Chapter 4

Determining Hash Type & Cracking Simple Passwords

Computer operating systems and applications normally store passwords in an encrypted form called a password hash. The hash is a cryptographic representation of the actual password. Therefore, the hash will need be to be unencrypted or cracked to find the true password. Surprisingly, some services store or transmit passwords in plain text! But during most security tests, when you recover a user’s password it will be in the encrypted hash form.

There are many different types of encryption used when creating hashes. In this chapter we will first talk about determining what type of hash you may have recovered. Then we will talk about the simple (and outdated) Microsoft LM password hash and see how these can be cracked online.  We will cover password cracking with cracking tools in greater depth in the following chapters. 

Not sure what Kind of Hash you have?

There are several different types of hashes that you will run into when you start cracking passwords. We covered Kerberos tickets in depth in the first chapter. But some of the most confusing ones are the different Windows hashes. Let’s try to explain these really quick.

➢      LM Hash – Outdated password hash that goes back to the old Lan Manager days. LM hashes are no longer stored by default, but you might still find them creeping about.

➢      NTLM Hash – Comprised of the LM hash and NT Hash (NTHash), separated by a colon. This is what you will find when you dump passwords from a Windows SAM Database or a Domain Controller’s database. NTLM Hashes can be passed in “Pass the Hash” type attacks.

➢      NTLMv1 or NTLMv2 – These are challenge response hashes, NTLMv2 is more secure. You will capture these hashes...

Cracking Simple LM Hashes

Many Windows XP systems used Lan Manager (LM) hashes to protect their passwords. This is a very old and outdated way to store password hashes. This hashing process was created for systems before Windows NT. Believe it or not, you can still find LM Hashes used in modern networks today. In this chapter we will look at cracking these simple LM (and some simple NTLM) hashes.

Microsoft’s support for Windows XP ended in 2014. As of Jan 2023, surprisingly enough around .5% of the world’s computers running Windows Operating Systems are still running it! XP is still holding on in the computer market share, just barely behind Windows 8, with Windows 10 still in first place. Shockingly what this means is that there are still a lot of Windows XP systems that could be in business-critical positions.

Source: Statcounter Global Stats – Feb, 20231

There are several different ways that computers encrypt their passwords. One of the most secure ways includes...

Cracking LM/ NTLM Password Hashes Online

There are several websites that will allow you to input a Windows NTLM hash and it will return the password used (if it is in its lookup table). CrackStation is one of the more popular ones. CrackStation’s website offers an online interface that cracks many LM/NTLM hashes using their lookup tables in mere seconds. Let’s try cracking a hash using this online tool.

Let’s crack a hash! This is the Administrator password hash from an XP machine:

Hash: aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0

Now,

➢      Surf to Crackstation, (https://crackstation.net/)

The website wants either the LM Hash on the left of the colon, or the NTHash which is on the right.

Pick one and paste it into CrackStation’s lookup prompt. Ensure that you are definitely not a robot and hit “crack hashes”.

In about a second, you should see the results shown in the next screenshot.

Oh look, the...