Security Software Technologies, Inc.
www.securitysoftwaretech.com
Feedback and comments to lc3@securitysoftwaretech.com
![]() |
![]() |
![]() |
![]() Most Popular Vulnerability Assessment/ Password Scanners |
Welcome to LC3 - the award-winning password audit and recovery tool for Windows!
Passwords have received increasing attention as a source of vulnerability in individual machines and entire networks. Security experts from industry, government, and academia agree that weak passwords represent one of the ten most critical internet security threats.1 LC3 offers an easy-to-use and adaptable way to identify and assess password vulnerability.
LC3 is a password auditing and recovery tool for Windows 2000 and Windows NT. LC3 uses a variety of sources and methods to retrieve passwords from the operating system, and provides feedback about the strength of passwords based on the types of audit required to recover the password and the length of time required to do so. The end result is a state of the art tool for password auditing and recovery that serves to guide organizational policies and procedures.
There are many uses for auditing user passwords. First and foremost is for a system administrator to audit the strength of the passwords their users are using. Weak passwords represent vulnerability points for any organization, and uncovering these vulnerabilities is the first step toward reducing them. Administrators can use corporate password policies, and for some environments, filtered password generators to improve the quality of passwords used in their organizations. But without testing the passwords chosen by users or generated against a real world password auditor, the administrator is taking a chance at the time required for an external attacker or malicious insider to uncover the passwords.
In other cases LC3 can be used to streamline the migration or upgrading of users from one authentication system to another. Lastly, LC3 can serve to recover a lost or forgotten password to permit re-entry to a system from which an administrator is locked out.
LC3 is distributed in a self-installing executable distribution file which may be downloaded for free from www.securitysoftwaretech.com/lc3 . Launching the installation file, starts a standard installation process. The installation process creates a directory named \Program Files\Security Software Technologies\LC3, in which LC3 is installed. Start LC3 by clicking the shortcut in the LC3 program group which is added to the Start .. Programs menu.
To uninstall LC3, go to the Windows Control Panel, and open Add/Remove Programs. Select LC3 from the list of programs installed on your system, and click on Remove. LC3 will be uninstalled from your system.
LC3 provides a 15 day free trial period, during which you have access to all features with the exception of the brute force crack. Paying to register LC3 provides you with an Unlock Code which allows full and continued use of the product.
We offer online, telephone and fax registration. Please see
www.securitysoftwaretech.com/lc3
for phone/fax numbers and the online registration form.
LC3 is licensed on a per machine basis, and each machine generates a unique LC3 Serial Number. When you register, you'll be asked to provide your name, address, credit card info, email address and the LC3 Serial Number. Note this means you must download and install LC3 and obtain the Serial Number from your installation before you can register it.
To obtain your installation's Serial Number, launch LC3, and click 'Register' from the LC3 splash screen. This opens a Registration dialog that provides your Serial Number. When you register, you receive a unique Unlock Code for your installation. Enter this code in the LC3 Registration dialog to unlock the product.
If you want to reinstall LC3 on new machine or operating system, you'll need
to obtain a new Unlock Code for it. To do so, install LC3 in the new environment
and then copy the installation's new Serial Number, which you can obtain from
Help .. About or from the Splash screen that appears when you launch the
product. Then click
here to obtain an Unlock Code for your new installation.
LC3 offers several enhancements over its predecessors:
The LC3 Wizard helps you quickly configure the settings needed to retrieve and audit passwords by the most common means, and provides a quick overview of the password auditing process.
The Wizard opens by default the first time you run LC3. Those already familiar with LC3 password auditing may prefer to administer LC3 without the Wizard, and can check the 'Don't show me this wizard on startup' checkbox. If you want to check out the Wizard at a later time, you may launch it from the LC3 toolbar.
Click next to use the Wizard.
The first step is to obtain encrypted passwords to audit. The wizard's next dialog lets you choose the source of encrypted passwords.
The first and most straightforward option extracts password hashes from the machine you're currently on.
The second option attempts to retrieve them from another network-accessible machine on which you have administrator privileges. (Note: password hashes retrieved with this approach will not be cracked if SYSKEY is enabled as is the default on Windows 2000, or if it is an NT system with SYSKEY enabled ...more about that later.)
The third option retrieves encrypted passwords from an NT emergency repair disk (note: Windows 2000 Emergency Repair Disks will not provide encrypted passwords).
The final option sniffs the network for
password hashes that are traversing it.
