Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am trying to crack passwords on two Windows member servers (2003 and 2008). There is no Active Directory. Each user seems to use the same password across servers, workstations, etc. I have access to the servers via an account given to me by the company that owns the servers. We'd like to get the other accounts.

With OphCrack, I used a pwdump file generated on the 2008 server to crack 18 of 26 passwords. These passwords were VERY simple (first names, for instance). The others are proving more elusive.

I am running Hash Suite Pro on the last eight accounts on a spare laptop.

I'd like some suggestions on other ways to go about this: tools, ways to speed the cracking up, etc. I've got a budget I can work with that's fairly high.

share|improve this question
    
rainbow tables are free, and this is probably not the right place to ask this question. Perhaps you should ask a lawyer. –  Rook Mar 4 '13 at 22:59
    
@Rook Ophcrack lists several "Professional Rainbow Tables" that are all for sale. Vista eightXL, for instance, is 2.0TB and $949. And I recognize you can't speak about the legality. I'm just ... upset. –  tcv Mar 4 '13 at 23:08
1  
If you think typing up this huge sob story is the best way to crack a password for free, you are doing it wrong. –  Rook Mar 4 '13 at 23:11
4  
So, I'm still confused. What is your question? Is it, 'Is it morally/ethically/legally acceptable to do this?" or is it "Free rainbow tables have been exhausted, what else can I do to retrieve passwords without spending $1000.00?" –  Xander Mar 4 '13 at 23:21
1  
@Xander -- Well, I'd love an answer to both but I suppose what's relevant here is the second question. –  tcv Mar 4 '13 at 23:23

3 Answers 3

Your story is weird. Why would the "company's owners" want to crack passwords ? What could be the circumstances which would make such an effort appropriate (i.e. morally acceptable, legally passable and adequate for the pursued goals) ? The closest I can think of is if some data what encrypted with a password-derived key, and the password owner is unavailable or uncooperative -- and that's a police-vs-terrorists scenario, not a suspected-fraud scenario. My ability to detect common sense, or lack thereof, is tingling crazily. There is something fishy in your situation.

I sense an unusual amount of fear for something as trivial as this trade dispute.

The best explanation I can make is that the "company's owners" are working for a "company" which is in the habit of never involving law enforcement agencies in its dealings, and to administrate swift justice on a self-operated basis. Are you sure you want to work for the Yakuza ? Jail time could become a secondary worry, with regards to maintaining your ability to count up to ten.


That being said, password hashes stored in a Windows system are supposed to use the NT hash, which is a simple application of MD4 over the password (encoded in little-endian UTF-16). The best known preimage attack on MD4 is still theoretical only (effort in 2104, which is way beyond the reach of Mankind in general, your reach in particular), so you are back to the brutal method of trying potential passwords, possibly optimized through a precomputed table (rainbow or not).

With a good GPU, you could perhaps try about 10 billions of passwords per second. You can rent some powerful hardware at Amazon Web Services. If you consider the "Vista eightXL" Ophcrack table, it claims covering about 99% of 8-character passwords, for a 95-character alphabet (the whole printable ASCII charset) -- that's about one week of computations on the aforementioned GPU. Rebuilding the rainbow table itself would be done in a fortnight. Is that worth 1000$ ?

There again, fishiness oozes under the door and permeates the atmosphere.

share|improve this answer
1  
+1 for the thoughtful Yakuza advice –  BrianAdkins Mar 5 '13 at 4:49
1  
The first reason that came to my mind was: The attacker is hoping for password reuse, e. g. on a private email account. –  Hendrik Brummermann Mar 5 '13 at 7:23
1  
Nice quote, Qui-Gonn. –  AviD Mar 5 '13 at 11:22
    
I'd have linked the quote to this‌​. (warning: audio) –  Polynomial Mar 5 '13 at 13:52
    
I wonder if the Yakuza has recruitment drives. Something like a bake sale, y'know? Buy a muffin, grab a flyer, etc. –  tcv Mar 5 '13 at 14:41

As far as jail time goes, as long as your contract is effective and has protection, you can be pretty safe in many countries. In the UK we do a lot of this sort of thing- mostly password strength audits. I'm not going to give legal advice, but your legal counsel should know the wording required in a contract for this. In the UK we use Hold Harmless terms, and restriction of liability so that if we break something while accessing computer systems we aren't held liable.

Technically, if you know the password strength requirements, you will know what sort of table or brute force you need to work with. For example if your minimum length requirement is 8 chars, start your brute force at 8 chars.

If you have already covered off brute force and dictionary attacks, a rainbow table maybe your only option. As @rook says, there are a few free places you can get them. The most common, though, are paid tables or table exchange, where you create a new table in exchange for the total set so far.

share|improve this answer

What is the relation between breaking someone's password and checking if he is fraud? If you want to check the official correspondence of such person, you don't need breaking password for that, but if it is used to break into private mail accounts... how it from ethical point of view differs from breaking into someone's house?

However, for legal issues, your question should be legalized. Relation between ethics and law varies. There are countries where you can be sentenced for criticizing religion (Salman Rushdie's case). There are, what is even harder to imagine, countries, in which you can go to prison for printing documents (see Dmitry Sklyarov's case). So it's not possible to answer your question without stating in which country you are operating. In North Korea in China you'd be legal as long as you work for government, in Europe something like that would in most case make you criminal.

In Germany, for example, even accessing the employee's mails stored on company's servers is allowed only under specific circumstances. See f.g.: http://www.hldataprotection.com/2011/08/articles/employment-privacy/german-higher-labor-court-permits-employers-to-review-employees-emails/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.