Lab 2: Test the complexity of a Windows System, Cracking Windows hashes using Johnny
When cracking Windows passwords if LM hashing is not disabled, two hashes are stored in the SAM database. SAM is Security Accounts Manager. It stores the LM & NTLM hashes in an encrypted form. So first we have to decrypt or dump the hashes into a file. For this other tools in kali linux are there which is described in the series. Check out tool “samdump2” for decrypting & dumping the SAM. For this Lab we have a dumped file containing the LM & NTLM hashes named “hashes”.
The first is the LM hash (relatively easy to crack because of design flaws, but often stored for backwards-compatibility)
The second is the NTLM hash which can be more difficult to crack (when used with strong passwords).
Step 1: Load the hashes file into Johnny.
Step 2: Select LM as format in the options tab.
Step 3: Start Attack and look for results
This one & the previous one on Johnny, these could be really time consuming & processor intensive. It could take upto a millennium to break a password by brute forcing it. So some times (in fact most of the times) we use word-list attack in which a word-list is supplied to crack the password.
If you want to know what is happening under the hood, read on.
Brute-forcing is simply a method of trying all combinations in a particular key space. Say suppose we have a suitcase with a number lock of 3 digits. Suppose you forgot your unlock code. You couldn’t figure it out what was it, what will you do ? Simply you try all combinations under 3 digits from 000 to 999. So how much time it would take to crack the code. Same happens in brute-forcing. Programs & Scripts analyze the type of cryptographic algorithm used, calculates the keyspace & runs through all values inside it.
Also there is word-list attack.In this, a wordlist containing a list of commonly used passwords is supplied to the attack. The program(here john) first finds out the hashing/encryption technique used in the supplied hash. Then the program calculates the corresponding hash of each word in the list supplied and compares it with the hash that needs to be cracked. We will do couple of wordlist attacks in later tutorials. This is also known as “Dictionary Attack”.
http://en.wikipedia.org/wiki/Brute-force_attack
http://searchsecurity.techtarget.com/definition/dictionary-attack
