[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20240223230616.GA18555@openwall.com>
Date: Sat, 24 Feb 2024 00:06:16 +0100
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: total noob? - finding clear text password of a local windows 10 user, can read SAM and SYSTEM
On Fri, Feb 23, 2024 at 09:40:27PM +0100, subscriber name wrote:
> trying finding clear text password of a local windows 10 user, can read SAM
> and SYSTEM
>
> the windows system itself doesnt work any more, but i can read the NTFS and
> copied over those two files to a linux system (kali) and tried first
> generating a text file via python script:
>
> > secretsdump.py -sam SAM -system SYSTEM LOCAL
>
> that output a line with lines which i have now in a crackthispw.txt file.
>
> > user name:1001:11122233445566aaabbccdd:zzzyyyyxxxxwwwww:::
>
>
> is this an LM hash / line / entry? as far as I understood, then i wanted to
> use john tool on this via
>
> > john --incremental --format=LM crackthispw.txt
>
> the ~/.john/john.pot file now contains a single line with
>
> > $LM$aaabbccdde12345:
>
> I am at a loss now? is this yet another LM hash or where do I go from here?
I guess that pot file line is actually:
$LM$aad3b435b51404ee:
This means that the LM hash corresponds to an empty string, and got
"cracked" as such. That's because recent Windows systems don't use LM
hashes anymore, instead only using NTLM ones.
You may want to try:
john --format=nt crackthispw.txt
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