The Quick Password Audit takes only a minute to perform and tries every word in a 26,000 word dictionary file included with LC3 to see if any words match the passwords you're examining.
Since many users comply with corporate password policies by slightly modifying dictionary words, the Common Password Crack programmatically varies the dictionary words by a chosen number of characters to see if any fit. This takes a couple minutes longer to complete.
The Strong Password Audit adds a brute force audit, trying all combinations of letters and numbers in seeking to compute passwords. This approach may take longer than a day to perform.
The Custom Audit lets you configure your audit more precisely. For example,
you can change word files or choose a different character set for the brute
force audit.
You may hide the audited passwords so that your audit identifies whether or not a password is unacceptably weak without revealing what the password is. When choose to hide audited passwords, you must use the Audit Time to determine whether or not a particular password was successfully cracked.
You may list the time required to retrieve each password, in order to have a quantitative estimate of each password's comparative strength.
If you choose 'visible notification when auditing is done,' your computer
will show an alert dialog when the audit completes, even if you're working in
another application.
Once you've finished the Reporting options, LC3 is ready to audit. The Wizard's final dialog summarizes the settings you've chosen. When you click Finish, the retrieval and audit begins.
Now let's take a closer look at some of the basic elements of password
auditing with LC3.
The operating system does not store users' passwords in their original clear-text form for security reasons. The actual user passwords are encrypted into hashed forms because they are sensitive information that can be used to impersonate any user, including the operating system administrator. The original password cannot be derived directly from a hashed password, so LC3 does what any hacker does: it guesses. By automating the 'guessing' process, LC3 reveals for administrators how tough a password is to crack.
LC3 works by first obtaining password hashes from the operating system, and then
hashing possible password values. When there's a match between a target hash and
a possible password hash, a password is found. Therefore, to do its thing, LC3
must first obtain password hashes from the target system, and then use various
cracking methods to retrieve the passwords.
There are several different approaches to obtaining password hashes, depending on where they reside, and your access to them. LC3 can obtain password hashes directly from the registry, from the file system, from backup tapes and repair disks, from Active Directory, or by recovering them as they traverse the network. This process is not always straightforward, so read carefully, below.
If you have administrator rights to the machine whose passwords you intend to audit, this is the easiest way to obtain the password hashes. Use Import .. Import From Local Machine on the LC3 menu to retrieve the hashes. This approach works regardless of whether passwords are stored in a SAM file or in Active Directory.
NOTE: LC3 is limited to dumping and opening 65K users. Large numbers of users can take a long time, so be prepared to wait a many minutes for more than than 10,000 users.
In some cases, you can dump the password hashes from a remote machine over the network if the remote machine allows network registry access. Enter the machine name or IP address into the Import from Remote Registry dialog box and press OK. The usernames and password hashes are now loaded into LC3.
Note that password hashes retrieved using this method will not be cracked if the target systems uses Microsoft's SYSKEY protection, as is the default with Windows 2000. SYSKEY adds an additional layer of encryption for stored passwords, and was introduced with the Windows NT Service Pack 3. However, installing the SP3 does not turn on SYSKEY, so very few Windows NT systems actually use SYSKEY. To obtain passwords from a remote system that uses SYSKEY, you may use the pwdump3 utility mentioned below.
On systems that do not use Active Directory, you may obtain password hashes from the file system. Since the operating system holds a lock on the SAM file where the password hashes are stored on the file system it is not possible to just read them from this file while the operating system is running. You may copy a SAM file by booting another operating system such as DOS (running NTFSDOS), or Linux (with NTFS file system support) and retrieving it from the target system, where it is typically stored in C:\WinNT\system32\config. This is especially useful if you have physical access to the machine and it has a floppy drive.
You may also retrieve a SAM from a Windows NT Emergency Repair Disk. However, Windows 2000 does not normally store a SAM file on repair disks it generates. You may also retrieve a SAM file from a repair directory on the system hard drive, or from a backup tape.
You load the password hashes from a "SAM" or "SAM._" file into LC3 by using the File Import SAM File menu command and specifying the filename. LC3 will automatically expand compressed "SAM._" files on NT.
NOTE: If you are running on Windows 95/98 you will need to expand the "SAM._" file to "SAM" using the expand utility on an NT system. The command is expand sam._ sam.
