By default Windows 2000, XP and 2003 systems in a domain or Active Directory tree cache the passwords and credentials of previously logged in users. This is done so that the users can still login again if the Domain Controller or ADS tree can not be reached either because of Controller failure or network problems. These cached passwords are stored as hashes in the local systems registry at the values HKEY_LOCAL_MACHINE\SECURITY\CACHE\NL$1 through NL$10. Unless the ACL is changed these values require SYSTEM level privileges to access (you can set it so an admin account can read them but you would still want to use a tool to parse out the data). Arnaud Pilon has created a tool called CacheDump for extracting these password hashes out of the registry. He and his team have also come up with patches for the password cracking tool "John the Ripper" that allow you to use John to crack these stored credential hashes. More on the technical details can be found at :8040/misc/cachedump.html for those who are so inclined. Fortunately from a security standpoint the way Microsoft hashes cached passwords is much more secure than the way they store local passwords in the SAM file. Since each cached hash has its own salt (a set of more or less random bits figured into the hash algorithm to help foil pre-computed attacks) cached passwords hashes take much longer to crack than LM (LAN Manager) hashes which don't salt the same way, are case insensitive and are split into seven character chunks. This tutorial will cover the basics of collecting the cached password hashes and setting up a Debian based Linux system with a patched version of "John the Ripper" to audit these hashes for weak passwords. With a little modification to these basic instructions you should be able to get the patched version of John to work on just about any *nix system or under the Cygwin environment for Windows. First download and extract cachedump.exe from :8040/misc/cachedump-1.0.zip to the Windows box you want to get the cached password hashes from. Once you have extracted the executable make sure you are logged in as an admin user, then drop out to a command prompt and use the following command to pipe the hashes into a file:
betwin xp crack v.2.00.672 | added by users
This is a follow-up to Irongeek's tutorial on Cracking Cached Domain/Active Directory Passwords on Windows XP/2000/2003. In version 2.68, Cain added support for MS-Cache hashes but unfortunately it only supports cracking hashes retrieved from the local machine. This is really a big limitation because, as I've found, usually you want to go get a lot of hashes from different machines and compile them into a big list and crack them all at once. If this is not the case, it is usually not convenient to crack the hashes on the machine that they were retrieved from because it may be a machine at your office or school. You may have sufficient privaleges to install and use Cain but in most cases it's probably not the best idea. Cain is much easier to use than John the Ripper for cracking just about anything. In this case, both Cain and John the Ripper support cracking MS-Cache hashes but John has the distinct advantage of being able to crack hashes from a list rather than restricting only to hashes retrieved from the local machine. In fact, as John is only meant to crack hashes, it cannot even retrieve any hashes at all but that's beside the point. Cain also has a nice, pretty GUI and runs on Windows, therefore making it much easier for most people to use compared to John (command line only, can't run on Windows without the help of Cygwin). As I said before, Cain only supports cracking hashes retrieved from the local machine but most of the time this isn't convenient or safe. However, there is a way to get Cain to crack MS-Cache hashes from any machine that you'd like. CacheDump is a tool mentioned in Irongeek's tutorial that can retrieve cached hashes from a machine. It requires administrative privaleges to retrieve the hashes so you'll have to be logged in under an adminstrative account for it to work. Irongeek spells it out in his tutorial so I won't go through how to use it here. Once you have used it and have your text file with the hashes, take that to the computer you'd like to crack the hashes on using Cain. There are two things holding Cain back from cracking hashes obtained from external machines. The first is that Cain does not support importing a hash list to be cracked. To get around this you need to first be sure that Cain is closed. If Cain isn't closed, you won't be able to save any changes to the file you will need to change (see the next paragraph). Next, go into the Cain directory, which by default is C:\Program Files\Cain In this directory, you should find a file called CACHE.LST among many others. All the LST files you see are temporary files that Cain uses to store cracked and uncracked hashes between sessions. That way Cain doesn't have to start cracking everything all over when you start up the program again and you don't have to import the hashes again as well. CACHE.LST is, you guessed it, where Cain stores the MS-Cache