How does brute force password cracking work with NT?
As previously pointed out, the Lan Manager password concantenated to 14 bytes, and split in half. The halves can be worked on individually. If the password was originally only 7 characters or less, that second half is always 0xAAD3B435B51404EE. To further ease brute force cracking, since a substantial reduction in bits occurs during the deriving of the 8 byte DES key from the 7 byte key, less keys have to be tried. Also since the password is converted to upper case before one way encrypting it, Lan Manager password cracking does not have to take into consideration the possibility of lower case letters. L0phtcrack incorporates techniques to exploit all of these possibilities. By cracking the Lan Man password first, the NT password can be brute forced to determine the proper case of each alpha character. L0phtcrack 2.01, the latest version as of this writing, is lightning fast.
