Ophcrack is a free, open-source Windows password cracker that uses rainbow tables — precomputed hash-to-plaintext lookup tables — to recover Windows LM (LAN Manager) and NTLM password hashes extremely quickly, without needing to perform brute-force computation at crack time. It was originally developed by Objectif Sécurité and became especially famous in the mid-2000s for being able to crack most alphanumeric Windows LM-hashed passwords in seconds to minutes using free rainbow tables.
Ophcrack has both a graphical interface (the primary way it’s normally used) and a command-line interface (ophcrack-cli) for scripted/headless use, which is what Kali Linux packages emphasize. It can load hashes directly from a local SAM file (using the bundled samdump2 utility), from a PWDUMP-format file, or by sniffing hashes live from memory on a bootable Ophcrack LiveCD (a separate distribution built specifically for this purpose). Because LM hashes are case-insensitive and split into two 7-character halves, they are dramatically weaker than NTLM, and rainbow tables are extraordinarily effective against them — which is precisely why modern Windows disables LM hash storage by default. Against pure NTLM hashes without LM, Ophcrack is far less effective and modern tools like Hashcat are generally preferred.
Key Features
- Rainbow-table-based lookup — near-instant cracking once tables are loaded, no per-hash brute-force needed
- GUI (
ophcrack) and CLI (ophcrack-cli) interfaces - Free rainbow tables available for download (XP LM tables, Vista/7 NTLM “free small” tables) plus larger paid tables from Objectif Sécurité
- Can load hashes directly from a Windows SAM/SYSTEM file pair
- Companion bootable LiveCD ISO for extracting hashes from an offline Windows installation
- Progress and success-rate statistics during a table-based crack
Installation
Ophcrack (GUI and CLI) is available in the Kali repositories:
sudo apt update
sudo apt install ophcrack ophcrack-cli -y
Verify:
ophcrack-cli -h
Download rainbow tables (not bundled by default due to size — tables range from tens of MB to tens of GB):
# Example: download the free XP LM "small" table set
wget https://ophcrack.sourceforge.io/tables/tables_xp_free_fast.zip -O xp_free_fast.zip
unzip xp_free_fast.zip -d /usr/share/ophcrack/tables/xp_free_fast
(Table download URLs change over time — check the Ophcrack SourceForge page for the current mirror list.)
Syntax
GUI:
ophcrack
CLI:
ophcrack-cli -d TABLE_DIR -t TABLE_NAME [options] -- hashfile
Command-Line Options
ophcrack-cli options:
| Option | Description |
|---|---|
-d DIR | Directory containing rainbow tables |
-t NAME | Name of the specific rainbow table set to use |
-f FILE | Input file containing hashes (PWDUMP/SAM-derived format: user:RID:LMhash:NTHash:::) |
-o FILE | Write cracked results to FILE |
-g | Enable “greedy” mode (uses more memory for faster lookups) |
-m NUM | Limit RAM usage (MB) for table loading |
-e | Only crack hashes for a specific list of usernames |
--help | Show CLI help |
GUI-specific workflow options (menu-driven, not flags):
| Action | Description |
|---|---|
| Load → PWDUMP file | Load hashes from a pwdump-format text file |
| Load → Encrypted SAM | Load hashes directly from SAM/SYSTEM registry hive files |
| Load → Local SAM | Load hashes from the currently running Windows system (Windows build only) |
| Tables | Select/enable which downloaded rainbow tables to use, and set their status (enabled/disabled) |
| Crack | Start the cracking process using enabled tables |
| Save | Export the results to a text file |
Companion extraction utility:
samdump2 SYSTEM SAM > hashes.txt
| Option | Description |
|---|---|
SYSTEM | Path to the extracted SYSTEM registry hive |
SAM | Path to the extracted SAM registry hive |
> hashes.txt | Redirects PWDUMP-format output for use with Ophcrack |
Basic Usage
ophcrack-cli -d /usr/share/ophcrack/tables/xp_free_fast -t XP_free_fast -f hashes.txt
Expected output:
Ophcrack 3.8.0
Loading table xp_free_fast (1/1)...
Table loaded (100%).
Cracking hash for user 'jsmith'...
LM Hash : 299BD128C1101FD6AAD3B435B51404EE
NT Hash : 92937945B518814341DE3F726500D4FF
Progress: 100% Found: SUMMER23
user: jsmith LM: SUMMER23 NT: Summer23
1 of 1 hashes cracked (100%)
Practical Examples
Example 1 — Extracting hashes from a copied SAM/SYSTEM hive
samdump2 SYSTEM SAM > hashes.txt
cat hashes.txt
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
jsmith:1001:299bd128c1101fd6aad3b435b51404ee:92937945b518814341de3f726500d4ff:::
Example 2 — CLI crack using the XP free rainbow tables
ophcrack-cli -d /usr/share/ophcrack/tables/xp_free_fast -t XP_free_fast -f hashes.txt -o cracked.txt
Progress: 100% Found: SUMMER23
1 of 2 hashes cracked (50%)
cat cracked.txt
jsmith:SUMMER23:Summer23
Example 3 — GUI-based crack from a PWDUMP file
[GUI] File > Load > PWDUMP file > hashes.txt
[GUI] Tables > Enable "vista_free" > OK
[GUI] Click "Crack"
Status: Cracking...
