The same techniques work for Linux and Mac hashes, but thousands of times slower, because Windows uses especially weak hashes.
Here's a simple test case. A password of
password
has this hash on Windows machines:
8846f7eaee8fb117ad06bdd830b7586c
Windows does not use any salt, so every user
with the same password has the same password hash.
Note: If you want to calculate more test cases, just go use this website:
The 3rd type of MD4 is a Windows password hash, as shown below:
nano hash1.py
In nano, enter the code
shown below:
Save the file with Ctrl+X, Y, Enter.
python hash1.py
Enter a password of password.
You should see a result like that shown below (the memory location may be different):
This is a hash, but it's a binary object and all you see is its memory location. To see the normal result in hexadecimal, add the hexdigest() method like this:
Run the program again. This time you should get the exact hash shown below:
This looks more like a hexadecimal hash, but it's incorrect for Windows passwords. As shown above, the correct NT hash starts with 8846.
That's because the Windows algorithm uses Unicode, not ASCII, to encode the characters.
Modify your program to use Unicode, as shown below. (NOTE: the code for Unicode is "UTF-16LE" with the letters in lowercase, NOT "utf-161e".)
Run the program again. This time you should get the exact hash shown below:
Click on the host system's taskbar, at the bottom of the screen.
Press the PrntScrn key to capture the whole desktop. Open Paint and paste in the image.
Save the image as "Proj 7a from YOUR NAME".
YOU MUST SEND IN A WHOLE-DESKTOP IMAGE FOR FULL CREDIT
Capture a screen image showing the last several hashes, as shown below.
Click on the host system's taskbar, at the bottom of the screen.
Press the PrntScrn key to capture the whole desktop. Open Paint and paste in the image.
Save the image as "Proj 7b from YOUR NAME".
YOU MUST SEND IN A WHOLE-DESKTOP IMAGE FOR FULL CREDIT
CCSF-username-PINWhere "username" is the username in lowercase and PIN is a two-digit number.
For example, a user named "Sam" might have a password like this:
CCSF-sam-01Crack these passwords, which were collected from a Windows 7 machine with Cain.
Ming:"":"":AAD3B435B51404EEAAD3B435B51404EE:52C4859C0617E4A8FEC24BA890C5FC57
Mohammed:"":"":AAD3B435B51404EEAAD3B435B51404EE:39057EF3A9FE57D98E7A9BAB7CD2F4F9
sam:"":"":AAD3B435B51404EEAAD3B435B51404EE:19A641D2520B983ABB7C931CEFF933FA
Note that the NTLM hash is the rightmost
part of each line, after the last colon.
To complete this challenge, email in the correct passwords for all three accounts.
Somewhere in the Terms of Service, it strongly warns users not to re-use the same password as their Windows password.
In addition, it is now much more secure, because it uses MD5 instead of MD4, and not only that, it uses many rounds of MD5.
It doesn't use Unicode encoding.
Crack these hashes if you can! Send in the correct passwords to collect credit.
Ming: 7621eca98fe6a1885d4f5f56a0525915
Mohammed: b2173861e8787a326fb4476aa9585e1c
sam: 42e646b706acfab0cf8079351d176121
So the new, super-enhanced system uses a much larger number of MD5 rounds, followed by an even larger number of SHA1 hash rounds. Of course, the total number of hashing rounds is less than 500, because management is sure that's enough.
And now each user has to click "I Agree" to a pop-up box requiring them not to re-use passwords, so only a complete idiot would do that.
Crack these hashes if you can! Send in the correct passwords to collect credit.
Ming: ce788ed5f855e51e6fd78f923b43a6407467c5f2
Mohammed: 582d99006950cddeb2df9f40b3f65ebc283dc378
sam: da660655f4d4714fe605e9063d1ded4b749c50a9