Don't use unique passwords anymore, try KeePass 2

I use to manage my passwords in an excel file stored in an encrypted drive. Why write them? Because I manage like 20 username/password combination, plus credit/debit card PIN's, my Wife's and two suns Birthday..  a lot information to keep in my little brain :) . This approach  "protects" my data but its very very manual the process of updating passwords and entering them in each application/web site.  But after reading this post (and many other of course) about the dangerous of managing unique or common passwords, I decided to search a tool to make my life easier. 


I looked at KeePass 2, its an OpenSource tool that has many features. One great feature its the ability to automatically input username and password to the applications. There are two easy ways to do this:


1.- Select the application window.. then go to the keepass window, select the password entry and press "Ctrl + V".. yessss!!  like pasting any clipboard item. KeePass will input the data for you in the previous active window.


2.- For this option you need to know the application window name. You need to name the keepass entry like the application window. Once you are in the applicacion, just press hotkey "Ctrl + Alt + A" and keypass will look an entry with the same name as the application and paste the data for you.


Of course these two hotkeys can be changed for whatever keys combination you like. I use this tool with my mail accounts (hotmail, gmail), with my facebook and twitter accounts and with my Remote Desktop connections and applications.


What about security?  Well, the database its protected by an AES 256-bit encryption. This encryption is used by the NSA to protect TOP SECRET information, so you can be 99% sure that your data will be safe. To open the password database, you have three options to protect them (or all together): 


a) A master password
b) A key file that you can store in an USB or network
c) A windows user account


My recommendation?  Use almost two of them and do an effort to use the three to open the database, will be more difficult if some one tries to stole your passwords. 




The best of this great tool?  ITS FREE of charge!!  Try it and let me know other tips/features.

Dumping Hashes from Active Directory NTDS.dit

I will get password hashes from the Active Directory database NTDS.dit using two tools: libesedb and NTDXtract. I used an Ubuntu box for this so I started by downloading and extracting the two tools. I also backed up the System State of a running domain controller and restored it to a different location on the same server. Then I copied the ntds.dit file and the System registry hive file. After that I ran the following commands:


$ cd libesedb
$ chmod +x configure
$ ./configure && make


The previous commands build the sources into the Linux box. Then I ran the following to export the AD tables:


cd esedbtools
./esedbexport ../../ntds.dit


The previous commands build the sources into the Linux box. Then I use dsusers.py to extract the hashes from the datatable:


$ cd ../../NTDSXtract/
$ python ./dsusers.py ../libesedb-20111220/esedbtools/ntds.dit.export/datatable.3 ../libesedb-20111220/esedbtools/ntds.dit.export/link_table.4 --passwordhashes ../system > ../AD-dump.txt


I received the error about pycrypto was not installed, so I went ahead and installed python-setuptools and installed pycrypto:


$ sudo apt-get install python-setuptools
$ sudo easy_install pycrypto


I ran the dsusers.py again and command completed successfully. This is the first entry from the results:

Running with options:

Extracting password hashes

List of users:

==============

Record ID:           38410
User name:           user01,
User principal name: user01@domain.local
SAM Account name:    user01
SAM Account type:    SAM_NORMAL_USER_ACCOUNT
GUID: c77de96a-4056-48bb-bddf-2ac67afb88bb
SID:  S-1-5-21-454326967-959678081-45468671-1346
When created:         2009-10-27 22:53:43
When changed:         2011-01-13 20:03:56
Account expires:      Never
Password last set:    2009-10-27 22:53:43.406250
Last logon:           Never
Last logon timestamp: 2009-10-27 22:54:32.593750
Bad password time     Never
Logon count:          -1
Bad password count:   -1
User Account Control:
NORMAL_ACCOUNT
Ancestors:
$ROOT_OBJECT$ domain local Domain-Users OTHER user01, 
Password hashes:
user01,:$NT$6fdcdcfbddbbb847d93bf186a164441e:::

As you see, the "Password hashes" field contains the information that I was looking for. Searching I found this article from Tim Tomes who modified dsusers.py to get the hashes in an usable form, the file is called dshashes.py.

Afetr using the new file with the same options, I get the results in this format:

Running with options:

Extracting password hashes

List of hashes:

==============

User01,:5161:51c185931454376f1d71060d896b7a46:6fdcdcfbddbbb847d93bf186a164441e:::

Using this hash, I can use hashcat or JTR to discover the password for this user.