Tools helps: First time cracking passwords

Question

I am trying to crack passwords on two Windows member servers (2003 and 2008). There is no Active Directory. Each user seems to use the same password across servers, workstations, etc. I have access to the servers via an account given to me by the company that owns the servers. We'd like to get the other accounts.

With OphCrack, I used a pwdump file generated on the 2008 server to crack 18 of 26 passwords. These passwords were VERY simple (first names, for instance). The others are proving more elusive.

I am running Hash Suite Pro on the last eight accounts on a spare laptop.

I'd like some suggestions on other ways to go about this: tools, ways to speed the cracking up, etc. I've got a budget I can work with that's fairly high.

Answer 1

As far as jail time goes, as long as your contract is effective and has protection, you can be pretty safe in many countries. In the UK we do a lot of this sort of thing- mostly password strength audits. I'm not going to give legal advice, but your legal counsel should know the wording required in a contract for this. In the UK we use Hold Harmless terms, and restriction of liability so that if we break something while accessing computer systems we aren't held liable.

Technically, if you know the password strength requirements, you will know what sort of table or brute force you need to work with. For example if your minimum length requirement is 8 chars, start your brute force at 8 chars.

If you have already covered off brute force and dictionary attacks, a rainbow table maybe your only option. As @rook says, there are a few free places you can get them. The most common, though, are paid tables or table exchange, where you create a new table in exchange for the total set so far.

Answer 2

Your story is weird. Why would the "company's owners" want to crack passwords ? What could be the circumstances which would make such an effort appropriate (i.e. morally acceptable, legally passable and adequate for the pursued goals) ? The closest I can think of is if some data what encrypted with a password-derived key, and the password owner is unavailable or uncooperative -- and that's a police-vs-terrorists scenario, not a suspected-fraud scenario. My ability to detect common sense, or lack thereof, is tingling crazily. There is something fishy in your situation.

I sense an unusual amount of fear for something as trivial as this trade dispute.

The best explanation I can make is that the "company's owners" are working for a "company" which is in the habit of never involving law enforcement agencies in its dealings, and to administrate swift justice on a self-operated basis. Are you sure you want to work for the Yakuza ? Jail time could become a secondary worry, with regards to maintaining your ability to count up to ten.

---

That being said, password hashes stored in a Windows system are supposed to use the NT hash, which is a simple application of MD4 over the password (encoded in little-endian UTF-16). The best known preimage attack on MD4 is still theoretical only (effort in 2¹⁰⁴, which is way beyond the reach of Mankind in general, your reach in particular), so you are back to the brutal method of trying potential passwords, possibly optimized through a precomputed table (rainbow or not).

With a good GPU, you could perhaps try about 10 billions of passwords per second. You can rent some powerful hardware at Amazon Web Services. If you consider the "Vista eightXL" Ophcrack table, it claims covering about 99% of 8-character passwords, for a 95-character alphabet (the whole printable ASCII charset) -- that's about one week of computations on the aforementioned GPU. Rebuilding the rainbow table itself would be done in a fortnight. Is that worth 1000$ ?

There again, fishiness oozes under the door and permeates the atmosphere.

Answer 3

What is the relation between breaking someone's password and checking if he is fraud? If you want to check the official correspondence of such person, you don't need breaking password for that, but if it is used to break into private mail accounts... how it from ethical point of view differs from breaking into someone's house?

However, for legal issues, your question should be legalized. Relation between ethics and law varies. There are countries where you can be sentenced for criticizing religion (Salman Rushdie's case). There are, what is even harder to imagine, countries, in which you can go to prison for printing documents (see Dmitry Sklyarov's case). So it's not possible to answer your question without stating in which country you are operating. In North Korea in China you'd be legal as long as you work for government, in Europe something like that would in most case make you criminal.

In Germany, for example, even accessing the employee's mails stored on company's servers is allowed only under specific circumstances. See f.g.: http://www.hldataprotection.com/2011/08/articles/employment-privacy/german-higher-labor-court-permits-employers-to-review-employees-emails/