LC3 can also capture the encrypted hashes from the challenge/response exchanged whenever one machine authenticates to another over the network. Your machine must have one or more Ethernet devices to access the network. Use the Import .. Import From Sniffer command. If more than one network interface is detected, you'll see the Select Network Interface dialog where you can choose the interface to sniff on. After choosing your interface you'll see the SMB Packet Capture Output dialog which captures any SMB authentication sessions that your network device can capture. If you are on switched network you will only see sessions originating from your machine or connecting to your machine.
NOTE: If you have a previous version of LC3 installed you must remove the NDIS packet driver from the Protocols tab in the Network Control Panel. Other low level packet drivers that are known to cause problems are the Asmodeus and ISS packet drivers. You will want to remove them also.
As SMB session authentications are captured they are displayed in the SMB Packet Capture Output window. The display shows source and destination IP addresses, the user name, the challenge, the encrypted LANMAN hash and the encrypted NTLM hash, if any. The capture can be imported at any time using the Import button. You can capture and crack other passwords at the same time, however password hashes captured after initiating an audit are not attempted in the running audit.
LC3 dumps password hashes from the SAM database (and from Active Directory)
of a system on which you have Administrator privileges, whether or not SYSKEY is
enabled on the system. However, if SYSKEY is being used (it is by default on
Windows 2000 systems) LC3 can only do this on the local machine on which it is
running. pwdump3
is a utility that allows remote access to the password database on SYSKEY
protected systems. It requires administrator access so it doesn't
compromise network security, and generates a file containing password hashes
that can be imported into LC3 for auditing.
The cracking processes that generate password values provide several options that balance audit rigor against the time required to crack. Effective auditing therefore requires an understanding the underlying business goals, and the security thresholds necessary to meet them.
To configure the cracking methods applied in your session, choose Session .. Session Options or simply click the toolbar's Session Options button to open the 'Auditing Options For This Session' dialog. From there you can configure the auditing options for the password hashes you have retrieved.
The fastest method for retrieving simple passwords is a dictionary crack. In a dictionary crack, LC3 tests all the words in a dictionary or word file against the password hashes. When it finds a correct password, it displays the result. The dictionary crack will try words of any length, up to and beyond the 14 character limit on Windows NT.
LC3 ships with a 250,000-word file named words-english that contains the most common English words. This file or any other word file you select is loaded into LC3 based on the settings in the Session Options dialog.
The second method LC3 can use is called a hybrid crack. This builds upon the dictionary method by appending numeric and symbol characters to dictionary words. Many users choose passwords such as "bogus1!" in an attempt to create a memorable, yet harder to crack password, based on dictionary words slightly modified with additional numbers and symbols. These are the types of passwords that will pass through many password filters and policies yet still pose organizational vulnerability because they are so easily cracked.
LC3 can guess these passwords in much less time than it would take for a brute force attack. LC3's Hybrid crack checks to see if any number of number and symbol characters are appended to each word in the word file you have selected. The default number of number and symbol characters is 2 but can be changed according to your preference.
The most comprehensive cracking method is the brute force method. This method will recover any password up to 14 characters (which is Windows NT's password length limit).
Because the brute force crack tries every combination of characters it's configured to use, your choice of character sets determines how long the brute force crack will take. Common passwords, based on letters and numbers can typically be recovered in about a day using the default character set A-Z and 0-9. Complex passwords, on the other hand, that use characters such as #_}* may take over a hundred days to crack on the same machine, using a comprehensive character set.
This difference between the strengths of weak versus strong passwords demonstrates the value of strong passwords in protecting your organization or machine. Using a real-world password auditing tool is the only real way to discover the strength of passwords in your organization, and gauge policy decisions such as:
LC3 can brute force four different types of password hash in its quest to recover a password:
Since a different approach is used for each of these attacks, you may be required to choose which you want LC3 to perform.
Because of its inherent weaknesses, the LM hash is the easiest to brute force.
Cracking challenge/response pairs captured from a network sniffing takes a bit longer because each password hash encrypted with a unique challenge so that some of the work done cracking one password cannot be used again to crack another. This means that LM challenge response data are the next most difficult to crack. The time to completion scales linearly as you add sniffed password hashes to crack. 10 network challenge/response hashes will take 10 times longer to crack than just one. Therefore, this type of cracking should be targeted toward particular passwords to be effective.
The NTLM hash is harder to brute force because it uses a stronger algorithm, and is case sensitive. For the reasons described above, NTLM challenge response pairs are the hardest of all to crack.
