Password Exploitation Class: Part 3: Windows LM and NTLM hash cracking 1/5

Clip 1/5
Credits: irongeek.com

This is a class we gave for the Kentuckiana ISSA on the the subject of password exploitation. The Password Exploitation Class was put on as a charity event for the Matthew Shoemaker Memorial Fund ( http://www.shoecon.org/ ). The speakers were Dakykilla, Purehate_ and Irongeek.

Lots of password finding and crack topics were covered. Hashcat, OCLHashcat, Cain, SAMDump2, Nir's Password Recovery
Tools, Password Renew, Backtrack 4 R1, UBCD4Win and much more

Part 3: Windows LM and NTLM hash cracking, Time Memory Tradeoffs, SAM Cracking Prevention, Linux/Unix passwd and shadow files, Parts of a *nix hash, Windows Cached Domain Credentials, Problems with Windows 7, Cracking Creds Countered, Finding where Unknown Apps store passwords, System Process Monitoring, RegFromApp, ProcessActivityView, Procmon (Process Monitor), finding the hash type, Other Weird Vectors, Inverse Bruteforce, Look in the logs for passwords, upcoming events.

For more information click here: http://bit.ly/axTkdj

Category:

Science & Technology

Tags:

• irongeek
• password
• cracking
• exploitation

[incaseofx]

You said you can pull syskey from the system hive... What exactly is the system hive?

[XxXxDreamWeaverxXxX]

hey man heres a long quteion lol

1)i aquired another computers SAM and SYSTEM file using a linux boot cd

2)i then took these files home on an external usb drive.

3)I have a dual boot system with linux ubuntu 10.10 and windows xp sp3

4)i extracted the hashes from these files using a program called "SAMinside" on XP, the hashes appeared to be LM so I exported them in pwdump format

4)can i then boot into linux and use a program called "john the ripper" to crack the hashes in the pwdump file?

THANX