hashcat Forum

Hello!

I am trying to recover some passwords from a Windows SBS 2003, Active Directory database, and I am unable to successfully get the clear text passwords from the LM Hashes, I have written this as a guide so that you know what I have done and we can fix it together.

I have Cygwin installed and in my PATH, also downloaded QuarksPWDump and of course oclhashcat.

I was using AMD CCC 14.2 but I downgraded to 13.2 so I could use oclhashcat. (Just used the normal CCC uninstaller, reboot, installed 13.2, reboot, all working fine)

Other bits are that I am using Windows 8.1 x64, have a AMD FX-9590 and 16gb of 2133mhz 10t memory and a AMD R9 290x. Drives layout is a 2x64GB SSD System RAID-0 and a 4x2TB WD Black Data RAID-10.

Benchmarks: (No idea why its showing as 2048MB, perhaps something to do with OverDrive?)


Run command prompt as Administrator (might not be required for all), and run the following to use the commands, or just replacing %WORKDIR% with your working directory:


I started by copying the Active Directory Database to my Working Directory:


To successfully use quarkspwdump I had to fix the database (I learned after my first attempt, solution here):


I then needed to run QuarksPWDump against my working, and fixed, ntds.dit file and write it to a text file (--history is optional):


The output is not directly usable by oclHashcat 1.02, so I had to extract the LM hashes and split them up into blocks of 16 (thanks):


It is simply laid out User:UID:LM:NTLMv1::: to extract the NTLMv1 here is the sed:


I then ran oclhashcat in brute force mode against the LM hashes, Upper-case, Digits and Symbols only:


However the results are as follows:



I did go out for a beer with my college while this was running, the final 100MH/s is probably just the spinning down, but if its not then it was perhaps because I locked my PC and the screens turned off?

I forgot to use increment so I did the following as of writing this (if you are doing this from scratch, do all 7 with increment):


And the results:


So, why are none of my hashes being matched up with anything?

Could the extracted hashes be invalid for some reason?

I did try NTLM (-m 1000) with the ntds_ntlm1.txt file, and the following rules (ntlm.hcmask) but got nothing, but I tributed that to the passwords perhaps being more complicated, which is why I kept to LM:


Any help would be much appreciated!

Many Thanks,
MadCatter

Thanks for the details. As not a single hash was cracked there must be something wrong. Can you crack the LM and NTLM example hash from here: https://hashcat.net/wiki/doku.php?id=example_hashes ?

hash corruption seems far more likely.

Thanks for the reply =]

(04-25-2014, 10:59 AM)atom Wrote: [ -> ]Thanks for the details. As not a single hash was cracked there must be something wrong. Can you crack the LM and NTLM example hash from here: https://hashcat.net/wiki/doku.php?id=example_hashes ?

I added the LM hash for HASHCAT at the top of the ntds_lm.hash file and ran:


The result I got after ~5 minutes:


So, is there something wrong with my data-set? I'll try another password dump utility and try grabbing some hashes from my machine. (I just assumed the output from quarkspwdump was fine, has all the expected data)

... I don't suppose the hashes being in upper/lower case matters?

(04-25-2014, 11:23 AM)epixoip Wrote: [ -> ]hash corruption seems far more likely.

Just saw your post after posting my response to atom, I guess I am doing something wrong extracting the hashes from the ntds.dit file.

I'm looking at ntdsxtract, just downloaded it, I'll give it a go and respond back.

So I did the following to get the hashes using NTDSXtract, I ended up just using a debian virtual machine as I could not get libesedb to compile with cygwin or visual studio 2013.

I used the guide here.

However the download for libesedb is on google, be sure to use the 20120102 one. Also had to "apt-get install python python-crypto" so I could run it.

Followed the rest of that blog post, except the table commands where +1 each, datatable.4 and link_table.6:


A few commands coming up, transferred the hashes.txt to my host, I just used Excel to do the matching:

This will give you all the LM hashes split up:

The same for NTLM but we include (instead of -v) the $NT$, and tweak the sed:

And the LM hahes are now working ... I will work on the step-by-step guide to this and also the using the LM Clear text passwords to match against the NTLM passwords, I did consider the Table-Lookup Attack, but Toggle-Case seems to do what we want for that.

Anyways, thanks so far =]

glad you were able to work through it