[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <1203439770.8738.37.camel@localhost>
Date: Tue, 19 Feb 2008 10:49:30 -0600
From: jmk <jmk@...fus.net>
To: john-users@...ts.openwall.com
Subject: Re: OT No output from fgdump
On Mon, 2008-02-18 at 20:08 +1300, Russell Fulton wrote:
> An admin of one of our domains recently tried dumping hashes from a
> domain controller. He logged in as admin and ran fgdump which sat
> around for a while and then exited without apparently producing any
> output. The AD is set so it does not store LM hashes but does have
> standard NTLM (v1 ?) hashes.
Were any errors reported by FgDump (use -v -v for greater verbosity)?
What AV product is running on the host? FgDump attempts to halt any
running AV product prior to extracting the password hashes, but not all
products or configurations are currently supported.
> Admins of other domains have succeeded in getting hashes from their
> ADs but all of them had LM hashes (but not for much longer ;).
> Documentation on pwdump6 says that it can dump both LM and NTLM hashes.
FWIW, setting the "Do Not Store LM Hashes" policies does not
retroactively remove the values. A password change, or multiple changes
if password history is being used, is needed to flush out the hashes.
Tools such as ThrashLM may also work to remove the LM values.
Joe
--
jmk <jmk@...fus.net>
Foofus Networks
--
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
