.

NT Hash Decode

<<

Clueless

Post Mon Apr 19, 2010 12:06 pm

NT Hash Decode

Help!  I am at my wits end.  Can anyone decode this NT hash for my wifes computer, I screwed up the password, and can't get back in.  She has all here photos stored on this computer, and I don't want to be responsible for loosing them.  I tried OPHCRACK live CD with the free tables, with no success, system is Vista.

NT hash = 7883959c919eafeb76f893f4f9426929

Any help would be greatly appreciated
<<

UNIX

User avatar

Hero Member
Hero Member

Posts: 1244

Joined: Mon Apr 28, 2008 9:20 am

Post Mon Apr 19, 2010 12:49 pm

Re: NT Hash Decode

May I ask how you screwed it up? Just curious. :)
<<

Clueless

Post Mon Apr 19, 2010 1:48 pm

Re: NT Hash Decode

Decided to reset her password as a joke, after having had a few too many, must have made a typo, now I can't logon, no admin account - in deep crap.
<<

pizza1337

Full Member
Full Member

Posts: 156

Joined: Mon Mar 08, 2010 5:29 pm

Post Mon Apr 19, 2010 2:39 pm

Re: NT Hash Decode

anyone else think its fishy?

><}}}'>
Knowledge Resource is Power.
<<

ziggy_567

User avatar

Sr. Member
Sr. Member

Posts: 378

Joined: Tue Dec 30, 2008 1:53 pm

Post Mon Apr 19, 2010 2:42 pm

Re: NT Hash Decode

Whether or not its fishy...Clueless would be the most able to crack the hash since he probably has "some" idea of what the password would be. If anyone else were to crack it, it would ultimately become a brute force attempt.
--
Ziggy


eCPPT - GSEC - GCIH - GWAPT - GCUX - RHCE - SCSecA - Security+ - Network+
<<

n1p

Jr. Member
Jr. Member

Posts: 89

Joined: Tue Mar 16, 2010 5:31 pm

Post Mon Apr 19, 2010 3:15 pm

Re: NT Hash Decode

Yes, I second that. You will roughly have the character length and possible variations. You obviously entered the pass twice to change it, so you cant be that far wrong. With this in mind you can significantly reduce the required searchable keyspace. So stick with it...

You could also try having a few more beers and trying again. Might get lucky... or unlucky
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Mon Apr 19, 2010 8:45 pm

Re: NT Hash Decode

really, don't need to crack it. if you have physical access to the computer there are tools out there that let you reset windows passwords. I use TRK (Trinity Rescue Kit) at work, and have yet to lose data.
OSWP, Sec+
<<

dynamik

Recruiters
Recruiters

Posts: 1119

Joined: Sun Nov 09, 2008 11:00 am

Location: Mile High City

Post Mon Apr 19, 2010 10:57 pm

Re: NT Hash Decode

There's not another administrator account on the machine where you can just reset it?

As mentioned earlier, there are utilities, such as konboot, that can reset passwords.

You might want to hold off on either method if she was using EFS though.
The day you stop learning is the day you start becoming obsolete.
<<

j0rDy

User avatar

Hero Member
Hero Member

Posts: 591

Joined: Tue Feb 23, 2010 4:55 am

Location: Netherlands

Post Tue Apr 20, 2010 3:24 am

Re: NT Hash Decode

no need to crack it. people tend to underestimate the power of physical access to the machine. there are plenty of tools (mostly linux based) that can boot as a live CD and reset the current password to whatever you want (even null) this is the easiest and most efficient way of resetting the password. Giving the fact you changed it to something random i'd say there is no need to crack it to find out what the password was. Good Luck!
CISSP, CEH, ECSA, OSCP, OSWP

earning my stripes appears to be a road i must travel alone...with a little help of EH.net
<<

DavidW

Newbie
Newbie

Posts: 21

Joined: Tue Jun 23, 2009 6:31 pm

Location: Pennsylvania

Post Wed Apr 21, 2010 12:32 pm

Re: NT Hash Decode

With this being your wife's computer and the fact that you have physical access to it, as a last resort if you can't reset the password so you can gain access you could remove the hard drive from her computer and connect it to another.  Once you boot the computer you would just copy the contents over from one hard drive to another and then format, reload and then copy the backed up data over to her computer again.  If this is a laptop you would need a device to connect the hard drive to another system but this would be no problem with a PC.  Before you go that route though what OS is your wife's computer running?  Once that is answered I will have more suggestions to try.
A+, Security+, MCP, MCSA:Security - Server 2003, MCSE:Security - Server 2003, MCTS,  MCITP: Enterprise Support Technician, MCITP: Server Administrator

Presently working on C|EH
<<

ziggy_567

User avatar

Sr. Member
Sr. Member

Posts: 378

Joined: Tue Dec 30, 2008 1:53 pm

Post Wed Apr 21, 2010 12:51 pm

Re: NT Hash Decode

My guess would be Windows since he's asking about a NT Hash.
;)
--
Ziggy


eCPPT - GSEC - GCIH - GWAPT - GCUX - RHCE - SCSecA - Security+ - Network+
<<

DavidW

Newbie
Newbie

Posts: 21

Joined: Tue Jun 23, 2009 6:31 pm

Location: Pennsylvania

Post Wed Apr 21, 2010 2:01 pm

Re: NT Hash Decode

I was assuming Windows as well and should have worded it as such I guess :).  I should have just mentioned it in my previous post about trying to log on to XP using administrator as the log in with no password and not being able to use the administrator account in Windows Vista and 7 to try this since it is disabled by default.  If it helped that'd be less work he would have to do.  Just adding my two cents. ;)
A+, Security+, MCP, MCSA:Security - Server 2003, MCSE:Security - Server 2003, MCTS,  MCITP: Enterprise Support Technician, MCITP: Server Administrator

Presently working on C|EH
<<

Marcos_NJ

Newbie
Newbie

Posts: 1

Joined: Mon Jul 05, 2010 3:01 pm

Post Mon Jul 05, 2010 3:12 pm

Re: NT Hash Decode

I have the same problem only the PC is of a deceased person who worked for me.  I believe I have quite a bit of intellectual property on the machine and I'm only able to get on the pc and retreive specific contents.  The hard drive must be in tact and not placed in another computer for retreival.

I have all the MD5, NTLM, LM, SHA1 codes but all online tools return "Not Found"

I'm on a timetable here and really need to get this done.
<<

hayabusa

User avatar

Hero Member
Hero Member

Posts: 1662

Joined: Mon Jan 29, 2007 2:59 pm

Post Mon Jul 05, 2010 6:55 pm

Re: NT Hash Decode

@Marcos_NJ - Boot the box to live Backtrack or Samurai cd / dvd, browse the drive(s) and get your data off of it...
~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH

Return to Other

Who is online

Users browsing this forum: No registered users and 1 guest

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software