Trustwave and Cybereason Merge to Form Global MDR Powerhouse for Unparalleled Cybersecurity Value. Learn More
Get access to immediate incident response assistance.
Get access to immediate incident response assistance.
Trustwave and Cybereason Merge to Form Global MDR Powerhouse for Unparalleled Cybersecurity Value. Learn More
Have you ever dumped LM and NTLM password hashes from a Windows system using the registry and never been able to crack the hashes or pass the hash? If so, maybe this blog post will be of specific interest and/or importance to you.
A couple months ago, my good friend Ryan Reynolds of Crowe Horwath explained to me that often times he would extract password hashes from a Windows system via the Windows registry and the hashes would never crack. He also discovered that when he pulled password hashes using other techniques, like LSASS injection, that he would get entirely different hashes, which in fact did crack successfully.
Here is just one example Ryan found when extracting hashes from Metasploit (via SAM/SYSTEM) and Pwdump6 (via LSASS injection).
After hearing a bit about this problem and knowing full well that we were getting bad hashes, Ryan and I decided that we would put our heads together and see if we could solve this problem.
Here are some highlights that resulted from our research:
Here are the slides that we delivered at DEFCON 20 for your viewing pleasure:
We hope that solving this problem for password cracking tools will help security professionals of all types obtain the correct password hashes from systems to evaluate their true state.
Here's a quick status of where we currently are with our patching efforts at the time of this writing:
If you have experienced this problem in the course of your work (or perhaps with a different tool not listed above) and the result of this research has directly helped you, we would really like to hear from you by commenting on this post.
Trustwave is a globally recognized cybersecurity leader that reduces cyber risk and fortifies organizations against disruptive and damaging cyber threats. Our comprehensive offensive and defensive cybersecurity portfolio detects what others cannot, responds with greater speed and effectiveness, optimizes client investment, and improves security resilience. Learn more about us.
Copyright © 2024 Trustwave Holdings, Inc. All rights reserved.