How to recovery passwords from Windows NT

Today i back to think in the past, when some friends asked me how to break Windows NT passwords, i thought that they could find tools to do it, some tried use a pure brute force and didn't got any good success, some did, but a long time ago was a better way to do it, using the rainbow table.

As you know the passwords on many systems are stored like hash, if the password has almost the same size of the hash you will have more success to recover, but if you think that the password has a bigger size, you will get so much collisions, that is very simple to understand, the hash has one fixed size and no matter whats the size of what you use like an input, the function always will generate the output in the same size.So you think, your password is something like 400 bytes, the hash have always 64 bits of size, there you go:

(your pwd) => 2^(8*400) = the number of combinations that you have with 400 bytes

(hash) => 2^64 = the number of combinations that the hash can hold

I don't need to tell you that for represent something more than 2^64 will generate same "identifications", think about 2^65 ((2^64)*2), the half of values will be collisions, in other words each "identification" can represent 2 different values.

However for each algorithm somethings like the forecast of the collisions would appear distinct from each other.

Well, if you want to know more about hash, here is a link:

http://en.wikipedia.org/wiki/Cryptographic_hash_function

Lets back to the LM hash:

http://en.wikipedia.org/wiki/LM_hash

size: 16 bytes(string)

Windows Passwords:

size: 15 characters long(OEM)

Here we have a good success rate.

The tool:

-------------------------------------------------------------------------------------

Image .iso

http://lasecwww.epfl.ch/~oechslin/projects/ophcrack/

Author: Dr Philippe Oechslin

-------------------------------------------------------------------------------------

Testing

If you want test with a VM like i did.

In Virtual PC:

Menu Bar >> Capture ISO Image... >> ophcrack-livecd-1.2.2.iso

Choose VESA Mode, and just look :)

-------------------------------------------------------------------------------------