Re: OT - Password Cracking Program

* Chuck Lewis <clewis@iquest.net> [2002-10-03 12:55 -0500]:
> Acquired a new company and they have NO IDEA what the Admin passwords are on
> their NT/2000 PC's...
>
> Is anyone using one of the products that can crack these ?

Two that I've used in the past are L0phtCrack, which runs under Windows,
and John the Ripper, which runs in Linux (and other Unices).  I'm not sure
if either of them works without knowing at least one admin password,
though.  (I've used them at work to test our users' passwords and have
just gotten the last of hashed passwords from my account, which has
Administrator rights.)

John the Ripper may be found at <http://www.openwall.com/john/>.
L0phtCrack is at <http://www.atstake.com/research/lc/>.

A little while back, I used John the Ripper to automatically convert the
passwords on one Linux box here from old-style DES-based crypt to MD5
hashes.  It was kind of depressing how many of the passwords it found.