Any free tools better than Ophcrack?

For password recovery that is. I've used the free tables to no success so far and was hoping someone here might know of another tool that would do the trick. The host uses win7.

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

shaqazoolu

Ophcrack isn't the problem. Your tables are.

docrice

Lots of free tables if you know where to look. The ones that come bundled with the tools aren't always very large.

it_consultant

This is the best one I use:

Offline NT Password & Registry Editor

It isn't a password cracker as much as it gives you the ability to blank out an account password, which is just as useful. The download is 3 megs, which is nice.

Devilsbane

it_consultant wrote: »

It isn't a password cracker as much as it gives you the ability to blank out an account password, which is just as useful. The download is 3 megs, which is nice.

Not always just as useful. Blanking a password can corrupt files, especially encrypted ones. Plus, since people often recycle passwords, cracking a windows password might also get you an email password.

it_consultant

I have used that tool countless times and have yet to corrupt a file. Of course, this is only good for Windows local passwords so if you use linux with SALT then this thing wont do it for you.

Devilsbane

Just stumbled across this.

5 ways to crack or reset a forgotten Windows XP administrator password

gorebrush

Konboot gets me into Windows machines in mere minutes.

docrice

I guess one question I should pose is this: is this exercise to actually recover a password or simply reset a password to get into a machine? Resetting it may cause problems in accessing EFS-encrypted files if the DRA information is lost as well.

slye

docrice wrote: »

I guess one question I should pose is this: is this exercise to actually recover a password or simply reset a password to get into a machine? Resetting it may cause problems in accessing EFS-encrypted files if the DRA information is lost as well.

Thanks guys, I'll give kon-boot a try. I'd like to recover the password, but since nothing is encrypted resetting it may be another option. As far as tables go, I'd need a table that is 15 charcters upper and lower case, numeric, special case and ALT + #. I'm thinking ophcrack is not the answer in this case.

eansdad

Have you tried using a rainbow table generator to generate the table you would need or are you using a generic table?

slye

eansdad wrote: »

Have you tried using a rainbow table generator to generate the table you would need or are you using a generic table?

No, what do you recommend for a primer on rainbow tables? I like to learn more about them.

Gorebrush- I visited the kon-boot website and followed the instructions but everytime I've used unetbootin to put the iso/img on a usb, then boot from the USB the system tells me that bootmgr is missing. I thought booting from the usb would be the same as booting a linux image...

Burn ISO Image to USB Flash Pen Drive (Kon-Boot to USB) | Raymond.CC Blog

jahsoul

slye wrote: »

No, what do you recommend for a primer on rainbow tables? I like to learn more about them.

Gorebrush- I visited the kon-boot website and followed the instructions but everytime I've used unetbootin to put the iso/img on a usb, then boot from the USB the system tells me that bootmgr is missing. I thought booting from the usb would be the same as booting a linux image...

Burn ISO Image to USB Flash Pen Drive (Kon-Boot to USB) | Raymond.CC Blog

What I did was download Hiren's (which has Kon-Boot) and then used multiboot iso. But I had to change the menu.lst

*Example*
title Hiren's Boot CD 11.1
find --set-root /Hiren's.BootCD.11.1.iso
map /Hiren's.BootCD.11.1.iso (hd32)
map --hook
chainloader (hd32)
boot

I know it's not unetbootin but it's gives me options if I want to run an OS, Acronis, or Hiren's...

themagicone

slye wrote: »

No, what do you recommend for a primer on rainbow tables? I like to learn more about them.

Gorebrush- I visited the kon-boot website and followed the instructions but everytime I've used unetbootin to put the iso/img on a usb, then boot from the USB the system tells me that bootmgr is missing. I thought booting from the usb would be the same as booting a linux image...

Burn ISO Image to USB Flash Pen Drive (Kon-Boot to USB) | Raymond.CC Blog

You need to make the usb disk bootable... One sec...

How To make Bootable USB

Devilsbane

Where do you guys suggest that I look to find more tables? Free/cheap is always a plus.

Devilsbane

slye wrote: »

No, what do you recommend for a primer on rainbow tables? I like to learn more about them.

A rainbow table is basically a list of passwords that have already been encrypted. So rather than spending time going through a list of passwords, encrypting them, and then comparing, you can save a ton of time just by comparing the results. Once a match is found, you know what the password is.

