‫Now, this is a typical Windows local hash.
‫The columns are separated by colons.
‫The first column is the username.
‫Second field is the user I.D. It can be thought of as a user group.
‫500 is for the administrators, five zero two ideas for the Kerberos accounts, et cetera.
‫The third field is the Elim hash and the fourth is the a.T.M hash.
‫As you saw on the previous slide, two different hashing methods exist in a local Windows password hash
‫table, L.M. hashes and Indium hashes.
‫Yelm hash is a very weak one, wavefunction used for storing passwords originally invented for the land
‫manager operating system.
‫But the Elim hash was included in Windows and T for backward compatibility, and it's still included
‫for backward compatibility.
‫However, it is disabled by default since Windows Vista and Windows Server 2008.
‫So let's see the properties of these methods comparatively.
‫Both types of hashes generate a 128 bit stored value, the M Hash has a limited character set of only
‫140 characters, while the Hash supports almost the entire Unicode character set of 65000 536 characters.
‫While L.M. allows cyphers up to 14 characters in length, Nehalem allows cyphers up to 256 characters
‫in length.
‫Well, you can specify a password consisting of more than 14 characters, but the L.M. algorithm takes
‫only the first 14 characters of the password into account.
‫And moreover, while until Masche calculates the hash based on the entire password the user entered,
‫the Yelm hash splits the password into two seven character chunks.
‫Padding is necessary.
‫That means you will crack to seven character passwords instead of one 14 character password.
‫It makes it dramatically easier to crack L.M. hashes.
‫Now, furthermore, L.M. hashes are case insensitive.
‫The password you specified is converted to all uppercase and then the hash is calculated.
‫Let's give an example for the algorithm, suppose that you specified a password as my secret password
‫with some uppercase and lowercase characters and the L.M. hashes are active in that system.
‫The system first converts all characters to uppercase.
‫Then it splits the password into two seven character chunks, ignores the 15th and the following characters.
‫So here we have Amawi s, e, c, r, e and T, Piast W o strings, and the hard part is ignored.
‫Unless the harsh realities of these parts are calculated.
‫You can crack a seven character length password in seconds, that means you can crack any L.M. hash
‫in minutes as a result, never, ever enable L.M. hash algorithm and Windows systems.