Date: Tue, 19 Feb 2008 10:49:30 -0600 From: jmk <jmk@...fus.net> To: john-users@...ts.openwall.com Subject: Re: OT No output from fgdump On Mon, 2008-02-18 at 20:08 +1300, Russell Fulton wrote: > An admin of one of our domains recently tried dumping hashes from a > domain controller. He logged in as admin and ran fgdump which sat > around for a while and then exited without apparently producing any > output. The AD is set so it does not store LM hashes but does have > standard NTLM (v1 ?) hashes. Were any errors reported by FgDump (use -v -v for greater verbosity)? What AV product is running on the host? FgDump attempts to halt any running AV product prior to extracting the password hashes, but not all products or configurations are currently supported. > Admins of other domains have succeeded in getting hashes from their > ADs but all of them had LM hashes (but not for much longer ;). > Documentation on pwdump6 says that it can dump both LM and NTLM hashes. FWIW, setting the "Do Not Store LM Hashes" policies does not retroactively remove the values. A password change, or multiple changes if password history is being used, is needed to flush out the hashes. Tools such as ThrashLM may also work to remove the LM values. Joe -- jmk <jmk@...fus.net> Foofus Networks -- To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.