When I dump the password history hashes stored in the SAM database with mimikatz lsadump::dcsync tool, for every i'th password (re-)set by a SAM account there are two hashes stored by Active Directory (AD): ntlm- i and lm- i. I know storing LM hashes is considered insecure nowadays so I wanted to test how easily crackable they truly are myself.

However, (1) I cannot brute-force the lm- hashes (hashcat / John the ripper / online) and (2) calculating the LM hash of the plaintext password doesn't match the LM hash returned by the mimikatz dump. ... which raises my question:

  • Could it be possible that regardless the label lm- another hash is stored by AD? Or perhaps a salted or encrypted version of?
  • In case yes, what hashing algorithm / encryption / other processing?

Example: dump of dummy SAM account

  • for current password pw- 0: password: NTLM(password) == ntlm- 0, but computing LM(password) != lm- 0
  • Similarly, for previous password pw- 1: abcd1234: NTLM(abcd1234) == ntlm- 1, but LM(abcd1234) != lm- 1
mimikatz # lsadump::dcsync /domain:[] /user:dummy
[DC] '[]' will be the domain
[DC] '[]' will be the DC server
[DC] 'dummy' will be the user account
[rpc] Service  : ldap
[rpc] AuthnSvc : GSS_NEGOTIATE (9)

Object RDN           : Dummy


SAM Username         : dummy
User Principal Name  : dummy@[]
Account Type         : 30000000 ( USER_OBJECT )
User Account Control : 00000200 ( NORMAL_ACCOUNT )
Account expiration   : []
Password last change : []
Object Security ID   : []
Object Relative ID   : []

  Hash NTLM: 8846f7eaee8fb117ad06bdd830b7586c
    ntlm- 0: 8846f7eaee8fb117ad06bdd830b7586c
    ntlm- 1: b3ec3e03e2a202cbd54fd104b8504fef
    lm  - 0: d2a96f653b732223d5e0fea4cb15c5fc 
    lm  - 1: 7d4a908bb3545ee7d7458ab8c727c9ae


You must log in to answer this question.

Browse other questions tagged .