Cracking Windows hashes

We can now use the password hashes we dumped in the previous section for legitimate authentication. However, before we do that, we still need to crack these hashes to obtain the cleartext passwords.

This section will be split into two main subsections. The first part will go over the process of cracking Windows password hashes with John the Ripper, while the second subsection will cover the process of authentication.

Before we can begin dumping and cracking password hashes, we need to take a look at the structure of a typical Windows hash.

As highlighted in the following screenshot, the hash ID is broken down into four sections:

Figure 7.24 – Hash structure

The four sections can be further classified as follows:

• The first section is the username.
• The second section is the unique RID.
• The third section is the LM hash.
• The fourth section is the NTLM hash.

Now that we understand what makes up...