Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As most people here will know, Windows caches domain/AD credentials in a format known as MS-Cache v2. Obviously, these would be excellent passwords to gain during a penetration test when local access is obtained on a workstation.

My understanding is that these can't be attacked using rainbow tables. However, aside from using JTR and Cain, I don't see many options in software to crack them. Specifically, I'd like to use my GPU's (4x Nvidia cards) to try and crack these. Alternatively, if I could run distributed software, that would be a reasonable second best.

A few questions then:

  • What options are there for recovering MS-Cache passwords?

  • Can anyone provide a technical breakdown of how MS-Cache (v2) is generated/attacked?

  • Is MS-Cache v2 used to encrypt credentials stored on a domain controller?

Edit:

I'm only interested in MS-Cache v2 Hashes as generally i wouldn't come across machines older than Windows XP in a domain.

share|improve this question
    
Maybe 'Password hashes dump tools (Cached domain logon information column)' is helpful? docs.google.com/spreadsheet/… ( –  Tate Hansen Feb 14 '13 at 2:13
    
That's an awesome list, but dumping them is simple enough, its the cracking that keeps stopping things :( –  NULLZ Feb 14 '13 at 3:27
add comment

3 Answers

up vote 13 down vote accepted
+100

MS-Cache is a pretty simple format - it's an MD4 hash of the password, followed by the username in lower case, and hashed together MD4( MD4(Unicode(password)) + Unicode(tolower(username)) ). I'm not sure of the technical difference between MS-Cache and v2; but nothing I can find suggests they're not susceptible to a RainbowTable attack (in fact, Cain & Abel seems to have support for MS-Cache and MS-Cache v2 tables - "Added MSCACHE v2 Hashes Cryptanalysis via Sorted Rainbow Tables" in v4.9.4).

The MS-Cache credentials are not stored on the domain controller (except for users that logon to it directly) - they are stored as MD4 hashes of the passwords, related to the username. You may be interested in this technet piece about how they're hadled.

Regarding GPU accelleration, it looks like John the Ripper has MD4 support; that may be what you're after. Otherwise there is this article on attacking Windows passwords with the GPU (specifically, you may be able to adapt ighashgpu for your purposes) and, as mentioned by Lucas in the comments below; rcracki_mt has GPU support.

[Update]

MS-Cache v2 is described in detail (with code) at openwall.info, and importantly PassLib mentions it's also known as 'DCC2', which may help with future searches (though info is frustratingly scant). As for attacks against it, from openwall:

In other words, incremental brute-force attacking for different search spaces, depending on the character set and the password length, will take ages. So it is a good idea to do some intelligent password guessing when attacking DCC2 hashes, i.e. rule-based dictionary and probabilistic attacks.

With that python module and PassLib you should be able to put together something involving PyCUDA and PassLib, but it doesn't look like it's been done by anyone before.

share|improve this answer
1  
I think rcracki has support for gpu as well, you can add it to your answer, I'm not going to make a separate answer for that. –  Lucas Kauffman Feb 14 '13 at 1:49
    
Windows XP or earlier uses MSCache V1 while Windows Vista/7/2008 use MSCache V2 i believe. In addition, i believe v2 uses SHA1 hash iterations along with MD4 that v1 uses to encrypt the password. I get 215 passes per second with Cain trying to crack them. :( At that rate, it'll take about 400 years to do JUST lower alpha/numeric at ONLY 8 chars. Cain does appear to support rainbow tables, can you link me to any that will generate/let me download? –  NULLZ Feb 14 '13 at 3:24
    
freerainbowtables.com does what it says on the tin :) –  Bob Watson Feb 14 '13 at 6:04
    
@BobWatson All that's there is LM, MD5, MYSQLSHA1, NTLM. I actively contribute to the BOINC project to further that. Unfortunately there are NO MSCache v2 hashes there. The fact that the v1 hash is MD4 and Salted seems to suggest that a table would only be done on 'common' names?? –  NULLZ Feb 14 '13 at 10:29
1  
I've added a section detailing what I found of MSCache2 - as compared to openwall.info/wiki/john/MSCash I don't think it's anywhere near as attackable. You'd have to go in with some prior knowledge of some description. –  Bob Watson Feb 17 '13 at 1:38
show 5 more comments

From this page, I see a description of MS-Cache v2 as the MD4 hash of the concatenation of the "NTLM hash" of the password, and the username (converted to lowercase, then encoded in "Unicode", which means "little-endian UTF-16" in Microsoft terminology). The "NTLM hash" is MD4 computed over the password (there again in little-endian UTF-16). So the hash involves two nested MD4 invocations and is "salted" by the user name.

