of valuable information for cyber investigators and security analysts alike. The registry lives mainly in C:System32config for the local machine, with user specific registry items contained in each user’s profile in a hidden file named NTUSER.DAT. The SAM file is part of the local machine hive and it is where you’ll be able to find information regarding user accounts. This is also where account credentials are stored.
What is an NTLM hash?
New Technology LAN Manager, or NTLM is a protocol suite in Windows that maintains authentication. The NTLM hash is unsalted, meaning that it is not modified with a known value. This enables the NTLM hash to be used in a practice called “Pass the Hash” where the hash value is used for authentication directly. The NTLM hash appears in the following format:
The information can be broken down into three sections. The first shows a username followed by a colon and double quotes. The colon and quotes can be safely ignored as they are not needed to crack the password. A user’s relative identifier would appear in this spot (500 for Administrator, 501 for Guest, 1000 for first user created account). The next string of characters is the LM hash and is only include for backwards compatibility. The last section is the most important for cracking, this is the NT hash. The NT hash is commonly referred to as the NTLM hash, which can be confusing at the start.
How do you get the NTLM hash?
The answer to this depends on the target system state. Mimikatz is likely the most popular tool for the job. If it is powered down, then the targets hard drive can be removed and mounted (ideally with a write blocker) and the registry files can be accessed. In this scenario, Mimikatz will be used against the SAM file and the SYSTEM file. An example of the command can be seen below.
Defeating the Hash
Once the NTLM hash has been obtained, there are several methods of determining the plain text password. Bear in mind that cryptographic hashes are one-way-functions that cannot be decoded. In order to determine the actual password, we must compare the hashes of known strings to determine if it is a match to the sample.
Cracking
Depending on the hardware of a computer, this method could take anywhere from hours to weeks. I will cover the process I took to begin cracking the hashes. There are various tools available, but I will be focusing a tool named Hashcat due to familiarity. Hashcat, is an opensource password hashing suite that can leverage the power of graphics cards to aid in the calculations. Hashcat itself supports cracking via a dictionary, bruteforce, or a combination there-of. A straight dictionary attack would be the fastest method, but it would require that the password be in the dictionary verbatim. A collection of wordlists can be found on GitHub with the correct search term. A bruteforce method would be slow, but as long as the mask matches it is a more inclusive search method.
In the above screenshot, I chose to use a GUI frontend on Hashcat for demonstration purposes. I’ll be starting a bruteforce attack assuming the password is between 1 and 9 characters in length and has uppercase, lowercase, and/or numbers in it. This can be seen by the character set #1 with ?l?d?u. The question mark here is used as a wildcard.
Hashcat will then try all the possible solutions to match the sample hash. In my case it is working at 7466MH/s (or 7,466,000,000 hashes a second). Even with the speed, this will take time.
There must be a better way
I am a firm believer that success in this field has a big part to do with being able to recognize when someone has already done the hard work for you. Most of the time you can find the answers you are looking for by asking the right question to the all-knowing Google. A quick search for NTLM hash cracker will return with a website called hashkiller.co.uk, which just happens to be who created the GUI for Hashcat.
Here, we can take the NT hash from the provided list and see if they have been seen before. I’ll be using the following as an example. The NT hash is highlighted.
Perfect, the password to the user account “cmonster” is “cookie”. This method works for most of the hashes found on the list. There are a few that are not found. I have listed them below.
You may have noticed that the hash for “Guest” and “victim” are identical, they must have the same password. We find one, we find both. My thought process for this part of the challenge was to return to Google and ask a different question. Knowing that a hash is a unique string, I figured it might be worth while to paste the hash directly into the search box and see what it returns. Perhaps it’s referenced elsewhere.
I stumbled upon the answer in the very first result. It became very obvious to me.
The account I was attempting to find the password for was Guest. The Guest account (sid 501) in Windows does not have a password by default, so it would make sense that it is blank. This must also be true for the victim account.
Unfortunately, I was unable to find any matches to two of the hashes using the easy method. My computer will be set to manual crack these two hashes over the next 8 weeks.
Below are the hashes that were able to be defeated using simple research and online tools.
What You Need for This Project
- A Kali Linux machine, real or virtual
- A Windows Server 2016 machine, real or virtual (or any other Windows version)
Creating a Windows Test User
On your Windows machine, click Start.Type in CMD and press Shift+Ctrl+Enter.
If a 'User Account Control' box pops up,click Yes.
