Date: Wed, 25 Jul 2007 09:08:17 -0400 From: "Ben Greenberg" <Ben.Greenberg@...et-int.com> To: <john-users@...ts.openwall.com> Subject: Brute-forcing cached Windows login password hashes Greetings all, My question is regarding the encrypted password hashes that Windows stores in the registry of the last 10 logins to a workstation. I read the original white paper written by Arnaud Pilon and I've used his cachedump tool to extract the password hashes from the registry. What I'm wondering is what type of hash those passwords use. Is it straight MD4? I know that each hash is salted with a machine-specific unique string. What I am unclear on is what exactly the password hash is and how it can be brute-forced. I know that there is a patch for John the Ripper, but every mention I can find refers to a two year old version of John. Does anyone know if the most recent version has this patch in it already? Also, is anyone familiar with any rainbow tables for cracking these passwords? Are rainbow tables possible for these hashes because of the salting? Thanks all.
Powered by blists - more mailing lists
Powered by Openwall GNU/*/Linux - Powered by OpenVZ