Why does pwdump7 retrieve LM hashes even though they're disabled?

Question

I'm currently undergoing a penetration testing certification, where I'm asked to :

• Set up a fully-patched Windows 10 Pro VM (done)
• Retrieve local password hashes from the SAM database using pwdump7
• Crack these passwords using rainbow tables and OphCrack

But I encounter a strange behavior of pwdump7 that I don't understand.

From online research, I gathered that LM hashes are disabled by default on Windows 10 systems. I also have the Network security: Do not store LAN Manager hash value on next password change Group Policy enabled by default on my VM.

However, when I run PwDump7.exe in an Administrator command prompt, I get the following hashdump :

Administrateur:500:1572D4F95361A8BB91A573D91D0FECD3:F198938E100D4E18CEEC6FF1B77AF209:::
Invité:501:C3909CE10A2E26E43E14033ED7C252D3:8FCB137FA6D5907BEC96D82D5631CF14:::
DefaultAccount:503:F12B8A9E3FA47FDC9C5098B04BB15FE2:FA1440E32F8F6B4B5F276A723209E0AE:::
WDAGUtilityAccount:504:F1601AD372DB88DAADE8A5B92B097581:D23055FD3030A0C8A1B56A3689AAB745:::
Admin:1000:1AF4EF0E6E14CE97C8D1CCAD392C46D7:16FCC3441F3005923F649E8F9D1684F5:::
Martin:1001:3A4C1FB7E7FF9EE2972AEC3F193D7552:3AF5C318F2268DD802E79D8A24E89959:::
Jason:1002:D7366D17F427BDD3A29E4A589002ACD7:2FD2BF7C980AD86E4D8A0527A3E136DE:::
Shiela:1003:D2E2DE9405BC29AA60B0BF02E8E48819:1EC1DFA1A4CB0B642100697C419EBBB5:::

It seems weird that there is something in the LM field of the dump, since it's supposed to be disabled. Moreover, OphCrack (cracking tool using rainbow tables) doesn't find a single password (it's supposed to find at least these 3 : "test", "apple" and "qwerty").

All this points to the fact that there is something wrong (or something I don't understand) about the way pwdump7 retrieves hashdump, and I'm curious about what it is. From the official website, I know that pwdump7 uses the binary SAM and SYSTEM files to retrieve the hashdump.

Using another tool (fgdump) I get the following hashdump :

Admin:1000:NO PASSWORD*********************:92937945B518814341DE3F726500D4FF:::
Administrateur:500:NO PASSWORD*********************:NO PASSWORD*********************:::
DefaultAccount:503:NO PASSWORD*********************:NO PASSWORD*********************:::
Invité:501:NO PASSWORD*********************:NO PASSWORD*********************:::
Jason:1002:NO PASSWORD*********************:2D20D252A479F485CDF5E171D93985BF:::
Martin:1001:NO PASSWORD*********************:5EBE7DFA074DA8EE8AEF1FAA2BBDE876:::
Shiela:1003:NO PASSWORD*********************:0CB6948805F797BF2A82807973B89537:::
WDAGUtilityAccount:504:NO PASSWORD*********************:019178C0B9CFCCE1F235A1153545B83F:::

This one is correct, and can be used with OphCrack to find the desired passwords.

Does someone know why the dump from pwdump7 is in such a weird format ?

Answer 1

In Windows 10 Anniversary update, Microsoft changed the encryption algorithm used for password hashes in SAM, the main difference being they switched the cipher used from RC4 to AES.

As pwdump7 is closed source and I wasn't able to find the date of its release, we can't tell for sure, but most probably it was never updated to be able to decrypt this newer encryption scheme, therefore the decrypted data is nonsense. Not only do you get fake LM hashes, but the NTLM hashes also differ from fgdump's output, so they are most probably also the result of wrong decryption and nonsensical.

You can find more information about the new encryption here: https://www.insecurity.be/blog/2018/01/21/retrieving-ntlm-hashes-and-what-changed-technical-writeup/