When possible, LC3 determines the best type of brute force attack to perform by itself. So, for example, if you have obtained both LM and NTLM hashes for each password you want to audit, LC3 will brute-forcing the LM hash since this is the fastest way to crack the passwords, even though it could achieve the same result with the more time-consuming brute force attack on the NTLM hash.
If, on the other hand, you have some passwords that have only LM hashes and others that have only NTLM hashes, neither approach (brute forcing the LM or the NTLM hashes) will give you all the passwords. In such a case, you have a choice. LC3 defaults to brute forcing the LM hash, but you can choose to switch it to brute forcing the NTLM hash by clicking the appropriate Toolbar or Session.. command.
Whenever you have a choice, the appropriate options will be available. Otherwise, they're greyed-out. The options you have are exposed either under Session drop-down menu, or on the Toolbar:
Once you've configured your audit in Session Options, you're ready to perform
the audit. Click the toolbar's 'Begin Audit' button
to start your audit. During the audit, status information
shows the progress of the audit. During dictionary and hybrid audits, the number of
dictionary words tried is displayed along with the percentage complete. During
the brute force attack, you can see the number of passwords attempted each
second under 'keyrate.'
Because brute force audits can be time-consuming when they involve the most comprehensive character sets, LC3 lets you break an audit into parts which can be run simultaneously on different machines. There are two basic methods you can use to perform a distributed audit.
If you have access to the same source of password hashes on different machines, you can configure your distributed audit from the Session Options dialog. Check the 'Distributed' checkbox, and choose which 'part' of the audit you want this machine to perform, out of the total number of 'parts' you're dividing the audit into. For example, if you imported the same SAM or registry file into two different machines running LC3, one machine would do part 1 of 1, and the other would do part 2 of 2.
If only one machine has immediate access to the source of target password hashes, you can divide an audit using the File .. Save Distributed feature. This lets you save the current session in parts, each of which can be run on any instance of LC3.
By auditing each of the saved session files, you achieve the complete
audit.
The following sections explore the commands available from the toolbar. Toolbar icons are shown in cases where the same functions can be invoked from the Toolbar.
File New Session
This creates a new LC3 audit session. The session metaphor allows you to keep multiple audits which may or may not yet have been completed.
File Open Session
This command opens a previously stored LC3 session from a *.lcs file.
Close Session
This stops and closes the current audit session. You are prompted about whether to save the session so it can be continued at a later time.
File Save and Save As
You may save the currently opened session to preserve the current state of your audit. This lets you stop and continue your audit at a later time, or move it to another machine without losing your progress. Save and Save As commands save the current state of the passwords, whether they are uncracked, partially cracked or cracked in the LC3 (*.lcs) format. This file can later be clicked to launch it into LC3 for continued cracking or to restarting a new crack session using the same target password hashes, but different audit options.
Save Distributed
This allows you to break a session into parts that can be audited simultaneously on different machines to speed up an audit.
Export
You may export your current results to a tab-delimited file. This is helpful in cases where you want to sort and modify the results, reformat them for presentation, or print them out.
LC3 Wizard
This launches the Wizard which walks the user through the configuration of common settings for an LC3 audit
Preferences
This command opens a dialog that looks similar to the Session Options dialog. The difference is that this one lets you configure the default settings for future auditing sessions.
Exit
Exit terminates the crack session if any and exits the program.
Toolbar
Show or hide the LC3 Toolbar.
Audited Passwords
The administrator can turn on or off the display of audited passwords. Use View .. Audit Times to know whether a password has been cracked when password display is turned off.
Password Hashes
Viewing the password hashes is interesting and useful to some people, and merely clutter to others. Use this option to toggle their display on or off.
Audit Times
This feature displays the amount of time LC3 took to crack each password. This provides an approximate quantitative measure of how robust a user's password is.
Visible Notification
Selecting this option causes an alert dialog to be displayed when the audit completes, even if you're working in another application.
Minimize to Tray
This command minimizes the program to a small icon in the system tray. The program window is reactivated by clicking on the small icon. This is useful when you are intending to crack for several days. If the SMB Packet Capture window is open it is minimized also.
Hide
This command hides the program window completely. It does not show up as an application in the task manager, although LC3 will continue to appear as a process. You can make the program visible again using the Ctrl+Alt+L key combination. If the Sniffer window had been open it is also hidden.
If you forget the code to re-display LC3, just remember to open this documentation from the Start .. Programs .. LC3 group!
