Prompt

Our analysts have obtained Windows password dumps storing hacker passwords. Can you crack them?

Walk-Through

This challenge involves cracking Windows NTLM passwords. The questions for this challenge can be solved using ophcrack with the XP special wordlist.

Setting up ophcrack

When you download the XP special wordlist, it will include everything in the XP free fast and XP free lists (the ‘special’ wordlist includes special characters while the “fast” and “free” versions only use alphanumeric characters).

🚧

ALL files for a particular wordlist should be downloaded and saved to a folder with the wordlist name.

ophcrack can run on both Linux and Windows. Windows may try to block the use of ophcrack because the program functions similar to some viruses.

🚧

Be sure to check that your download file for the program matches the MD5 checksum for the latest version. For the wordlist files, use the md5sum.txt file to check that you have the correct files downloaded.

Run the ophcrack program. Select ‘Tables’. Select which table you want to use, click ‘Install’ and then navigate to the folder where you saved the wordlist. When done correctly, the red button next to the wordlist will turn green.

Guide

You can load in each hash individually using the “Load > Single Hash” option or you can save all of the hashes into a text file and then select the “Load > PWDUMP file” option to load all of the hashes at once.

Once hashes are loaded, press ‘Crack’.

Output from ophcrack after cracking is completed. The passwords have been mostly redacted. Use answers from the ‘NT Pwd’ column as these include the lowercase characters that are part of the password.

Useful resources for this challenge:

ophcrack tables: https://ophcrack.sourceforge.io/tables.php
ophcrack download: https://ophcrack.sourceforge.io/download.php
Use the Tutorial Video below

Tutorial Video

Watch our full Tutorial Video to learn more about hashed passwords, salted hashes and password cracking AND to see a walkthrough of how to solve this challenge:

NCL Summer Live - Cracking Password Hashes - Aug 19 2021

Learn tips and tools of the trade with the National Cyber League's NCL Summer Live video tutorial series. This episode covers how to approach cracking password hashes; Password Cracking is one of the 9 NCL competition categories. Franz Payer, CEO of Cyber Skyline explains the basics of what is a hash; how password hashes work; the types of hashes, including salted hashes, and various tools available to crack password hashes. He finishes up with a live demo in the NCL Practice Gym for you to follow along. The National Cyber League, powered by Cyber Skyline, is a bi-annual, all-virtual cybersecurity student competition, advancing hands-on skills and knowledge. Check the website at nationalcyberleague.org for details.

www.youtube.com

NCL Summer Live - Cracking Password Hashes - Aug 19 2021

Questions

21259DD63B980471AAD3B435B51404EE:1E43E37B818AB5EDB066EB58CCDC1823

11CB3F697332AE4C4A3B108F3FA6CB6D:13B29964CC2480B4EF454C59562E675C

65711C079DC4CD3CC2265B23734E0DAC:47F747C5190DC0F0B921AA4A07F06285

FBBDA33FC12E83FB0C240E84A183686E:DDE9DC6E34E2E6E11EF9E51C6B27ED96

21C4E7C2EFE8E8D1C00B70065ED76AA7:A7A0F9AFD4A78F531A1CF4C42E531BBF

E85B4B634711A266AAD3B435B51404EE:FD134459FE4D3A6DB4034C4E52403F16

BA756FB317B622DBAAD3B435B51404EE:C8405270B10B13AE8A24612BB853567A

199C926FA387EAB7AAD3B435B51404EE:F196F77BF8BB15781BA8364C649C5FD4

FE4AACAAAD7D986AAAD3B435B51404EE:3928E16F614E2316CA51C336FA5B3011

3613F7EC15407F56AAD3B435B51404EE:C82E164316183AA3AF3EA6BAA642A237