Pwdump

pwdump is the name of various Windows programs that outputs the LM and NTLM password hashes of local user accounts from the Security Account Manager (SAM) database and from the Active Directory domain's users cache on the operating system.

It is widely used, to perform both the famous pass-the-hash attack, or also can be used to brute-force users' password directly. In order to work, it must be run under an Administrator account, or be able to access an Administrator account on the computer where the hashes are to be dumped. Pwdump could be said to compromise security because it could allow a malicious administrator to access user's passwords.[1]

History

The initial program called pwdump was written by Jeremy Allison. He published the source code in 1997 (see open-source).[2] Since then there have been further developments by other programmers:

  1. pwdump (1997) — original program by Jeremy Allison.[3]
  2. pwdump2 (2000) — by Todd Sabin of Bindview (GPL), uses DLL injection.[4]
  3. pwdump3 — by Phil Staubs (GPL), works over the network.
    • pwdump3e — by Phil Staubs (GPL), sends encrypted over network.
  4. pwdump4 — by bingle (GPL), improvement on pwdump3 and pwdump2.
  5. pwdump5 — by AntonYo! (freeware).
  6. pwdump6 (c. 2006) — by fizzgig (GPL), improvement of pwdump3e. No source code.
    • fgdump (2007) — by fizzgig, improvement of pwdump6 w/ addons. No source code.
  7. pwdump7 — by Andres Tarasco (freeware), uses own filesystem drivers. No source code.
  8. pwdump8 — by Fulvio Zanetti and Andrea Petralia, supports AES128 encrypted hashes (Windows 10 and later). No source code.[5]

Notes

  1. ^ "LSASS Memory - Red Canary Threat Detection Report". Red Canary. Retrieved 2023-12-11.
  2. ^ Allison 2012 see pwdump.c
  3. ^ Allison 2012.
  4. ^ SecuriTeam.com 2017.
  5. ^ Blackmath 2019.

References


Stub icon

This security software article is a stub. You can help Wikipedia by adding missing information.

Content Disclaimer

Informasi ini disarikan dari Wikipedia dan disajikan kembali untuk tujuan edukasi. Konten tersedia di bawah lisensi CC BY-SA 3.0. Kami tidak bertanggung jawab atas ketidakakuratan data yang bersumber dari kontribusi publik tersebut.

  1. The information displayed on this website is sourced in part or in whole from Wikipedia and has been adapted for the purpose of restating it. We strive to provide accurate and relevant information, however:
  2. There is no guarantee of absolute accuracy. Wikipedia is an open, collaborative project that can be edited by anyone, so information is subject to change.
  3. It is not intended to constitute professional advice. The content displayed is for informational and educational purposes only. For important decisions (e.g., medical, legal, or financial), please consult a professional.
  4. Content copyright. Wikipedia is licensed under the Creative Commons Attribution-ShareAlike License (CC BY-SA). This means that content may be reused with appropriate attribution and shared under a similar license.
  5. Responsible use. Any risk arising from the use of information from this website is entirely the responsibility of the user.