Date: Thu, 15 Nov 2012 12:19:08 +0400 From: Aleksey Cherepanov <aleksey.4erepanov@...il.com> To: john-users@...ts.openwall.com Subject: Re: LM with empty strings = password longer than 15 chars? On Thu, Nov 15, 2012 at 08:14:19AM +0100, john wittgeinstein wrote: > Ive got this pwdump output: > > Administrator:500:aad3b435b51404eeaad3b435b51404ee:4dc0249ad90ab626362050195893c788::: > Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: > user:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: > > We can clearly see "aad3b435b51404ee" string which invokes empty key. But again all the LM hashes are the same for each user. The LM are the same for admin, Guest, user, but the NT are different. Is this common to happen if Admin is more than 15 characters long? Yes and no, Windows XP is the last version of windows that still uses LM hashes: so there if password is longer than 15 characters or LM are disabled through policy or registry or something like this (I do not know details) then only NT hash is used. So empty LM hashes means that only NT hashes are used. They still could be shorter than 15 characters - you need to know more about system to make such conclusion. -- Regards, Aleksey Cherepanov
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.