Progress: 87%
Found 1/2 passwords
Example 4 — Limiting memory usage during a large table crack
ophcrack-cli -d /mnt/tables/vista_free -t Vista_free -m 2048 -f hashes.txt
Loading table Vista_free with 2048 MB RAM limit...
Table loaded (100%).
Progress: 100%
Example 5 — Cracking only a specific user’s hash
ophcrack-cli -d /usr/share/ophcrack/tables/xp_free_fast -t XP_free_fast -f hashes.txt -e jsmith
Cracking hash for user 'jsmith' only...
Found: SUMMER23
Example 6 — Using multiple rainbow table sets in one run
ophcrack-cli -d /mnt/tables -t "XP_free_fast,Vista_free" -f hashes.txt -o full_results.txt
Loading table XP_free_fast... done
Loading table Vista_free... done
2 of 2 hashes cracked (100%)
Example 7 — Verifying an Administrator account has no LM hash set (modern default)
grep Administrator hashes.txt
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Note: aad3b435b51404eeaad3b435b51404ee is the constant "empty LM hash" value —
this account has LM hashing disabled and Ophcrack's LM tables will not help;
an NTLM-capable table or a tool like Hashcat/John is required instead.
Example 8 — Exporting results after a GUI crack session
[GUI] File > Save > cracked_report.txt
Saved 3 cracked passwords to cracked_report.txt
Common Use Cases
- Recovering legacy Windows local account passwords from LM-hash-enabled systems (older Windows XP/2003 era, or systems with LM compatibility deliberately re-enabled)
- Quickly validating whether local Windows accounts on an in-scope machine use weak, rainbow-table-crackable passwords
- Physical/offline access engagements — booting a target machine from the Ophcrack LiveCD to extract and crack hashes without needing the OS credentials
- Educational demonstrations of why LM hashing is fundamentally broken and why it was deprecated
- Cross-checking results from a GPU-based Hashcat/John NTLM crack against a rainbow-table approach when LM hashes are present
Automation with Bash
#!/bin/bash
# ophcrack-extract-and-crack.sh — extract hashes from copied hive files and run CLI crack
SYSTEM_HIVE="SYSTEM"
SAM_HIVE="SAM"
TABLE_DIR="/usr/share/ophcrack/tables/xp_free_fast"
TABLE_NAME="XP_free_fast"
samdump2 "$SYSTEM_HIVE" "$SAM_HIVE" > hashes.txt
ophcrack-cli -d "$TABLE_DIR" -t "$TABLE_NAME" -f hashes.txt -o cracked_results.txt
echo "[*] Cracked results:"
cat cracked_results.txt
#!/bin/bash
# ophcrack-batch.sh — run against multiple extracted hash files (e.g., from several hosts)
TABLE_DIR="/usr/share/ophcrack/tables/xp_free_fast"
TABLE_NAME="XP_free_fast"
for hashfile in host_*_hashes.txt; do
echo "[*] Cracking $hashfile"
ophcrack-cli -d "$TABLE_DIR" -t "$TABLE_NAME" -f "$hashfile" -o "cracked_${hashfile}"
done
Tips and Best Practices
- Check for the constant empty-LM-hash value (
aad3b435b51404eeaad3b435b51404ee) before spending time on a rainbow-table crack — it means LM hashing is disabled and Ophcrack’s classic strength (LM tables) will not apply; pivot to NTLM-capable tables or Hashcat/John instead. - Larger, paid rainbow table sets from Objectif Sécurité dramatically increase success rate over the free tables, especially for NTLM; factor this into engagement planning and budget if Ophcrack is a core part of the toolkit.
- Rainbow tables trade disk space for crack time — keep enough free disk/RAM available, as full table sets can be tens of gigabytes and CLI/GUI loading can be memory-intensive (
-mhelps cap this). - Use the dedicated Ophcrack LiveCD when you have physical access to a powered-off machine — it avoids needing to boot into Windows at all to pull the SAM/SYSTEM hives.
- For modern Windows targets (Vista and later, LM disabled by default, strong NTLM passwords), treat Ophcrack as a secondary/legacy tool and prefer Hashcat/John for primary NTLM cracking work.
Troubleshooting
| Problem | Cause / Fix |
|---|---|
| 0% cracked despite tables loading fine | Target’s LM hash is empty/disabled (modern Windows default) — rainbow tables for LM won’t help; try NTLM-specific tables or switch tools |
samdump2 fails to read hive files | Hives may be in-use/locked (can’t read directly from a running system); copy them via reg save or boot from external media first |
| CLI hangs at “Loading table…” | Table files may be corrupted/incomplete download; re-download and verify checksums |
| Out of memory while loading large tables | Use -m to cap RAM usage, or use a machine with more RAM; consider smaller table sets |
| GUI won’t start / missing dependencies | Install missing Qt/GTK libraries: sudo apt install --fix-missing ophcrack |
References
- Official site: https://ophcrack.sourceforge.io/
- SourceForge project (including rainbow table downloads): https://sourceforge.net/projects/ophcrack/
- Kali Linux tool page: https://www.kali.org/tools/ophcrack/
- Objectif Sécurité (commercial rainbow tables): https://www.objectif-securite.ch/en/ophcrack