Efficient Password Cracking Where LM Hashes Exist for Some Users

Sometimes you end up with a great many Windows domain passwords that need cracking – either because you have compromised the domain controller and exported them yourself, or because the client has asked you to perform a password audit and has supplied the database to you themselves.

As you know, LM hashes are insecure, and there is a very good way of cracking these (Ophcrack). However, there will also be passwords that cannot be cracked using the standard tables, or maybe the LM hash is not present in the dump at all. In this case, we’ll need to attack the NTLM hash with another tool – in this case a GPU cracker known as Oclhashcat.

In this case we have a large (something like 6,000 entry) pwdump format file, with LM and NTLM hashes. Because the LM hashes have various weaknesses in the cryptography, we can crack a lot of passwords using Ophcrack – but in some cases only NTLM hashes are present. In this case we can use a hybrid approach.

First, start Ophcrack going on your pwdump format file – that’s fairly quick to recover original passwords where LM hashes exist.

In parallel with that, take the pwdump format output and feed it through cut like this, to get Oclhashcat format:

Then do an incremental crack (with default mask) :

And also run with your standard massive dictionary – mine is called “combined.txt”:

…until bored, or Ophcrack finishes.

Once Ophcrack has finished, you can then feed your cracked passwords from that into a custom dictionary, and use that in conjunction with rules. I exported all fields from Ophcrack, using “;” as separator, so I could make use of any full or partial cracks it had managed.

This means that the Oclhashcat run will get at least all the passwords that the Ophcrack run got.

You can also try a hybrid attack like this – for each dictionary word, try that word followed by each possible trailing character.

Or try several of the half LM passwords from Ophcrack where the full password hasn’t been recovered – remember you’ll need one of the rules where it will try every possible combination of upper/lower case, because the LM password is case insensitive.

Once you’re happy you’ve got as many as you can, dump out the eventual results like this:

In summary this method is based on a phased password cracking approach against databases containing LM hashes which involves:

• Crack LM hashes using pre-computed hash tables – pass #1;
• Run a dictionary attack using GPU assisted software and any useful dictionaries – pass #2;
• Take the output of pass #1 and #2, feed it to a dictionary and run a brute forcing pass using GPU assisted software with default mangling rules – pass #3;
• (optional) Take each entry of the output of pass #1 and try all variations where a trailing character is added using GPU assisted software – pass #4;
• (optional) Take each entry of the output of pass #1 which only yielded the first half of the password and try those using GPU assisted software + mangling rules + case sensitive rules (because LM hashes are case insensitive) – pass #5;
• Run an incremental brute force attack against any uncracked hashes using GPU assisted software – pass #infinite (I would not wait for this one to finish…);

For what it’s worth, we recovered 5,120 out of 6,000-odd passwords in day on a normal sort of laptop; the password policy wasn’t terribly good though, which helped us a lot.