What You Need for This Project
This website allows you to decrypt, if you're lucky, your ntlm hashes, and give you the corresponding plaintext. We proceed by comparing your hash with our online database, which contains more than 1.000.000.000 different hashes. Hashes.com este un serviciu de cautare hashuri. Acesta iti permite sa introduci un hash MD5, SHA-1, Vbulletin, Invision Power Board, MyBB, Bcrypt, Wordpress, SHA-256, SHA-512, MYSQL5, etc si sa-i cauti (gasesti) rezolvarea corespunzatoare in baza noastra de hashuri deja rezolvate.
- A Kali Linux machine, real or virtual
- A Windows Server 2016 machine, real or virtual (or any other Windows version)
Creating a Windows Test User
On your Windows machine, click Start.Type in CMD and press Shift+Ctrl+Enter.
If a 'User Account Control' box pops up,click Yes.
In the Administrator command prompt window,execute this command, which creates a user named'jose' with a password of 'P@ssw0rd'.
net user jose P@ssw0rd /add Downloading and Installing 7-Zip
In a browser, go to
Download the correct version for your operating system,which is probably the 64-bit version,as shown below.
Install itwith the default options.
Downloading and Installing Cain
In a browser, go toRight-click the downloaded file, point to7-Zip, and click'Extract Here',as shown below.
Enter a password of samas shown below. Click OK.
Double-click the ca_setup file.Install the software with the default options,as shown below.
When you see the message below, asking whether toinstall WinPcap, click the'Don't install' button.
TroubleshootingIf you get a warning box saying'Found some malware', as shown below,you need to tell Windows Defender not toremove Cain.At the lower left of the desktop, clickthe magnifying-glass 'Search' icon and typeDEFENDER. Open Windows Defender. In Windows Defender, click Settings andturn off 'Real-time protection'as shown below. Close Windows Defender and run the ca_setup fileagain. If this is your personal machine, remember to turn'Real-time protection' back on when you completethe project. |
Installing WinPcap
In a browser, go toClick 'Installer for Windows',as shown below. Download and install thesoftware with the default options.
Extracting Password Hashes with Cain
On your Windows desktop, right-click the Cainicon and click 'Run as Administrator'.Lm Hash Example
If a 'User Account Control' box pops up,click Yes.
In Cain, on the upper set of tabs, clickCracker.
In Cain, move the mouse to the center of thewindow, over the empty white space.
Right-click and click 'Add to list...',as shown below.
In the 'Add NT Hashes from' box, accept thedefault selectionof 'Import Hashes from local system',as shown below,and click Next.
The password hashes appear,as shown below.
Understanding Password Hashes
There are two password hashes: LM Hashes and NT hashes.LM hashes date from the 1980's, andare so weak Microsoftno longer uses them. The LM hash values Cainshows are just dummy filler values that no longerinclude any information about real passwords.
NT hashes are Microsoft's 'more secure' hash,used by Windows NT in 1993 and never updated inany way. As you will see, these hashes are alsovery weak and easily cracked, compared with Linuxpassword hashes.
Cracking four Linux hashes took about 20 secondsusing a dictionary of 500 words when I did it,but as you will see, you can crack four Windowspasswords using a dictionary of 500,000 wordsin about a second. Windows password hashesare more than 10,000 times weaker thanLinux hashes.
Notice that your NT passwordhash for 'Jose'starts with E19CC, just like mine, shown in theimage above. This isbecause Microsoft doesn't add a random 'salt'to passwords before hashing them--every useron every Windows machine on Earth has the same saltif they are using a password of P@ssw0rd.
That means you can often crack Windows passwordhashes by just Googling them,as shown below, because manylists of common passwords and hashes havebeen uploaded to the Internet over the last20 years.
However, in this project, we'll use hashcat, which is avery powerfulway to crack passwords.
Exporting the Hash to a Text File
In Cain, right-click jose and clickExport. Save the filewith the namewin1 in the default format (L0phtCrack 2.x file).Open the win1.lc file in Notepad.
Carefully highlight the NT hash for Jose,as shown below, right-click it, and clickCopy.
12.1: Recording Your Success (5 pts.)
Use the formbelow to record your score in Canvas.If you don't have a Canvas account, seethe instructionshere.
Pasting the Password Hash into Kali Linux
In your Kali Linux machine,in a Terminal window, execute these commands: In the nano window, from the menu bar at the top,click Edit,Crack Lm Hash Online
Paste.The hash appears,as shown below:
Press Ctrl+X, Y, Enter tosave the file.
Getting a Wordlist
Kali Linux contains a list of approximately 500,000 commonlyused passwords from the RockYou breach.In a Terminal window, execute these commands to extract them:
You should see the first ten passwords,as shown below.Getting Hashcat 2.00
Hashcat updated to 3.00 and it won't run in a virtualmachine anymore. The simplest solution is to use theold version.In a Terminal window, execute these commands:
You should see four password hashes,as shown below:Cracking the Hashes
In a Terminal window, execute this command.You mayneed to use hashcat-cli32.bin on your system.
./hash/hashcat-cli64.bin -m 1000 -a 0 -o winpass2.txt --remove win2.hash /usr/share/wordlists/rockyou.txtcat winpass2.txtEnter the password for the hash beginning with '32ff' into the form below.
12.2: Recording Your Success (10 pts.)
Use the formbelow to record your score in Canvas.If you don't have a Canvas account, seethe instructions here.