From: Thor (Hammer of God) (thor@hammerofgod.com)
Date: Tue Oct 31 2006 - 19:27:00 EST
Hey Lee-- thanks... I missed the reference to "admin access" in the OP,
instead, I got caught in the language of "Basically, any sam once in hand,
is cracked these days via rainbowtables."
Yes, I'm totally with you on grabbing the SAM from a running system that you
have admin access to. No argument from me on that one- thanks for taking
the time to point that out.
But I guess I'm still stuck a bit on "any SAM in hand is cracked." I know
you didn't say that, but even the 500gig NTML tables are only all uppercase
or all lowercase with 0-9, and only 1-9 character passwords, and according
to one of your references, took almost 16 years to generate. The upper/lower
with 0-9 are only for 1-7 character passwords.
Maybe I'm just in a different environment, but when I see people report
"routine" cracking SAM's, it really makes we wonder who the client-base is.
I think the last time I was paid for any work with LM cracking was over 10
years ago. I've been turning off LM since Win2k came out, and have been
telling people to use pass-phrases instead of passwords since Win2000
allowed 126 character passcodes. Even something as simple as "my dog has
fleas" couldn't be rainbow cracked with anything I've seen out there. Of
course, when you have a pass phrase like "OK, this is my passphrase--crack
THIS 1 homeboy!" Then the whole thing goes out the window.
That's what I was on about- while I think rainbow tables are neat, I've
really not had much use for them given their size, having to have admin
access to get the SAM anyway (for win machines) and how easy it is to thwart
them. But that's just me ;)
Thx
T
On 10/31/06 1:56 AM, "Lee Lawson" <leejlawson@gmail.com> spoketh to all:
> Not quite sure where you are going here, but...
>
> Since NT4 SP3 (I think) the password hashes in the SAM file have been
> encrypted with DES at 128 bit. The hashes are decrypted on boot up so
> that the system can authenticate users.
>
> If you can obtain the SAM file, in the same directory is the 'system'
> file. This holds the boot key, or to be really specific, the DES
> symmetric encryption/decryption key. This key needs to be extracted
> correctly (Cain & Abel or bkhive).
>
> In the now decrypted SAM file will be the LM hashes and NTLM hashes.
> There are two instances where the LM hashes will all be blank:
> 1) The password is longer than 14 characters.
> 2) The registry change has been made to prevent storing passwords with
> LM and I agree that I cannot see why people would not switch it off,
> but then don't. Oh well.
>
> If you are to use Rainbow Tables, the disk space required for LM is
> over 200 Gb although I have 47 GB and that has not failed to crack a
> password. If you want to start cracking NTLM hashed passwords, you
> are going to need much more disk space, over 500 Gb! This means that
> it is just as easy to do, as long as you have the disk space!
>
> So, NTLM hashes are just as easy to break, they will take longer as
> the tables to look through are bigger.
>
> The Rainbow Tables for each algorithm need to be created yourself or
> purchased/stolen/downloaded/shared. You can buy them from:
> http://www.rainbowtables.net/
> http://www.rainbowcrack-online.com/
>
> There are, at present that I know of, tables for: LM, NTLM, MD4, MD5,
> CiscoPIX, MySQL and SHA1, but any can be made if you have the source
> code for the algorithm.
>
> Don't know if this has cleared anything up, but there you go...
>
>
>
>
> On 10/30/06, Thor (Hammer of God) <thor@hammerofgod.com> wrote:
>> You "routinely" crack passwords on SAM's that are SYSKEY'd by default
>> (128-bit) with rainbow tables? XP/2k3 has syskey on by default... And any
>> password over 14 characters automatically clear the LM hash, even if you
>> have not turned it off (which I can't imagine anyone not doing.)
>>
>> So, I'm guessing that the "rainbow table" hubbub is all 40-bit, or silly LM
>> hash cracking, right? Or am I missing something here?
>>
>> t
>>
>>
>>
>> On 10/26/06 2:07 PM, "ep" <captgoodnight@hotmail.com> spoketh to all:
>>
>>> I crack these routinely when pentesting/playing, granted, it's by pushing
>>> the sam through rainbow tables, thus admin access...
>>> Basically, any sam once in hand, is cracked these days via rainbowtables.
>>> There're ways to prevent this from happening, but most admins don't go that
>>> extra step...
>>>
>>> --cg
>>>
>>> -----Original Message-----
>>> From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com] On
>>> Behalf Of Joey Peloquin
>>> Sent: Wednesday, October 25, 2006 12:38 PM
>>> To: s-williams@nyc.rr.com; Pen-Testing
>>> Subject: Re: Windows XP / 2K3 Default Users
>>>
>>> s-williams@nyc.rr.com wrote:
>>>> Hello list this might be an easy question to answer but have anyone
>>>> been sucessful in using windows built in default accounts when doing a
>>>> password audit. I
>>> know most
>>>> xp machines has (help assitant and support_xxxxxxxx). Is their a
>>>> default
>>> list out
>>>> there some where with various vendor OS passwords, or a way to figure
>>>> out the password for these accounts.
>>>> Sent via BlackBerry from T-Mobile
>>>
>>> You can try to crack them through normal means, but it'd likely be a futile
>>> act since a) they are randomized and *extremely* complex (as far as I
>>> recall) and b) even my ~13 year old knows to restrict these accounts. There
>>> are clueless admins out there though, so, *shrug*.
>>>
>>> -jp
>>>
>>>
>>>
>>> ------------------------------------------------------------------------
>>> This List Sponsored by: Cenzic
>>>
>>> Need to secure your web apps?
>>> Cenzic Hailstorm finds vulnerabilities fast.
>>> Click the link to buy it, try it or download Hailstorm for FREE.
>>> http://www.cenzic.com/products_services/download_hailstorm.php?camp=70160000
>>> 0008bOW
>>> ------------------------------------------------------------------------
>>>
>>>
>>>
>>> ------------------------------------------------------------------------
>>> This List Sponsored by: Cenzic
>>>
>>> Need to secure your web apps?
>>> Cenzic Hailstorm finds vulnerabilities fast.
>>> Click the link to buy it, try it or download Hailstorm for FREE.
>>> http://www.cenzic.com/products_services/download_hailstorm.php?camp=70160000
>>> 00
>>> 08bOW
>>> ------------------------------------------------------------------------
>>>
>>>
>>>
>>
>>
>>
>> ------------------------------------------------------------------------
>> This List Sponsored by: Cenzic
>>
>> Need to secure your web apps?
>> Cenzic Hailstorm finds vulnerabilities fast.
>> Click the link to buy it, try it or download Hailstorm for FREE.
>> http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000
>> 008bOW
>> ------------------------------------------------------------------------
>>
>>
>
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:57:15 EDT