‫Now, this is a typical Windows local hash.
‫The columns are separated by colons.
‫The first column is the username.
‫Second field is the user I.D. It can be thought of as a user group.
‫Five hundred is for the administrators five zero two ideas for the current accounts, et cetera.
‫The third field is the Elm Hash, and the fourth is the end hash.
‫As you saw on the previous slide, two different hashing methods exist in a local Windows password hash
‫table.
‫Elam hashes and indium hashes The Eleme hash is a very weak one way function used for storing passwords.
‫Originally invented for the Land Manager operating system, but the Elm hash was included in Windows
‫NT for backward compatibility, and it still included for backward compatibility.
‫However, it is disabled by default since Windows Vista and Windows Server 2008.
‫So let's see the properties of these methods, comparatively.
‫Both types of hashes, generator, 128 bit stored value the Elm Hash has a limited character set of
‫only 142 characters.
‫While the hash supports almost the entire Unicode character set of sixty five thousand five hundred
‫thirty six characters.
‫While Elm allows cyphers up to 14 characters in length, and TLM allows ciphers up to 256 characters
‫in length.
‫Well, you can specify a password consisting of more than 14 characters, but the Elm algorithm takes
‫only the first 14 characters of the password into account.
‫And moreover, while in TLM Hash calculates the hash based on the entire password, the user entered
‫the realm hash splits the password into two seven character chunks padding as necessary.
‫That means you will crack to seven character passwords instead of one 14 character password.
‫It makes it dramatically easier to track elm hashes.
‫Now, furthermore, elm hashes are case insensitive.
‫The password you specified is converted to all upper cases and then the hash is calculated.
‫Let's give an example for the Illinois algorithm.
‫Suppose that you specified a password as my secret password with some uppercase and lowercase characters,
‫and the hashes are active in that system.
‫The system first convert all characters to uppercase.
‫Then it splits the password into two seven character chunks, ignores the 15th and the following characters.
‫So here we have M.y S E C, R E and T possessed W o strings, and the hard part is ignored.
‫Unless the hash values of these parts are calculated.
‫You can crack a seven character length password in seconds.
‫That means you can crack any hash in minutes as a result.
‫Never, ever enable LM hash algorithm and windows systems.