When I dump the password history hashes stored in the SAM database with mimikatz lsadump::dcsync tool, for every
i'th password (re-)set by a SAM account there are two hashes stored by Active Directory (AD):
ntlm- i and
lm- i. I know storing LM hashes is considered insecure nowadays so I wanted to test how easily crackable they truly are myself.
However, (1) I cannot brute-force the
lm- hashes (hashcat / John the ripper / online) and (2) calculating the LM hash of the plaintext password doesn't match the LM hash returned by the mimikatz dump. ... which raises my question:
- Could it be possible that regardless the label
lm-another hash is stored by AD? Or perhaps a salted or encrypted version of?
- In case yes, what hashing algorithm / encryption / other processing?
Example: dump of dummy SAM account
- for current password
pw- 0: password: NTLM(
ntlm- 0, but computing LM(
- Similarly, for previous password
pw- 1: abcd1234: NTLM(
ntlm- 1, but LM(
mimikatz # lsadump::dcsync /domain: /user:dummy [DC] '' will be the domain [DC] '' will be the DC server [DC] 'dummy' will be the user account [rpc] Service : ldap [rpc] AuthnSvc : GSS_NEGOTIATE (9) Object RDN : Dummy ** SAM ACCOUNT ** SAM Username : dummy User Principal Name : dummy@ Account Type : 30000000 ( USER_OBJECT ) User Account Control : 00000200 ( NORMAL_ACCOUNT ) Account expiration :  Password last change :  Object Security ID :  Object Relative ID :  Credentials: Hash NTLM: 8846f7eaee8fb117ad06bdd830b7586c ntlm- 0: 8846f7eaee8fb117ad06bdd830b7586c ntlm- 1: b3ec3e03e2a202cbd54fd104b8504fef lm - 0: d2a96f653b732223d5e0fea4cb15c5fc lm - 1: 7d4a908bb3545ee7d7458ab8c727c9ae