{"id":471,"date":"2012-03-23T14:24:49","date_gmt":"2012-03-23T14:24:49","guid":{"rendered":"http:\/\/www.phillips321.co.uk\/?p=471"},"modified":"2012-03-23T14:29:11","modified_gmt":"2012-03-23T14:29:11","slug":"cracking-lm-hashes-with-rainbow-tables","status":"publish","type":"post","link":"https:\/\/www.phillips321.co.uk\/2012\/03\/23\/cracking-lm-hashes-with-rainbow-tables\/","title":{"rendered":"Cracking LM hashes with rainbow tables"},"content":{"rendered":"

So you’ve got a hash and you want to crack it. We’ve already covered a quick way to get to a windows password here<\/a> but in that example we simply used john the ripper<\/a> to crack the password… but what if john is taking ages? Step in rainbow tables.<\/p>\n

I wont go into detail of what Rainbow tables are as they are already well documented on the web<\/a> but as a quick summary they are simply pre computed hashes stored in usually large tables in order to tradeoff the CPU\/storage issue computers are always up against.<\/p>\n

Lets just say we have the hash:<\/p>\n

1
<\/div><\/td>
Administrator:500<\/span>:1d9321d6da8213bdc4482861fc3ea9db:80290fc9b3c2b233769aa9d6ced8bc86:::<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

The first, and most common tool, that we’ll use to perform the cracking is ophcrack<\/a>. It’s easy to install, on debian boxes it’s as easy as apt-get install ophcrack<\/em>(you’ll need the correct repository).<\/p>\n

Once you’ve got ophcrack install you’ll also need to download the rainbow tables for it, they can be found here<\/a>.<\/p>\n

Simply load it up and click the tables icon, you then need to click install in order to load your tables (XP free fast and XP free small):
\n\"\"<\/a>
\nThen click Load–>Single Hash:
\n\"\"<\/a>
\nThen it’s as simple as clicking Crack<\/strong>, if the password is found it’ll be displayed as such, simple!
\n\"\"<\/a><\/p>\n

The next tool on the list is rcracki (or rcracki_mt as it’s now known).<\/a> This tool is to be used with the rainbow tables provided on freerainbowtables.com<\/a>. The tables are pretty large and for LanManager hashes like we’ve got here you have 2 options:<\/p>\n