Rainbow tables are "just" precomputed tables (with a trick which saves a lot of space); they can crack hashes which were encountered during the table building phase, but none other. Therefore, you can build a rainbow table for MS-Cache v2, but only for a specific user name; the table would not be applicable to hashes for other users. Therefore, such a table would make sense for a user name which is often found in many domains, namely "Administrator", but this is still of limited applicability. Cain & Abel pretends to include (since version 4.9.43) support for generating and using rainbow tables on MS-Cache v2 hashes, but, of course, for a single user name at a time.

If you only have one hash to crack, then building the table would take more time than brute force cracking (building a rainbow table which covers N possible passwords takes time about 1.7*N whereas brute force cracking has an average cost of about N/2, so the table is worth building only if trying to crack at least 4 hashed passwords, all with the same username in the case of MS-Cache v2).

I did not find freely available, already computed rainbow tables for MS-Cache v2 and username "Administrator".


MD4 is an ancestor to MD5 and maps very well to GPU (even better than MD5) so your four GPU should be able to try potential passwords by the billion(s) per second. The "jumbo" version of John the Ripper is documented to support MS-Cache v2 with GPU (under the name "MSCash2"), albeit with some inefficiencies on the password generation side (to hash one billion passwords per second, you have to generate one billion potential passwords per second, and that could starve the most well-intentioned CPU). At the very least, this will give you some source code to play with, and a "reference implementation" which would be handy for tests.

A quad-core Core2 2.4 GHz CPU, without any GPU at all, should be able to compute 80 millions of MD4 hashes per second, with SSE2-enhanced code (estimation from an implementation of mine which did 48 millions of SHA-1 hashes per second), translating to 40 millions of passwords per second. This is already quite good, by password cracking standards, although of course the GPU will be vastly more efficient. It would be a nice programming exercise.

share|improve this answer
    
In that thread (government security) there is conflicting information about weather or not rainbow tables work., additionally, there's no working link to the user's source. It seems like there has been comparatively little research done into these types of hashes. I'm well familiar with rainbow tables so it looks like MS-Cachev2 isn't suited to using them. I'm yet to find any "domain admin" called 'administrator' :P I can't see any option in C&A to allow for creation of MS-Cache rainbow tables... –  NULLZ Feb 15 '13 at 6:18
1  
Rainbow tables work really well - as long as you don't have salts. If you do, see @Thomas' comment regarding usefulness for well known user names. –  Rory Alsop Feb 15 '13 at 13:24
add comment

A very good tool you should try is oclHashcat, which is a GPU only hash cracker, it works on Windows and Linux and supports multi-GPU as well.

There are two versions of this software which are useful for you, oclHashcat-lite which is a single hash cracker and oclHashcat-plus which can crack up to 15 million hashes at the same time.

For example, using the command line parameters which follows this line, you will bruteforce MS-CACHE 2 hashes which are kept in a specified file (example.hash) trying the lower_alpha_numeric charset. The cleartext will be saved into a file:

cudaHashcat-plus64.exe -o out.txt -a 3 -1 ?l?d -m 1100 --increment-min=1 example.hash

More information are available in the Wiki.

P.S.: Because this script uses the increment mode it will check up to 15 digits passwords (36^15).

share|improve this answer
    
Hi LMGTFY, That link is perfect and exactly the software i was looking for. I use oclHashcat but i haven't used oclHashcat-plus! Thanks! –  NULLZ Feb 20 '13 at 1:25
1  
@D3C4FF I'm glad you've found my previous answer useful. By the way, oclHashcat-plus is the successor of the "old" oclHashcat. THIS is an entry in their wiki which explains how to split the workload allowing the user to distribute the cracking process across multiple computers. –  LMGTFY Feb 20 '13 at 7:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.