ophcrack

Crack passwords from a pwdump file using rainbow tables

$ ophcrack -g -d [path/to/tables] -f [hashes.txt]

$ ophcrack -g -d [path/to/tables] -t [xp_free_fast] -f [hashes.txt] -n [4]

$ ophcrack -g -d [path/to/tables] -f [hashes.txt] -o [cracked.txt]

$ ophcrack -g -B -d [path/to/tables] -f [hashes.txt]

$ ophcrack -g -q -d [path/to/tables] -f [hashes.txt] -l [log.txt]

$ ophcrack

ophcrack [options]
ophcrack -g -d tablesdir -f hashfile

ophcrack is a Windows password cracker that uses rainbow tables to recover passwords from LM and NTLM hashes. It implements a time-memory trade-off technique, pre-computing hash chains that dramatically speed up the cracking process.
The tool can crack Windows NT, 2000, XP, Vista, 7, 8, and 10 passwords. Free rainbow tables are available for common password patterns, with paid tables offering higher success rates. It can import hashes from pwdump files, SAM/SYSTEM registry files, or by dumping directly from local/remote Windows systems.
Ophcrack provides both GUI and command-line interfaces. The GUI includes real-time graphs analyzing password strength distribution. A LiveCD version allows booting directly on a Windows machine to extract and crack passwords without installing software.

-g

Disable GUI, run in command-line mode

Specify rainbow tables base directory

Specify tables to use (table_name,start,end:...)

Load hashes from pwdump or session file

Write output in pwdump format

Log all output to file

Number of threads to use

Disable audit mode (default)

Enable audit mode

Disable bruteforce

Enable bruteforce (default)

Specify configuration file

Do not display empty passwords

Hide usernames in output

Show usernames (default)

Preload level (0=none, 1=index, 2=index+end, 3=all)

Quiet mode

Start cracking immediately (GUI only)

Disable session auto-saving

Session file for auto-saving progress

Display statistics

Display debugging information

Show help

Rainbow tables require significant disk space (hundreds of MB to tens of GB). LM hashes are limited to passwords up to 14 characters and are case-insensitive. NTLM hashes are harder to crack. Success depends on having appropriate tables for the password character set. Only use on systems you own or have authorization to test.

Ophcrack was developed by Philippe Oechslin at EPFL (Swiss Federal Institute of Technology) and first released in 2004. Oechslin invented the rainbow table technique as an improvement over earlier time-memory trade-off methods. The tool demonstrated the weakness of LM hash storage, contributing to Microsoft's decision to deprecate LM hashes in Windows Vista and later versions.

hashcat(1), john(1), pwdump(1), rcrack(1)