In the Administrator command prompt window,execute this command, which creates a user named'jose' with a password of 'P@ssw0rd'.
net user jose P@ssw0rd /add :max_bytes(150000):strip_icc()/offline-nt-password-registry-editor-5980bb8fc412440010626e47.png "Crack Lm Hash Nt Hash Decrypt")
Downloading and Installing 7-Zip
In a browser, go toDownload the correct version for your operating system,which is probably the 64-bit version,as shown below.
Install itwith the default options.
Downloading and Installing Cain
In a browser, go toRight-click the downloaded file, point to7-Zip, and click'Extract Here',as shown below.
Enter a password of samas shown below. Click OK.
Double-click the ca_setup file.Install the software with the default options,as shown below.
When you see the message below, asking whether toinstall WinPcap, click the'Don't install' button.
TroubleshootingIf you get a warning box saying'Found some malware', as shown below,you need to tell Windows Defender not toremove Cain.At the lower left of the desktop, clickthe magnifying-glass 'Search' icon and typeDEFENDER. Open Windows Defender. In Windows Defender, click Settings andturn off 'Real-time protection'as shown below. Close Windows Defender and run the ca_setup fileagain. If this is your personal machine, remember to turn'Real-time protection' back on when you completethe project. |
Installing WinPcap
In a browser, go toClick 'Installer for Windows',as shown below. Download and install thesoftware with the default options.
Extracting Password Hashes with Cain
On your Windows desktop, right-click the Cainicon and click 'Run as Administrator'.If a 'User Account Control' box pops up,click Yes.
In Cain, on the upper set of tabs, clickCracker.
In Cain, move the mouse to the center of thewindow, over the empty white space.
Right-click and click 'Add to list...',as shown below.
In the 'Add NT Hashes from' box, accept thedefault selectionof 'Import Hashes from local system',as shown below,and click Next.
The password hashes appear,as shown below.
Understanding Password Hashes
There are two password hashes: LM Hashes and NT hashes.LM hashes date from the 1980's, andare so weak Microsoftno longer uses them. The LM hash values Cainshows are just dummy filler values that no longerinclude any information about real passwords.
NT hashes are Microsoft's 'more secure' hash,used by Windows NT in 1993 and never updated inany way. As you will see, these hashes are alsovery weak and easily cracked, compared with Linuxpassword hashes.
Cracking four Linux hashes took about 20 secondsusing a dictionary of 500 words when I did it,but as you will see, you can crack four Windowspasswords using a dictionary of 500,000 wordsin about a second. Windows password hashesare more than 10,000 times weaker thanLinux hashes.
Notice that your NT passwordhash for 'Jose'starts with E19CC, just like mine, shown in theimage above. This isbecause Microsoft doesn't add a random 'salt'to passwords before hashing them--every useron every Windows machine on Earth has the same saltif they are using a password of P@ssw0rd.
That means you can often crack Windows passwordhashes by just Googling them,as shown below, because manylists of common passwords and hashes havebeen uploaded to the Internet over the last20 years.
However, in this project, we'll use hashcat, which is avery powerfulway to crack passwords.
Exporting the Hash to a Text File
In Cain, right-click jose and clickExport. Save the filewith the namewin1 in the default format (L0phtCrack 2.x file).Open the win1.lc file in Notepad.
Carefully highlight the NT hash for Jose,as shown below, right-click it, and clickCopy.
12.1: Recording Your Success (5 pts.)
Use the formbelow to record your score in Canvas.If you don't have a Canvas account, seethe instructionshere.
Pasting the Password Hash into Kali Linux
In your Kali Linux machine,in a Terminal window, execute these commands: In the nano window, from the menu bar at the top,click Edit, Paste.The hash appears,as shown below:
Press Ctrl+X, Y, Enter tosave the file.
Getting a Wordlist
Kali Linux contains a list of approximately 500,000 commonlyused passwords from the RockYou breach.In a Terminal window, execute these commands to extract them:
You should see the first ten passwords,as shown below.Getting Hashcat 2.00
Hashcat updated to 3.00 and it won't run in a virtualmachine anymore. The simplest solution is to use theold version.In a Terminal window, execute these commands:
You should see four password hashes,as shown below:Cracking the Hashes
In a Terminal window, execute this command.You mayneed to use hashcat-cli32.bin on your system../hash/hashcat-cli64.bin -m 1000 -a 0 -o winpass2.txt --remove win2.hash /usr/share/wordlists/rockyou.txtcat winpass2.txtEnter the password for the hash beginning with '32ff' into the form below.
12.2: Recording Your Success (10 pts.)
Use the formbelow to record your score in Canvas.Crack Lm Hash Nt Hash Decrypt Code
If you don't have a Canvas account, seethe instructions here.
Comments are closed.