Here we are in our lab and we have Kali opened up and we're using the tool Offcrack and you can see
already that I have a folder here and I kind of want to explain this real quick. On my personal
desktop I have the VM of Windows XP that you see here and I brought this up in the previous skill.
Well there's a couple of users on here and we're going to be using Offcrack to see if we can use
a rainbow table from the link above to crack the other user's password on this Windows XP system.
In order to do this you have to export the SAM and security registry hives and I've done so for you
already inside of this XP folder on the lower right of the desktop. Right next to that is an
Offcrack XP tables folder as I zoom in for you right there and that's where the rainbow table for
XP free is. Now we're going to open up Offcrack and there's a couple different ways you can do
this. You can start by going to just hitting start and typing in Offcrack or you can go to
the credential access subfolder in the start menu and see if I can zoom in for you real quick.
There you go and you can see it listed in there along with a bunch of other tools
some of which we will get into in the skill. So we're going to select Offcrack
and it's going to take just a second to open up. There we go. Now there's a couple different
things that we have to do in order to get started with this. First we have to load our cables and
that's represented by simply just the tables icon there in the middle on the top. So when we click
that we can go to XP free fast and we can click on install. This is where you point to the folder
on the desktop called Offcrack XP tables. So desktop, Offcrack XP tables, XP free fast and
it's in there. We'll just click open. You can see that it's identified the folder. We also have free
small. So if I go in this folder real quick, you can see free small, XP German, XP special. So we
can load all those up real quick. So next one is free small. We'll click on install, go up a table,
free small and just click open. And then in special install, go up a table or a folder and
click on special and click open. And in German V1, I believe it's V1. We'll just do it there
just in case. And if you haven't figured out that the folks that made this are German,
click on open. Oh, it was number two. That's okay. So now that we have all those installed,
you can see that they're green as in enabled. You can expand them. You can see the different
tables in there as well. And we're going to also click on the green button or click on the green
button to make sure that they are enabled, but also click okay. You can see that the status is
inactive right now. The next thing we need to do is load the SAM and security registry hives from
the XP system that I've imported for you already. Now this is on the actual desktop. This is the
folder right here with the two registry hives in there for you. And I'm going to move Ofcrack
over just a little bit and show you that it is right on the bottom right next to Ofcrack to the
left labeled XP. So you just simply go to load and you have a couple of options in here. First,
you have a single hash. You can input your own hash that you've exported. Let's say you got it
from a Cisco device or a shadow file, or you can do a password dump file or a session file,
or what we're doing in encrypted SAM. So we're going to select encrypted SAM,
go up to our desktop and select the XP folder and click on open. Now right here, you can see
that all the users of that Windows XP system have been identified. I'm going to leave this
zoomed in for you just a second. We have administrator, three disabled, Eric and author
Dent. Now, if I zoom out and I'm going to pop over to my Windows XP system real quick,
and I'm going to go open up MMC. And you could see inside of my Windows XP system here locally
that in users, I have administrator, author Dent, Eric, and those three disabled ones,
guest help assistant, and a support. Those are default Windows accounts that are added
that are already disabled by default as well. But we're taking a look and comparing the fact
that we can see all the users listed inside of off crack that came from our registry.
So popping back over to the lab real quick, we can go in and click on crack.
Now, right away, you can see that they're preloading the tables in RAM, and this is
going to take a little bit. So I'm going to kind of jump ahead to when this is complete,
because what it's doing right now is it's going through a brute force attack, a preload,
and identifying if passwords have been found. And when this is done, I'll zoom in on the time
elapsed for you as well to show you how long this actually took. You can see that the progress is
starting to slowly load in there, and we're going to see if we can actually get the passwords to
identify themselves. One thing I also want to show you as well, too, is that the NT hash and LM
hashes have been identified as well. And these will pop up in other rainbow tables, and you may
have noticed that we have a website that we can go to to reverse engineer in LM and NT hashes.
We may do this momentarily, but as I move over and select the author DENT user right here and
zoom in for you, you can see that while I was rambling on, it's already found the password
using those rainbow tables. So P at $$WORD. Now, you notice that it's all uppercase and LM and LM2,
but the NT password is what we're looking at, and that is the full complete password with the actual
upper and lowercase case sensitivity on it as well. So that's the actual password of the user
from that Windows XP system just by simply using the encrypted SAM file. But if it didn't pick up
there, and let's say your rainbow tables aren't expansive enough, you can actually take the LM
and NT hash as I move over for you again real quick. There we go. And you can take these two
hashes right here and find whichever reverse engineering website you choose to be able to go
do LM or NT hash reverse engineering. Now, I'll put the link for this site below, but as you can
see, I just went ahead and did the enter password here, which is the one we got from author DENT.
And as I zoom in, you can see the LM hash starts with B010. And if I pop back over to the lab real
quick, you can see that right here, B010. So LM and NT hashes have been reverse engineered,
and the algorithm has been determined. As long as you can get your hands on them,
there is a way for you to be able to reverse engineer that password either by rainbow tables,
password spraying, brute forcing, or reverse engineering through somebody else's work,
which is not cheating.