Printable View
I was asked by someone else how Windows systems in a domain cache passwords so that people can login even when the box can’t contact the domain controller. I found a site by a guy named Arnaud Pilon about how it works and he also provides tools for grabbing the password hashes out of the LSASS cache and cracking them using John the Ripper. Interesting stuff. Here is the URL:
http://www.cr0.net:8040/misc/cachedump.html
Irongeek nice link, but i have one question i was wornding if any one could answer. In the article he says
and then he goes on on how to get the information stored in HKLM\SECURITY\CACHE\NL$n using CacheDump but wouldnt it also be possible to get the same information from HKLM\SECURITY\CACHE\NL$n with out tools if you had system pivileges.Quote:
Credentials are stored in HKLM\SECURITY\
CACHE\NL$n with n ranging between 1 and 10. The default ACL does not allow
Administrators to read these registry values, which can only be accessed
with SYSTEM privileges.
Administrators don’t have as high a level of access as the SYSTEM account, so he starts a service with his tool to run as SYSTEM and get to those values. At least that is my understanding.
I know, but what i am saying is that i know of ways of getting system privileges on a windows box even if you aren't admin and my question was if you got your self system priv would you be able to get the passwords with out any tools to be unencryped on a difrent computer.
Yes. If you can access the registry with SYSTEM rights, then you can grab your hashes. This is exactly how L0phtCrack works.
--TH13
Ok thank you thehorse13 i was just wornding if you could, I would have tryed it befor asking but i dont have access to that kind of network right now.
I just tested it and it seems to work great. Still, it can take a long time to crack a password using John's incremental mode so it's of limited use to a cracker. Maybe I should write a tutorial on on.
There really isn't a need to login with an account that has system privileges. Just use regedit and give yourself the permissions to the proper keys. By default only system has privileges, but the OS doesn't keep you from changing the permissons on those keys.
I just tested what mohaughn said and he is correct, but the cachedump tool does everything for you and parses out the usernames so it's easier than to do it all by hand.