When I dump the password history hashes stored in the SAM database with mimikatz lsadump::dcsync tool, for every i'th password (re-)set by a SAM account there are two hashes stored by Active Directory (AD): ntlm- i and lm- i. I know storing LM hashes is considered insecure nowadays so I wanted to test how easily crackable they truly are myself.
However, (1) I cannot brute-force the lm- hashes (hashcat / John the ripper / online) and (2) calculating the LM hash of the plaintext password doesn't match the LM hash returned by the mimikatz dump. ... which raises my question:
- Could it be possible that regardless the label
lm-another hash is stored by AD? Or perhaps a salted or encrypted version of? - In case yes, what hashing algorithm / encryption / other processing?
Example: dump of dummy SAM account
- for current password
pw- 0: password: NTLM(password) ==ntlm- 0, but computing LM(password) !=lm- 0 - Similarly, for previous password
pw- 1: abcd1234: NTLM(abcd1234) ==ntlm- 1, but LM(abcd1234) !=lm- 1
mimikatz # lsadump::dcsync /domain:[] /user:dummy
[DC] '[]' will be the domain
[DC] '[]' will be the DC server
[DC] 'dummy' will be the user account
[rpc] Service : ldap
[rpc] AuthnSvc : GSS_NEGOTIATE (9)
Object RDN : Dummy
** SAM ACCOUNT **
SAM Username : dummy
User Principal Name : dummy@[]
Account Type : 30000000 ( USER_OBJECT )
User Account Control : 00000200 ( NORMAL_ACCOUNT )
Account expiration : []
Password last change : []
Object Security ID : []
Object Relative ID : []
Credentials:
Hash NTLM: 8846f7eaee8fb117ad06bdd830b7586c
ntlm- 0: 8846f7eaee8fb117ad06bdd830b7586c
ntlm- 1: b3ec3e03e2a202cbd54fd104b8504fef
lm - 0: d2a96f653b732223d5e0fea4cb15c5fc
lm - 1: 7d4a908bb3545ee7d7458ab8c727c9ae