hashes. Go ahead and open this file up in Notepad or your favorite text editor. If there is anything in the file to begin with you can do what you would like with it. Leaving it or deleting it won't affect anything at all. The second problem Cain has is that it does not understand the format that CacheDump uses. Fortunately, the formats that Cain and CacheDump use are very similar and don't require much effort to convert. Here is the format that Cain uses: domain;username;password;hash; Here is the format that cachedump uses: username:hash:domain There may be some extra information at the end of a cachedump entry but as far as I can tell that doesn't affect anything in terms of the hash or the final password. At first I thought it may be used somehow in the salt but I've found in my testing so far that this is not true. Going back to Cain's format, you can see that it's pretty simple. At first, obviously, "password" will be completely blank. An actual line from CACHE.LST would look something like this: acme;roadrunner;;6C7773E383661CC9FD9980FB7AFA8A5D; The same hash dumped by cachedump would look like this: roadrunner:6C7773E383661CC9FD9980FB7AFA8A5D:acme As you can see, the formats are very similar and easy to convert between. The only problem is that this becomes a little intensive if you have a lot of hashes. You wouldn't want to convert a lot of hashes by hand obviously, so I hacked together a quick PHP script that converts between the two formats. The script really only does a little bit of string parsing and reconstructing and is rather simple overall. It would also be really easy to get the same result from just about any other programming language if you wanted to create one yourself. There are 2 PHP pages involved though they could easily be combined into one. I named them cache.php and cache2.php creatively enough. Here is the source for cache.php where the user can upload a file with cachedump hashes:
This solution has been long requested because it allows Advanced Models under combined loading conditions to retain the bearing portion of the loading after transition to single or double through cracks. Since this capability will be added, we are also including an out-of-plane bending option that can be used for Advanced through crack models.
In all previous AFGROW releases, out-of-plane bending solution for Classic through crack models have been approximated as 2/3 of the applied tension classic solution. This was done to allow bending effects to be conservatively approximated after transition where the crack was assumed to be straight through crack (single crack length through-the-thickness). Many Users attending our Workshops felt that this approximation was far too conservative, and a factor of 0.4 was more realistic. After comparing analytical results to our oblique crack solution, it looked like the factor varied between 0.4 and 0.5 as a function of thickness. Since the factor, 2/3, has been used to date, we think it makes sense to add a new user-defined preference with a default value of 2/3, but allow users to make a choice from 0.4 to 2/3. As noted above, this will also be applied for Advanced Models where a bending fraction is used for crack(s) at holes. However, it should also be noted that the correction in these cases will be applied to the corresponding Advanced Model Axial solution.
This allows users to input different tabular crack growth rate data for the a-direction and c-direction. Normally, crack growth data for the L-T orientation is used for both crack directions. However, as we try to expand our capabilities to predict actual crack shapes seen in the field (or in laboratory tests), it is helpful to have the option to use different data when they may be available.
So rather than "inventing" a new feature, better had been that DL explains WHY they crack, and A REAL FEATURE would have been to offer a good (read: working) "aging" algorythm for words to be rehearsed. THAT is what users were looking for, and isn't there AT ALL. (the current "aging" indicator on "word list" ISN'T working)
There are two big reasons that Windows passwords are easier to crack. When passwords are stored in the computer they are hashed. Hashing a password adds some obscurity to the password. Windows uses MD4 to hash its passwords (without a salt) where as Linux uses 5000 rounds SHA-512 with a salt (last I checked). Essentially Linux uses a hash that has more possible outputs and added obscurity. If you don't know what hashing and salting is I'd suggest you look here.
In an attempt to improve the security of the SAM database against offline software cracking, Microsoft introduced the SYSKEY function in Windows NT 4.0. When SYSKEY is enabled, the on-disk copy of the SAM file is partially encrypted, so that the password hash values for all local accounts stored in the SAM are encrypted with a key (usually also referred to as the "SYSKEY"). It can be enabled by running the syskey program.[2] As of Windows 10 version 1709, syskey was removed due to a combination of insecure security[3] and misuse by bad actors to lock users out of systems. 2ff7e9595c
Comments