Once a user has been authenticated via logging in, they have a token associated with processes they are running. One of the issues with the Microsoft Windows account access mechanisms is that they use a token-based model to handle user authorization tasks. crashing the system or sending up confusing alerts, but not typically stopping the activity). It also handles starting and stopping anti-virus applications, which can cause issues during this type of activity (e.g. FgDump is a wrapper application which pulls together our version of PwDump, in addition to several password-related utilities (e.g. To extract a system’s password database, I tend to rely on our FgDump application. This password database entry contains the older LAN Manager Network Protocol (LM) and NT LAN Manager (NTLM) encrypted hash for the account. The encryption schemes used are one-way, or non-reversible, meaning that this data cannot be decrypted through simple means. Microsoft Windows stores user passwords in the system’s password database (called “SAM”) in an encrypted hash. This page focuses on two specific areas: LM/NTLM password hashes (what tools like FgDump extract) and LM/NTLM challenge/response hashes (the actual authentication exchange performed over a network). The following is a brief overview of the code I’ve developed for this work and some of the tricks to using it. This work includes password hash extraction, cracking of the hashes, and using them as-is.

Crack lm hash nt hash decrypt