[Full-disclosure] Tool release: extract Windows credentials from registry hives

[wac]

"Two Things Infinite: The Universe and Human Stupidity"
Albert Einstein

Google
Error


Forbidden
Your client does not have permission to get URL
/files/creddump-0.1.tar.bz2 from this server. (Client IP address:
xxx.xxx.xxx.xxx)

You are accessing this page from a forbidden country.


Why google code? Don't waste your time or others that want to download
and use SourceForge, Codeplex, FSF, etc. and make them loose revenue.
Is so laughable that even the license permits redistribution in the
first place and mirroring it won't be a crime. And then proxies /
bouncers / tunnels. But then why make you or your visitors loose time?
Or... maybe Google want us to make mirrors without  limitations of
it's entire website and make us get the revenue they won't ;). Let us
know google we are impatient to clone your SF takeover attempt sh...
without restrictions.


On 2/20/08, Brendan Dolan-Gavitt <bdolangavitt at wesleyan.edu> wrote:
> CredDump is a new tool implemented entirely in Python that is capable
> of extracting:
>
> * LM and NT hashes (SYSKEY protected)
> * Cached domain passwords
> * LSA secrets
>
> It has no dependencies on any part of Windows, and operates directly
> on registry hive files. It is licensed under the GPL and intended to
> be easy to read, so you can find out how various Windows obfuscation
> algorithms work by reading the code. (I will also be posting a series
> of articles explaining the algorithms in detail on my blog in the
> coming weeks).
>
> You can download the tool at:
> http://code.google.com/p/creddump/
>
> Or read a more detailed introduction at:
> http://moyix.blogspot.com/2008/02/creddump-extract-credentials-from.html
>
> CredDump is based on the hard work of many people, so please to read
> the credits section in the README.
>
> Cheers,
> Brendan
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>