Lab

For this lab, we have obtained some password hashes and need to find out what the passwords are and what the most efficient way to get those passwords is. The applications and test data can be found in the Git repository at https://github.com/PacktPublishing/Hands-On-Ethical-Hacking-Tactics/.

*Note: These tools can be flagged by antivirus programs as malicious and removed from your system before they even get started. You can download the files and copy them to your metasploitable Windows instance and run them there for the lab.

Brute force password crack

In this part of the lab, we will use the program LCP to perform a brute force attack against a SAM database example:

1. Install LCP and run.
2. Select Hybrid Attack | Import | Import from PWDump File and browse to and select SAM.txt:

Figure 5.13 – LCP main screen

3. Record the passwords that the accounts list. Note that the guest account doesn’t have a password.
...