Summary

In this chapter, we covered the fundamental theory behind Windows passwords and their hashed representations. We looked at both raw hashes as they're stored in the SAM and encrypted network hashes. We then reviewed the fundamental design flaws that make Windows hashes such a lucrative target for the pen tester. The Metasploit Framework was introduced for the first time to demonstrate auxiliary modules; we used the SMB listener module to capture authentication attempts from misled Windows targets on the network. We then demonstrated a type of link-local name service spoofing that can trick a target into authenticating against our machine as well. With the captured credentials from our demonstration, we moved on to practical password cracking with John the Ripper. We covered the two primary methodologies of password cracking with John and demonstrated ways to fine-tune...