Import From Local Machine
This commands imports password hashes used by the currently running operating system.
Import From Remote Registry
This commands opens a dialog box which accepts an computer name or IP address. The computer specified is queried through remote registry calls to dump the password hashes contained in the SAM section of the registry. Administrator privileges and remote registry access is required to dump the password hashes in this way. The password hashes retrieved using this approach will fail to be cracked if the remote machine is using SYSKEY as is the default on Windows 2000 machines.
Import From SAM file
Use this command to import password hashes stored in a SAM file. Note that a SAM file is locked and inaccessible while the operating system that uses it is in use. You may copy a SAM file by booting another operating system such as DOS (running NTFSDOS), or Linux (with NTFS file system support) and retrieving it from the target system, or you may retrieve it from a backup tape, from a Windows NT Emergency Repair Disk, or from a repair directory on the system hard drive. Click OK to import a copied SAM file.
Import From Sniffer
This command launches the network packet capture window. SMB packet capture promiscuously monitors your ethernet for SMB network authentication packets. When it captures an authentication session it will display the authentication parameters: username, challenge, and hashes in the window.
The contents of the window can be saved at any time to a *.lc file using the Save Capture button or they can be cleared using the Clear Capture button. When you close the window or press Done the capture session is terminated.
Import From .LCS file
This command imports password hashes from a saved L0phtCrack 2/2.5 session. The imported password hashes become part of the currently open session and do not affect the currently configured Session Options.
Import From PWDUMP file
This imports the output of a pwdump session into LC3.
Begin Audit
This command starts the audit engine going to work on the password hashes you have loaded, based on your configuration of the Session Options. A progress display shows the status.
Pause Audit
This feature halts the current audit, saving any progress that has been made so far. You may continue the audit from where you left off at a later time by choosing to 'Begin Audit' again.
Restart Audit
After a warning dialog, this command stops the current session and restarts it from the beginning, discarding any progress already made.
Brute LM
This and the other three brute force configuration options below determine what gets brute-forced since the approach is varies with each method. When possible, LC3 tries to determine the best choice to make. So, for example, if you have obtained both LM and NTLM hashes for each password you want to audit, LC3 will brute-forcing the LM hash since this is the fastest way to crack the passwords. If on the other hand, you have some passwords that have only LM hashes and others that have only NTLM hashes, however, neither approach will give you all the passwords. In this case, LC3 defaults to brute forcing the LM hash, but you can choose to switch it to brute forcing the NTLM hash by clicking the appropriate Toolbar or Session.. command.
Brute NTLM
Brute LM Challenge/Response
Brute NTLM Challenge/Response
Session Options
This opens the 'Auditing Options For This Session' dialog box, which contains all the different settings for modifying how LC3 tries to crack the password hashes. The options in this dialog are discussed in greater detail under the the section of this documentation entitled, Using LC3.
Documentation
This opens the help file you're currently reading.
LC3 Website
This command launches your browser and takes you to the LC3 website where you can find updates and additional program information when it becomes available.
SST Website
This command launches your browser and takes you to the Security Software Technologies home page where you can find out about other SST Products.
Online FAQ
This command launches your browser and takes you to an online FAQ about LC3.
About LC3
This command shows the program version information, Serial Number, and Unlock Code (for a registered copy of LC3).
Like many computing architectures, Windows passwords reflect not the most technically sophisticated design, but rather their own particular history of design flaws, vulnerability patches and the evolutionary restrictions imposed by serving a large installed-base. In this section, we take apart why it is so feasible to crack the LM hash that protects Windows passwords, and then talk about why the stronger NTLM hash, which was designed as an improvement on the LM hash and released with Windows NT Service Pack 3, is often irrelevant.
-------------------------- -----------------------------
| 16byte LM hash | |
16byte NTLM hash (md4) |
-------------------------- -----------------------------
We already know that you only have to go through 7 characters to retrieve passwords (up to 14 chars in length) in the LM hash. Furthermore, since there is no salting being done, constants appear, giving away information that speeds up an attack.
--------------------------------------------------------
| 1st 8bytes of LM hash | second 8bytes of LM hash |
--------------------------------------------------------
from first 7 chars from second 7 chars
The first 8 bytes are derived from the first seven characters of the password and the second 8 bytes are derived from the 8th through 14th characters of the password. If the password is less than 7 characters then the second half will always be: 0xAAD3B435B51404EE. Let's assume for this example that the user's password has a LM hash of 0xC23413A8A1E7665f AAD3B435B51404EE (which I'll save everyone the nanosecond it would have taken for them to plug this into LC3 and have it tell them the password is "WELCOME").
