Login
Login

pwdump

{{Short description|Security auditing tool for Windows}}

{{lowercase title|title=pwdump}}

pwdump is the name of various Windows programs that outputs the LM and NTLM password hashes of local user accounts from the Security Account Manager (SAM) database and from the Active Directory domain's users cache on the operating system.

It is widely used, to perform both the famous pass-the-hash attack, or also can be used to brute-force users' password directly. In order to work, it must be run under an Administrator account, or be able to access an Administrator account on the computer where the hashes are to be dumped. Pwdump could be said to compromise security because it could allow a malicious administrator to access user's passwords.{{Cite web |title=LSASS Memory - Red Canary Threat Detection Report |url=https://redcanary.com/threat-detection-report/techniques/lsass-memory/ |access-date=2023-12-11 |website=Red Canary |language=en}}

History

{{more citations needed section|date=June 2023}}

The initial program called pwdump was written by Jeremy Allison. He published the source code in 1997 (see open-source).{{harvnb|Allison|2012}} see pwdump.c Since then there have been further developments by other programmers:

  1. pwdump (1997) — original program by Jeremy Allison.{{sfn|Allison|2012}}
  2. pwdump2 (2000) — by Todd Sabin of Bindview (GPL), uses DLL injection.{{sfn|SecuriTeam.com|2017}}
  3. pwdump3 — by Phil Staubs (GPL), works over the network.
  4. *pwdump3e — by Phil Staubs (GPL), sends encrypted over network.
  5. pwdump4 — by bingle (GPL), improvement on pwdump3 and pwdump2.
  6. pwdump5 — by AntonYo! (freeware).
  7. pwdump6 (c. 2006) — by fizzgig (GPL), improvement of pwdump3e. No source code.
  8. *fgdump (2007) — by fizzgig, improvement of pwdump6 w/ addons. No source code.
  9. pwdump7 — by Andres Tarasco (freeware), uses own filesystem drivers. No source code.
  10. pwdump8 — by Fulvio Zanetti and Andrea Petralia, supports AES128 encrypted hashes (Windows 10 and later). No source code.{{sfn |Blackmath|2019}}

Notes

{{more citations needed|date=June 2017}}

{{reflist}}

References

  • {{cite web |last=Allison |first=Jeremy |title=Index of /pub/samba/pwdump |website=Samba |date=30 September 2012 |url=http://samba.org/samba/ftp/pwdump/ |access-date=15 June 2017}}

  • {{cite web |last=Sabin |first=Todd |title=New version of PWDump2 allows dumping of password hashes Active Directory |website=SecuriTeam.com | date=1 February 2017 |url=http://www.securiteam.com/tools/5ZQ0G000FU.html | ref={{sfnref|SecuriTeam.com|2017}} |access-date=15 June 2017}}

    • {{cite web | title=pwdump8 | date=15 May 2019|website=forums.hak5.org|url=https://forums.hak5.org/topic/46130-pwdump8/ | ref={{sfnref |Blackmath}}}}

    Category:Windows security software

    Category:Cryptographic attacks

    Category:Free security software

    Category:Command-line software

    {{Security-software-stub}}