RE: ntds.dit, john and pwdump2

["Beauford, Jason" <jbeauford () EightInOnePet com>]

Here's an IDEA:  Since this is the Active Directory Database, could you
set up your own DOMAIN CONTROLLER, replace your DIT with this DIT?
Maybe it will replicate the data and give you access to its contents.

I have no idea if this will work for you, but it would be interesting to
try.

JMB

-----Original Message-----
From: Dave Dyer [mailto:ddyer () ciber com] 
Sent: Thursday, January 20, 2005 1:28 PM
To: security-basics () securityfocus com
Subject: ntds.dit, john and pwdump2


Hello List,

I am cracking a password file for a client, and have a copy of the
NTDS.DIT file from a domain controller (win2k/Active Directory). We do
not have access to L0phtcrack currently, and I'm on a deadline. I was
going to use John the Ripper with some plugins written by 3rd parties to
crack the password file, but apparently the NTDS.DIT file isn't really a
hashed file that John can read

After some research, I found that you can use PWDUMP2 to actually export
the user/pw information on the DC to a hashed file that you can then
crack with John (even if syskey is used after SP2). However, in order
for PWDUMP to work, you have to run it as an administrator from the DC
itself, where it injects its own .dll into the lsass.exe process, which
I no longer have access to. My question is this:

Does anyone know if there is a way to extract the user/pw information
from the NTDS.DIT file (rather than from lsass.exe on the server) into a
hashed file that I can then crack with John?

If not, does anyone have any other suggestions on what I can do with
this NTDS.DIT file to crack it?

Thanks in Advance,

dave

***********

Dave Dyer

<mailto:ddyer () enspherics com <mailto:ddyer () enspherics com> > 

"So you'll bring experts in to water the company's plants but you'll do
the security thing yourself?"

-QinetiQ in the Financial Times