RE: LC4 (L0phtCrack) error "Couldn't open SAM\Domains\Account\Users in SAM file. Possibly improper format."

From: Christopher W. Morris <morriscw(at)erols.com>
Date: Thu Apr 17 2003 - 15:54:38 EDT

Did you make sure to use tftp with the "-i" option for binary mode transfer?

-----Original Message-----
From: MACRIDES,NATHAN (HP-Australia,ex3) [mailto:nathan.macrides@hp.com] Sent: Wednesday, April 16, 2003 8:24 PM
To: flexicon33@yahoo.com; pen-test@securityfocus.com Subject: RE: LC4 (L0phtCrack) error "Couldn't open SAM\Domains\Account\Users in SAM file. Possibly improper format."

Have you tried using regback to export the SAM? you should give it a try and see if you get any different results.

Regards

Nathan

-----Original Message-----
From: flexicon33@yahoo.com [mailto:flexicon33@yahoo.com] Sent: Wednesday, April 16, 2003 2:25 PM
To: pen-test@securityfocus.com
Subject: LC4 (L0phtCrack) error "Couldn't open SAM\Domains\Account\Users in SAM file. Possibly improper format."

Hi,
I'm trying to import some SAM files into LC4, and for some reason LC4 doesn't like the format. I get the above error for any of 5 SAM files I'm trying.

For a pen test, I got these sam files by senging a 'tptp put' command to the SQL server (had no 'sa' password) so the SAM files were sent to my tftp server. There were 5 of these servers, so I got 5 SAM files to try. LC4 doesn't like any of them.

However, LC4 works for other SAM files... I tested with my own SAM file (w2k) and also another I downloaded from a machine via an http exploit... LC4 had no problems opening those 2 and working on them.

Why does LC4 complain about these other SAM files? Does some other sam format exist or did they get mangled somehow? Thanks...
Flexicon33, CISSP

---

Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the world's premier event for IT and network security experts. The two-day Training features 6 hand-on courses on May 12-13 taught by professionals. The two-day Briefings on May 14-15 features 24 top speakers with no vendor sales pitches. Deadline for the best rates is April 25. Register today to ensure your place. http://www.securityfocus.com/BlackHat-pen-test

---

---

Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the world's premier event for IT and network security experts. The two-day Training features 6 hand-on courses on May 12-13 taught by professionals. The two-day Briefings on May 14-15 features 24 top speakers with no vendor sales pitches. Deadline for the best rates is April 25. Register today to ensure your place. http://www.securityfocus.com/BlackHat-pen-test

---

#################################################################
#################################################################
#################################################################
#####
#####
#####
#################################################################
#################################################################
#################################################################

#################################################################
#################################################################
#################################################################
#####
#####
#####
#################################################################
#################################################################
#################################################################

---

Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the world's premier event for IT and network security experts. The two-day Training features 6 hand-on courses on May 12-13 taught by professionals. The two-day Briefings on May 14-15 features 24 top speakers with no vendor sales pitches. Deadline for the best rates is April 25. Register today to ensure your place. http://www.securityfocus.com/BlackHat-pen-test

---

Received on Thu Apr 17 16:46:17 2003