Here's what happens to this hash on the network:
|
--> |
|
Why this is breakable:
The LM Hash for 7 or fewer character passwords:
-------------------- -------------------- --------------------
| C23413A8A1E766 | | 5fAAD3B435B514 | | 04EE0000000000
|
--------------------
-------------------- --------------------
The first thing we check is to see if the user's password is shorter than 8 characters, by taking the 7 byte value of 0x04EE0000000000, turning it into an 8 byte odd parity DES key, and encrypting it against the 8 byte challenge of 0x0001020304050607. If we get the result of 0xCCCCCCCCCCCCCCCC then we are pretty sure it's shorter than 8 characters. In order to be sure we can run through 0x??AAD3B435B514 (i.e. just 256 possible combinations) to see that 5f shows us the result is 0xBBBBBBBBBBBBBBBB, proving the password is less than 7 characters and also giving us the last byte of the first half of the LM hash.
What if the test above proves we're dealing with an 8 character or greater password?
-------------------- -------------------- --------------------
| C23413A8A1E766 | | AC435F2DD90417 | | CCD60000000000
|
--------------------
-------------------- --------------------
It takes us, in a worst case scenario, 65,535 checks to figure out that the 2bytes that are used in the last third are 0xCCD6. In a simplistic fashion, you could go through your 7 digit combinations of characters for the first third the same way you would the LM hash from the registry. This will yield not only the first third of the response, but also the first byte of the second third. Keep in mind that you already have the last two bytes that made up the third. You could approach the middle third in the same fashion.
In summary, the challenge response can be brute-forced for the LM hash. Microsoft made the
decision to continue sending the LM hash response along with the NTLM response even when NT Service Pack 3 was installed, probably because eliminating
the LM hash response would prevent Windows 95 and 98 machines from talking to NT
machines. As a result, it is a moot point how secure or well done the NTLM hash
might be. The strength of the more secure NTLM hash is made irrelevant by its position in a chain whose weakest link is the
LM hash.
There are several things you can do to improve password security in your organization:
Registered LC3 users get free technical support by email with one business day or faster response time. To get technical support, you must include the Serial Number and Unlock Code from LC3's Help .. About dialog in your email's Subject line, separated by two colons. For example, a valid subject line might be,
Subject: Using International Dictionaries? 1e15f863::13fc7b05
Registered users can send their technical support questions to lc3@securitysoftwaretech.com.
Technical support is not provided for
non-registered users.
LC3 runs on Microsoft Windows operating systems, and has been tested on Windows 98 SE, Windows ME, Windows NT, Windows 2000, and beta versions of Windows XP. Its minimum system requirements are the same as those for the operating system on which you run it.
LC3 is a processor intensive (not memory intensive) application, and was optimized for Pentium
II and Pentium III processors. It also works fine on other processes.
LC3 includes WinPcap software for packet capture and network analysis. Copyright (c) 1999, 2000, Politecnico di Torino. All rights reserved.
WinPcap is further derived from LibPcap software, copyright (c) 1988, 1989, 1991, 1994, 1995, 1996, 1997 The Regents of the University of California. All rights
reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that:
- NT bugtraq
- The Microsoft focus area at SecurityFocus.com
- Usenet newsgroups on Windows NT administration:
- comp.os.ms-windows.nt.admin.security
- comp.os.ms-windows.nt.admin.networking
- comp.os.ms-windows.nt.admin.misc
As mentioned above, pwdump3 allows remote access to the password database on SYSKEY protected systems, and is available for free from e-business technology, Inc.
L0phtCrack 1.5 is available in an open source version. Note, however that LC3 is about four times faster than the L0phtCrack 1.5, due to optimization. The source version is essentially a researcher’s version, made available to share information about how the password auditing works. It’s not intended as an audit tool for production environments.
NTFSDOS is useful free utility for booting your system from a floppy to gain read-only access to your hard disk's files. This can be useful for accessing a SAM file (although SYSKEY-protected SAMs will not be auditable in LC3).
LC3's authors are Mudge, Weld Pond, and Dildog.
1. The SANS Institute. Ten Most Critical Internet Security Threats - The Experts' Consensus. January, 2001. www.sans.org/topten.htm