Of course it is all more complicated than that. Try this on for size. Rainbow table - Wikipedia, the free encyclopedia

Heero

Devilsbane wrote: »

A rainbow table is basically a list of passwords that have already been encrypted. So rather than spending time going through a list of passwords, encrypting them, and then comparing, you can save a ton of time just by comparing the results. Once a match is found, you know what the password is.

Of course it is all more complicated than that. Try this on for size. Rainbow table - Wikipedia, the free encyclopedia

I used to think that, but then you realize it is way more complicated than that. Storing password-->hash combinations is simple, rainbow tables do it in a very complicated way that improved efficiency, but generally there is a size/time to crack trade off when it comes to the actual table.

eansdad

Devilsbane wrote: »

Where do you guys suggest that I look to find more tables? Free/cheap is always a plus.

Winrtgen from oxit.it isn't bad for free. Most AVs will pick it up so you'll need to use a VM to use it.

shaqazoolu

I've had pretty good success with Ophcrack with the 8GB tables. I don't know what the character limitations on it are but I've cracked some pretty ugly, random looking passwords with it. That's why I say I don't think Ophcrack is the problem.

What you could do is just get a couple of GTX295's in SLI and straight brute force them with a CUDA cracking tool...if you had time and money to burn of course.

I'm pretty sure some of the CUDA tools are also capable of doing salted SHA-1 hashes too.

alan2308

Devilsbane wrote: »

Where do you guys suggest that I look to find more tables? Free/cheap is always a plus.

Free Rainbow Tables » Distributed Rainbow Table Generation » LM, NTLM, MD5, SHA1, HALFLMCHALL, MSCACHE

It's a distributed computing project (like SETI or Folding@Home), so the bundle is always growing. Right now they have nearly 2TB available. Buy a loaded hard drive or grab a torrent off of the site.

slye

gorebrush wrote: »

Konboot gets me into Windows machines in mere minutes.

Thanks! I got it to blank the admin password and get in and start installing updates.

gorebrush

slye wrote: »

Thanks! I got it to blank the admin password and get in and start installing updates.

That's the way

SephStorm

shaqazoolu wrote: »

What you could do is just get a couple of GTX295's in SLI and straight brute force them with a CUDA cracking tool...if you had time and money to burn of course. I'm pretty sure some of the CUDA tools are also capable of doing salted SHA-1 hashes too.

^ this I would like to see a tutorial on, and

Winrtgen from oxit.it isn't bad for free. Most AVs will pick it up so you'll need to use a VM to use it.

Why would anti virus pick up a hash generator?

myedjo24

I used to like to use ERD Commander 2005 for password recovery. I don't know what happened to them, but I think it's part of Microsoft now (or always has been?). IDK. Haven't really needed something like ERD in awhile.

gosh1976

Hiren's BootCD worked a charm on a windows 7 box for me just yesterday. I just blanked the password to get in.

Devilsbane

gosh1976 wrote: »

Hiren's BootCD worked a charm on a windows 7 box for me just yesterday. I just blanked the password to get in.

What version do you have? I think I have version 9.8, and I booted up into mini xp mode a couple months ago intending to run a chkdsk on my C: drive, but it wasn't able to see any of my drives.

Also, which tool did you use to do that?

Devilsbane

SephStorm wrote: »

Why would anti virus pick up a hash generator?

Because the antivirus program is attempting to protect your PC. There are very few people who would have this on their machine. For the mass majority of people, having a password cracking tool on their computer means that someone is attacking them.

Most will pick up johntheripper, netcat, and other tools with legitimet uses.

gosh1976

Devilsbane wrote: »

What version do you have? I think I have version 9.8, and I booted up into mini xp mode a couple months ago intending to run a chkdsk on my C: drive, but it wasn't able to see any of my drives.

Also, which tool did you use to do that?

I have version 10.6. I don't remember what the name of the tool was but it was one of the first few in the menu if I remember correctly.

Devilsbane

gosh1976 wrote: »

I have version 10.6. I don't remember what the name of the tool was but it was one of the first few in the menu if I remember correctly.

Probably time to update my tools then, I've had that disk for a year and a half or so. I think Windows 7 uses a new version of NTFS. I guess they support it now, awesome.

it_consultant

My original link supports Windows 7.

http://pogostick.net/~pnh/ntpasswd/

Mojo_666

it_consultant wrote: »

I have used that tool countless times and have yet to corrupt a file. Of course, this is only good for Windows local passwords so if you use linux with SALT then this thing wont do it for you.

+1

Been using this for many years and never had a corrupt file.