Let's now see the usage of rainbow tables and practice will show how easy it is to crack an entry passwords
using the tables.
Then we'll also take a look at the risks related to a Windows user connecting to a different system.
Will intercept empty land manager credentials and recover and end TLM password out of them.
Will use this password to extract the user's original password.
We'll start with an off line attack
we'll turn on an operating system but in a different way.
The original system will not start up and it's dead the popular crack application will run automatically.
The program is available in a live CD version and an installation version will look at later
this program is fully automatic.
You only need to launch a disk with the software to obtain a user's password.
You can run the program and then have a coffee or tea break.
When you return your workstation you shouldn't be able to see cracked passwords on the screen
Windows XP will be the tax system as you know from previous modules.
The default Windows XP configurations stores both LAN Manager and any land manager passwords
we have access to the same file since Windows is not booted.
It doesn't protect the file.
We also have access to the security and system files which means that it's now possible to decrypt the
Sam the attack computer's user has not used the Siskiyou tool and hasn't moved the key to an external
location.
This means that we can access the land manager and TLM manager hashes L.M. and Unicode passwords as
you know Ellen passwords are converted to uppercase and split into two halves.
As you can see the program cracks both halves at the same time one password has already been determined.
The first half was runes the other was blank.
We also cracked two letters from the second half of another password but we don't have the first half
yet.
Retrack L.M. passwords in this column you can see the results of reversing enty functions since enty
passwords are case sensitive to crack passwords are also case sensitive.
To determine passwords are so simple that they're probably contained in a dictionary or a permutation
list.
We are using rainbow tables however this will be easier to see when we launch the program again and
an installed version.
What are the drawbacks of this approach.
The method seems effective since after two minutes we've managed to find 913 passwords.
What if this workstation belonged to somebody else.
Two minutes would seem like a lifetime.
Let's leave the attack at the current state will run off crack again but this time not from a live CD.
We switched to Windows 7 offtrack is already installed in the system.
Do I look similar but it will be more noticeable here that we are using rainbow tables.
Will use XP free fast tables that are available for free on the crack Web site.
You can easily download and install them if you'd like to install other tables.
They unfortunately have to be paid for as a small digression I'd mention that most rainbow tables shared
on the internet don't include many diacritics if a password contains a diacritical marks that is not
found in the table you use.
You won't be able to crack it using this table which should now indicate the location of the sam.
The file can be extracted from a computer that stores passwords we want to crack
under Seacole and backslash windows backslash system 32 backslash config.
You can find three files that were mentioned before.
Sam security and system.
If you try to copy the same it can't be done the file can't be deleted or edited as well.
The file is blocked and these operations are exclusive to the Windows security system only the security
account manager Sam itself.
If we'd like to see what blocks it we should use Process Monitor to do this.
So how can you access the Sam to copy it to your multiprocessor ram heavy PC to make cracking passwords
faster.
You need to launch a victim's computer under a different system then you can copy the three files and
indicate their paths in the program.
You can also crack single passwords in off crack Here's a little window where you provide the password
in the P.W. dump format.
B.W. dump is a popular utility used to dump memory passwords P.W. dump can be run under an account that
has debugging permissions.
For example an administrative account selecting the local sound with the P.W. dump six options launches
the program.
After a while of crack will display system users in the passwords in the anti version.
Not in the L-M since this was Windows 7.
We said before that it's extremely difficult to crack an anti hash if it's secure.
P.W. dumb saves the data that was accessed by a DSL injection into the same manager to a txt file.
The text file has the format you can see below.
For the purposes of this presentation the file has been prepared earlier this cryptographic resource
can be harvested by a person who breaks into a server.
The file names users and their auntie and LAN Manager passwords you can copy the user's data and paste
it into crack
the selected user's password is apparently shorter than 7 characters.
We know this because the second part of the land Manager password is padded with spaces.
Let's try to crack the password rainbow tables are loaded now into memory after they're completely loaded.
The cracking will begin.
It turns out that the password of the admin three users the string pass.
You already know why the Elham password is in upper case.
You can also see that the user Bob has no passwords set the password for the user.
Alice has not been cracked on the other hand.
The rainbow table we use did not contain the string that was Alliss password
will log into Windows XP.
The system is needed for the last presentation in this module.
Even though our passwords even as empty are L.M. passwords are not sent over a network in plaintext.
We can use can enable a tool we used before to sniff them out.
This time the tool will not poison R.P. caches but simply listen in
your the results of the previous listening session as you can see Cecil and admin are the users that
connected to us.
Or who's NZL sessions we have intercepted.
Let's try to connect to an attacker's computer in Windows XP.
We don't have any ulterior motive we simply want to see what the computers sharing.
We don't want to download files or run applications on that PC.
We only want to connect to it if you type in net view.
LS PC in the command line interface the result would be the same
we can't connect to LS PC a window pops up where we can enter a different log in and then different
password
coming back to the attackers computer.
Let's see if there are any changes.
Eyeteeth super admin is another user next to Cecil I.T. admin that appears in Cain and Abel as you can
see the user attempted to authenticate using a secure version of the TLM protocol session security.
We know the users L.M. in NC hashes and also the challenge and response messages as you can see the
L-A messages contain only Noll's.
This means that this is the second version of the protocol.
If there is no domain you cannot then a kid in a more secure way you can also select to Cecil Edmon
and eyeteeth super Edmon and send them to a cracker.
Cain and Abel features a cryptanalysis attack option that uses a rainbow table just like before.
We don't want to repeat the same attacks over and over.
So now we'll try a brute force attack on that and TLM session security hashes.
You can see only one security hash.
Probably the newest one.
We don't know how the earlier ones were intercepted.
The attack begins by clicking Start
the cracked password belongs to the user's Cecil.
It turns out that the user has a blank password.
Things get interesting now.
Paradoxically the fact that Cecil has an empty password is what rescue's the user.
You can't connect to a computer as Cecil now Windows disables remote authentication using blank passwords
Microsoft implemented this solution a while back because many administrative accounts were blank by
default.
Up till recently Windows created administrative accounts with no passwords during installation.
It turns out that a blank password can be more secure than a lazy or simple password or example toor
one
this password was brute force during this short talk on Cecil.
In about 30 seconds Arty's super Edmon only tried to see what we shared.
This was enough however to sniff out the user's password.
We didn't need anything else.