Windows This presentation is an amalgam of presentations by Mark Michael, Randy Marchany and Ed Skoudis. I have edited and added material. Dr. Stephen C. Hayne

Service Packs and Hot Fixes Hot Fixes Upgrades to fix specific problems Such as programming flaws Service Packs Upgrades to fix problems within Windows Like security flaws Such as IP spoofing Contain a number of Hot Fixes

Domains And File Sharing Domains – Grouping Machines Together PDC – Primary Domain Controller Contains information about user accounts BDC – Backup Domain Controller Emergency copy of the PDC File Sharing – Accessing Resources across the Network \\xxxxx\zzz Where xxxxx is the computer name, and zzz is the shared folder Use $ after the name of the folder to make it hidden

User Groups Local Groups Administrators (Local) Account Operators Server Operators Backup Operators Print Operators Replicator Users Guests Global Groups Domain Administrators Domain Users

Windows File Systems FAT Standard file system Offers no access control NTFS Has many more different access permissions Makes securing files easier Most importantly, DOS can not view NTFS partitions

NTFS Permissions Standard Permissions No Access User can’t do anything Read User can read and execute Change User can read, write, execute, and delete Full Control User can change permissions for other users, Take Ownership, and have full access Special Permissions Read only Execute Write Delete Change Permissions Take Ownership

Windows Security Local Security Authority (LSA) Determines whether a logon attempt is valid Security Accounts Manager (SAM) Receives user logon information and checks it with its database to verify a correct username/password SAM Database Stores the LM and NT password hashes

Windows Passwords LM Password Used for backward compatibility Stores passwords in CAPS Much easier to crack than NT Hashes Password is not hashed or encrypted Broken up into 2 groups of 7 characters Usually gives away the NT password if cracked NT Password Used for compatibility with Windows NT/2000 systems Stores password exactly how they were entered by the user Uses a series of 2 one way hashes to hash the password Does not salt passwords like Unix

Windows “NT” Passwords Length Anywhere from 0 to 14 characters Characters All letters (upper and lowercase), numbers, and symbols are acceptable Stored in SAM database \WINNT\system32\config or \WINNT\repair …

NT Passwords 1. Hashed using RSA MD4 function Not reversable! But can be replicated… 2. Hashed again using MS function into SAM Reversable and fairly simple 3. Encrypted using Syskey function Strong encryption of SAM on disk

LM Passwords VS. NT Passwords An 8 character LM password is 890 times easier to crack than an 8 character NT password A 14 character LM password is 450 trillion times easier to crack than a 14 character NT Password 450 trillion = 450,000,000,000,000

Password Reset Offline NT Password & Registry Editor

Active Directory All important Based on Lightweight Directory Access Protocol an extensible, vendor-independent, network protocol standard -- it supports hardware, software, and network heterogeneity for any kind of data

LDAP (Active Directory)

Active Directory Creates a a hierarchy of trusted Organizational Units User profiles are verified with controlling server and can be set up to “roam” (huge data transfers) Passwords stored in “ntdis.nit” database or in SAM file (regular OS)

Windows Cracking Obtain copy of SAM and run L0phtCrack BUT – can’t get “real” SAM if system uses Active Directory UNLESS, use PWDUMP3 first…

NTFSDos and SAMDump NTFSDos Utility that allows DOS to view NTFS partitions Can be placed on a boot disk and used to access files that can’t be accessed in Windows SAMDump Utility that “dumps” the password hashes in the SAM database Can be used to view the password hashes or to export them into a text file If Syskey is used, displayed hashes will be incorrect

PWDump3 A utility similar to SAMDump Grabs password hashes from memory instead of the SAM database Because of this, it will work with Syskey enabled Can only be used by the Administrator on each system

L0phtCrack Uses Dictionary, Hybrid, and Brute Force attacks on password hashes Can get password from a local machine, a repair disk, a copied SAM file, or over a network (By sniffing packets) Can only be used by users who have Administrator status Uses a built in version of PWDump3 to access the password hashes from memory

Password Protection 1. Remove permissions from the “repair” file 2. Audit Password Registry Keys 3. Use a strong Admin password and DON’T share it! 1. characters – increases key space 100 times 2. Possibly add characters from [Alt+###]

Security Administrative Settings Local Security Policy – when unjoined… Disable weaker LM authentication if no 95/98 machines on network “runas” utility Kerberos! EFS (DES) doesn’t apply across the net EFS

Un*x Cracking Obtain “John the Ripper” Run against /etc/passwd file