Welcome to HBH! If you have tried to register and didn't get a verification email, please using the following link to resend the verification email.

help with encryption


ghost's Avatar
0 0

hey,

i extracted this from a windows xp box, but im not sure what kind of encryption is is. Can someone tell me how to break it (im not saying do it for me, but how it can be reversed). i ran it through JTR without the commas (32 long), but it came out blank.

Thanks

Administrator:500:0,25,21,C4,1D,05,4B,A2,88,41,7E,AF,50,CF,AC,29,C3: _8A,4B,D5,C4,36,B3,81,FB,41,CF,59,75,75,AC,68,CF,09009:::

Guest:501:0:0:::


ghost's Avatar
0 0

Since no one has replied yet, I'll throw in my guess,

Those look like password hashes for user accounts.

If I'm right, then you need to crack them to see what the password is.

You'll have to do a little googling, but there are a few ways to go about it.

Here are some words to search;

dictionary attack: uses a big wordlist and see if the password matches any of those words–fast rainbow tables: Looks the hash up from a list of pre-computed hashes–fast brute force: Computes all hashes in order until it finds a match–slow

Someone much more educated then I could tell you more


richohealey's Avatar
Python Ninja
0 0

it's the sam dump.

google sam cracker.

i think C&A has one too


ghost's Avatar
0 0

VashTSPD wrote: Since no one has replied yet, I'll throw in my guess,

Those look like password hashes for user accounts.

haha. talk about stating the obvious. :p


richohealey's Avatar
Python Ninja
0 0

ordinarily i would have flamed the shit out of him, but he was trying to be helpful. read up man!


ghost's Avatar
0 0

Thanks for not flaming my first post.

I can only hide behind the excuse that it has been many moons since I last did anything related to hacking.


richohealey's Avatar
Python Ninja
0 0

it's all good man :)

had you worded it as though the rest of us couldn't have worked that out i would have gone to town on you though XD

ha ha.

have fun!


lukem_95's Avatar
Member
0 0

yeah Cain&Abel does have one.

Theyre LM hashes.


ghost's Avatar
0 0

thanks for your replys. i'll put them through cain and abel now.

EDIT: somethings wrong. when i added it as a text file, but when the file is: Administrator:500:0,25,21,C4,1D,05,4B,A2,88,41,7E,AF,50,CF,AC,29,C3: _8A,4B,D5,C4,36,B3,81,FB,41,CF,59,75,75,AC,68,CF,09009:::

nothing gets imported. with: Administrator:500:0,25,21,C4,1D,05,4B,A2,88,41,7E,AF,50,CF,AC,29,C3:::

it gets imported, but the hash is not recognized. here is a screen shot: http://img183.imageshack.us/img183/285/cainif6.jpg


ghost's Avatar
0 0

anything using a decent rainbow table should be able to get this in no time ig:rainbowcrack,LOphtcrack, or the foremetioned cain & able.