In the right pane, right-click p7, point to 'Brute-Force Attack', and click ' NTLM Hashes'. It should find the five-letter password within a few seconds. In the 'Brute-Force Attack' box, click the Start button. In the right pane, right-click p5, point to 'Brute-Force Attack', and click ' NTLM Hashes'. It should find the three-letter password immediately. The NTLM hashes are much more difficult to crack, so it will only work for short passwords. Note: we are cracking the NTLM hashes, not the old, weak LM hashes. If Cain won't install, you may need the fix in this video:Ĭracking Passwords In the right pane, right-click p3, point to 'Brute-Force Attack', and click 'NTLM Hashes', as shown below on this page. The LM hashes will all be the same if you are using Windows Vista or later, but the NT hash contains the password information. The password hashes appear, as shown in the figure below. In the 'Add NT Hashes from' box, click Next. Move the mouse to the center right, where a blank white pane appears with a gray grid. In the Cain window, at the top, click the Cracker tab. If a 'User Account Control' box appears, click Yes. Right-click Cain in the results and click ' Run as Administrator'. It will install WinPCap as well as Cain & Abel.Ĭlick Start, type in CAIN. Install the software with the default options.

Unzip the downloaded file with 7-Zip, using the passwordĭouble-click the installer. If that site is blocked, which it now is at CCSF, use this alternate download link: (The version number may be higher now.) Save the installer on your desktop.

Scroll down and click ' Download Cain & Abel v4.9.36 for Windows NT/2000/XP'.

Scroll down past the disclaimer and click ' Cain & Abel'.

Those commands create three new users on the system. Net user p3 abc /addnet user p5 abcde /addnet user p7 abcdefg /add In the Administrator Command Prompt window, execute these commands: 'Password must meet complexity requirements Properties'Ĭlick Start, type in CMD and press Shift+Ctrl+Enter. ' Password must meet complexity requirements'.

In Local Security Policy, in the left pane, When it finds the program, as shown below, Windows such as Windows 10 you do not need to do this. If you are using Windows Server 2008, you need to disable If you don't want to install it on your real machine, use a VM. You will need to allow it to install, which is pretty easy if you use Microsoft Security Essentials.

Cain & Abel will be detected as malware by your virus scanner.

If you want to use Windows Server 2008, you need to disable the 'Password must meet complexity requirements' policy as explained here:

A Windows machine with administrator access (real or virtual).

Project 18: Cracking Windows Passwords with Cain and Abel (10 Points)

Cain and abel latest version