I have recently dumped some hashes from my local machine because I'm trying to understand the process in which Windows 7 hashes it's passwords.
I have discovered my local password hash that looks (similar) to this:
Now what I would like to know is what the different sections mean, so:
We have this hash:
Jason:502:aad3c435b514a4eeaad3b935b51304fe:c46b9e588fa0d112de6f59fd6d58eae3::: that looks to be separated by
: if we separate this by the
: we end up with this:
[Jason, :, 502, :, aad3c435b514a4eeaad3b935b51304fe, :, c46b9e588fa0d112de6f59fd6d58eae3, :, :, :]
- I'm assuming the first part
Jasonis the username, that's the most logical to me.
- The third part
aad3c435b514a4eeaad3b935b51304feis the ntlm hash would be my best guess.
If my assumption is correct then that leaves
- I'd guess that the other hash (
c46b9e588fa0d112de6f59fd6d58eae3) is the derived key, that is created from the password itself.
502would be the binary data of the user.
- And the
:is just a separator or a padding.
Now for my question, am I correct in my assumptions on what each part of the hash represents? If not can someone please explain to me what each part represents?