The history of one of the most famous Windows password cracker.

1. THE STORY OF
FROM 1997 TO 2015
Yes, L0phtCrack can drink legally now.

3. HOBBIT'S CIFS RESEARCH PAPER
JANUARY 1997

4. Jeremy Allison released pwdump on 3/24/1997
Inspired to reverse engineer for Linux to NT interoperability for SAMBA
Can dump password hashes from Windows NT registry but not crack
Jonathan Wilkins released NTCrack on 3/28/1997
Can crack LANMAN hashes only
Mudge released L0phtCrack on 4/11/1997
Cracks both LANMAN and NTLM hashes
Origins of L0phtCrack

5. For each user, LANMAN hashes
stored alongside NTLM for
backwards compatibility.
LANMAN Passwords uppercased
and split into two 7 character
passwords for hashing.
This scheme persisted until
Windows Vista shipped Jan 2007!
Windows NT Password Hash Refresher

6. L0PHTCRACK 1.0 4/11/1997
• Core engine written by
Mudge
• GUI version written by
Weld Pond
• Imports hashes from
Jeremy Allison's
PWDUMP
• Microsoft responds with
SYSKEY on 5/15/1997 in
NT4 SP3

7. • Windows administrators need a GUI
• Put the tools for password cracking in one program
L0phtCrack 1.5 Pivots from POC
to Administrator/Pen Tester Tool

8. L0PHTCRACK 1.5 7/12/1997
• GUI update to fix Brute
Forcing bugs
• Challenge/Response hash
cracking added
• Built-in hash dumping
• Shareware license
• U.S. Government
Accounting Office
becomes first paying
customer

9. L0PHTCRACK 2.0 2/16/1998
• Built-in sniffing for
challenge/response
• Ability to import SAM
registry hive added
• First commercial version
with 14-day trial license

10. L0PHTCRACK 2.5 1/13/1999
• DilDog joins L0pht as to
work on L0phtCrack full-
time.
• DES core rewritten with
optimized assembly
algorithm.
• Hybrid dictionary/brute
attack added

11. January 2000

12. L0PHTCRACK 3.0 (PRE) 1/24/2000
• Never Released
• Last Version with L0pht
branding
• Added session-based
interface
• Added L0phtCrack Wizard
• Added import from
remote registry

13. LC3 (SST) 4/6/2001
• Released by "Security
Software Technologies"
• Added 'distributed'
cracking
• SST not allowed to use
L0pht name on
L0phtCrack, 'LC' used
instead.

14. LC3 (@stake) 5/18/2001
• Three versions:
Professional, Admin, and
Consultant

15. LC4 (@stake) 5/14/2002
• Rob Cheyne added to
team
• GUI improvements:
sorting, exporting, SCBS
code pages
• Hybrid mode improved to
use more combinations
• Multiple dictionary
support

16. LC5 (@stake) 9/2/2004
• Ian Melven added to
team, uncredited
• Windows 2003 update,
better packet sniffer
• Rainbow Tables added
• Audit Scheduling
• Windows Domain
Remediation
• Support Options

17. September 16, 2004

18. FOUR YEARS PASS...

19. December 31, 2008

20. L0phtCrack 6 3/11/2009
• Original development
team, DilDog, Weld Pond,
Mudge, purchase LC back
from Symantec.
• UI Modernization
• 21 Service releases and
updates through to 2015
• Support for 64-bit,
Windows Vista, and
Windows 7, and Windows
Server up to 2012r2
• Basic Unix Hash Support

21. Goals Of L0phtCrack Today
• Put all the tools for password auditing in one program
• Make it easy for the enterprise to adopt with remediation and
reports
• Support modern hardware, operating systems, and hash
formats
• Support more than just Windows
• Include more of the security community!

22. Challenges
• Better ways to extract hashes.
• Remote extraction is more difficult these days, remote UAC,
firewalls
• Sniffer out of date
• GPU challenges: Keeping the GPU fully busy. Not all GPUs are
that fast, CPU can be faster!

23. ANNOUNCING
Early 2016

24. L0phtCrack 7 Early 2016
• Complete code overhaul
by DilDog. 100% new
codebase.
• Converted from MFC to Qt
for eventual portability
• New cracking engine
based on John The Ripper
• Multi-GPU OpenCL, CUDA
and CPU multi-core
• SSSE3, SSE4.1, AVX, XOP,
AVX2 optimizations,

25. L0phtCrack 7 Early 2016
• JtR complex wordlist
rules
• Full Unicode and
character set support
• Queue-based operation
• Completely overhauled
scheduler
• Full Unix support for
Linux, Solaris, BSD and
AIX hashes w/ssh remote
extraction.
• Automatic update
notification

26. L0phtCrack 7 Early 2016
Calibration selects which
hardware and algorithms
fastest

27. Completely Pluggable API
• Open Source API allows third-party plugins to work with L0phtCrack.
Beginning of a software ecosystem
• All features in L0phtCrack are implemented as plugins using the API.
• API is beta, will be released shortly after launch, available on
GitHub.
• Non-core features to be moved to plugins
Pluggable Units of IBM 604 calculator from 1948.
Ran at 50 kHz.

28. Future Directions
• Mac OS X support.
• Port GUI to OS X and Linux
• Support for other cracking engines.
• Hint: hashcat and oclHashcat now open source
• Enterprise reporting/analytics
• More import modules, such as creddump, mimikatz, volume
shadow copy, etc.
• Wireshark plugin for sniffing
• Database hashes
• More than just password cracking!
• Add support for Nmap
• Network inventory

29. THANK YOU!
Chris Wysopal
@weldpond
support@l0phtcrack.com