Decoding NTLM passwords (+ catching worms)

[Petr Kazil]

Hi, I have a testmachine running on the Internet without a firewall (on
purpose). Every evening I start getting a lot of failed logon's to my
accounts (Administrator, krbgt, IUSR etc.). My guess is that: hackers come
home from work and start hacking - or - innocent users come home and switch
on their infected machines.

Question 1:

Using _windump_ and _ethereal_ I can trace this traffic to port 445 and many
different IP adresses. These must be worms, trojans or scripts since I get
many logon attempts every second. That's too fast for manual hacking.

Using _ScoopLM_ I can filter out the challenge, lm-response and ntlm
response. But what tool could I use to get the passwords that these entities
are trying against my machine? I would like to know what kind of
dictionaries they are using.

Since this is just "fooling around" I cannot afford the 100+ dollars for
Lophtcrack, and I don't even know if that would do the trick. Any
suggestions?

Question 2:

If I want to catch a live worm, what is the common procedure? I could share
a directory and then write a script that scans the directory every minute or
so. As soon as a file appears in the directory I could reset the share or
file permissions or block the network traffic (I guess a lot is possible
with WMI). But probably there are more elegant and intelligent solutions.

(Note: Snort doesn't seem to work on this machine, it's an old laptop with a
Xircom Cardbus. Snort and nmap don't seem to work with this PCMCIA network
interface.)

 

[Petr Kazil]

You can try using Cain & Abel

http://www.oxid.it/cain.html

Thanks, this looks very promising and I'm going to try it out.
At the moment I'm running _BeatLM_ to crack the hashes. It works but it's no
so quick.

You can simply open up your PC by setting the administrator password
to nothing

Sounds easy enough

A much better approach is to use a honeynet configuration that allows
you to block certain outgoing requests from your PC

Yes. I don't have a firewall to spare, nor a dual homed PC, but I guess I
might do the trick using IPSEC filtering.

Take a look here: http://honeynet.org/

I know them. That's the site that inspired me to start playing with these
ideas.

One such program that runs on windows can be found here:
http://www.securityprofiling.com/honeyd/honeyd.shtml

I'll take a look, but I'm afraid it won't work with a laptop + pcmcia card.
That's all I have. I got two old laptops from work to play with and they
don't have on-board network cards.

 

[Petr Kazil]

You can try using Cain & Abel

http://www.oxid.it/cain.html

After some wild fiddling it works like a dream.
But I had to make a shorter dictionary using the common passwords used by
worms, otherwise it took too long. Using a dictionary with 900 common
passwords it decodes about 25% of them. Nice!