john-users - Re: OT No output from fgdump

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / community lists wiki CVSweb mirrors signatures
bringing security into open environments

Order Openwall GNU/*/Linux 2.0 on a CD with delivery worldwide

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Tue, 19 Feb 2008 10:49:30 -0600
From: jmk <jmk@...fus.net>
To: john-users@...ts.openwall.com
Subject: Re: OT No output from fgdump

On Mon, 2008-02-18 at 20:08 +1300, Russell Fulton wrote:
> An admin of one of our domains recently tried dumping hashes from a  
> domain controller.  He logged in as admin and ran fgdump which sat  
> around for a while and then exited without apparently producing any  
> output.  The AD is set so it does not store LM hashes but does have  
> standard NTLM (v1 ?) hashes.

Were any errors reported by FgDump (use -v -v for greater verbosity)?
What AV product is running on the host? FgDump attempts to halt any
running AV product prior to extracting the password hashes, but not all
products or configurations are currently supported.

> Admins of other domains have succeeded in getting hashes from their  
> ADs but all of them had LM hashes (but not for much longer ;).   
> Documentation on pwdump6 says that it can dump both LM and NTLM hashes.

FWIW, setting the "Do Not Store LM Hashes" policies does not
retroactively remove the values. A password change, or multiple changes
if password history is being used, is needed to flush out the hashes.
Tools such as ThrashLM may also work to remove the LM values.

Joe

-- 
jmk <jmk@...fus.net>
Foofus Networks

-- 
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.