Desktop

Ask something
Discussion Locked

is there is any software?

0 helpful
6 replies

by arunagiri.s

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

i have downloaded a image file to recover the password of a system and i have done the process correctly and i got the output which is shown below as fig. finally by uploading this detail to a particular site i got the password for

Administrator nandha
Staff moorthi
Admin shree

````````````````````````````````````````````````
......fig......
VERSION:03
Administrator:500:0,4F,A5,54,63,50,2A,66,FD,AA,D3,B4,35,B5,14,04,EE:
_10,B4,CC,48,5C,03,26,30,69,17,44,B1,BD,AB,9F,D8,0862B:::

Staff:1003:0,8B,24,25,56,57,E2,40,48,AA,D3,B4,35,B5,14,04,EE:
_D1,86,76,40,A7,3B,81,A5,F9,1B,79,AA,4C,B7,0C,3C,07A4D:::

Admin:1005:0,10,20,98,5F,D6,13,DA,8F,AA,D3,B4,35,B5,14,04,EE:
_B9,F1,B6,1B,D9,04,CC,BF,7C,9E,02,CA,9D,25,B6,C0,08E40:::
`````````````````````````````````````````````````
IS THERE IS ANY SOFTWARE TO CONVERT THIS DATA IN TO OUTPUT.

6 replies

by hal 9000

What you have here is a HEX output and not a SWAG output. It's all because of the program that you used to recover the passwords.

I'm not sure if there are any HEX to ASCII converters your real solution here is to use a different Recovery Package if you don't understand HEX.

Col

by bugmenot2

The loginrecovery.com program you used has a weird format for the hashes. If you remove the 0 at the beginning and the 5-digit thing at the end, and remove all the commas, underscore, and newline, you get the regular format for the LM and NTLM hashes:
Administrator:500:4FA55463502A66FDAAD3B435B51404EE:10B4CC485C032630691744B1BDAB9FD8:::
Staff:1003:8B24255657E24048AAD3B435B51404EE:D1867640A73B81A5F91B79AA4CB70C3C:::
Admin:1005:1020985FD613DA8FAAD3B435B51404EE:B9F1B61BD904CCBF7C9E02CA9D25B6C0:::

Now you need to *crack* them. For alphanumeric passwords like the ones you have, they can be cracked instantly with the open-source Ophcrack program online:
http://lasecwww.epfl.ch/~oechslin/projects/ophcrack/
which can also be downloaded.

For more sophisticated passwords, there are other rainbow-table cracking programs with tables that you can download, as well as many online sites that will crack them for you.

by gwgokil

Hello, i have another weird format for the hashes loginrecovery.com, there is no 0 at the beginning and the 5-digit thing at the end. I'd tried another way but do not find anything, could you help me how to break this code to become regular format for the LM and NTLM hashes. Here is the code:

VERSION:04
Administrator:500:93,88,B4,08,1A,93,F0,4E,1D,3D,66,47,C8,48,A7,97,81:
_40,D9,D6,4E,B8,5C,9B,8A,1E,E0,6B,53,25,89,C7,3D,XX:::

Guest:501:3A:
_:::

HelpAssistant:1000:18,FD,DB,D8,B4,39,26,77,FB,FF,63,AA,36,CB,C2,F1,9D:
_6C,FE,C1,DA,CF,DD,19,41,36,92,EF,A6,DB,DC,2C,4F,XX:::

SUPPORT_388945a0:1002:48:
_A2,CC,48,CD,D8,2A,9C,08,D8,10,07,E8,E9,C7,44,A6,XX:::

Thanks before.

by kentaro

You can use Lr4 v1.0 to decode Loginrecovery V4 dump. I confirmed a PWDUMP entry which decoded by Lr4 v1.0 can be solved with LCP.

1. Lr4.exe is a small console based companion tool of MDCrack. You can find it on MDCrack download site.
http://c3rb3r.openwall.net/mdcrack/ln.html

2. You have to make a text file which named UPLOAD.TXT contains LoginRecovery result.

VERSION:04
Administrator:500:93,88,B4,08,1A,93,F0,4E,1D,3D,66,47,C8,48,A7,97,81:
_40,D9,D6,4E,B8,5C,9B,8A,1E,E0,6B,53,25,89,C7,3D,XX:::

3.Put UPLOAD.TXT to the same place of Lr4.exe.

4.Excute it from DOS prompt.

Lr4.exe --verbose
Lr4.exe --help

This discussion is closed to new replies.