Collecting Windows password hashes
Windows password hashes take a few different forms. The two hashes that are stored on almost every Windows device to authenticate a local user are the LAN Manager (also known as LANMAN) hash and the NT hash.
The LANMAN hash represents – unfortunately – some of the worst password hashing that can be available in a modern operating system. The good news is that LANMAN hashing is disabled by default in newer Windows operating systems (Windows 7 and higher). However, it is worth discussing LANMAN because it is still enabled on some systems for backward compatibility, and it makes cracking passwords monumentally easier. Why?
It has to do with how the original password is stored and treated. As you will remember from Chapter 1, the more characters available to a given position in the password, the greater the possibilities for the correct character for that position – also, the longer the password, the greater the number of combinations...
