Due to the nature of a hashing algorithm (see About Windows passwords), it is not possible to restore the original password from the hash (whether it is LM or NTLM). However, it is still possible to find the password using brute-force and dictionary attacks, by testing all possible passwords in a given range, or by trying the words from the wordlist, respectively. So, to get the passwords, we just need to:

Because hashing is based on relatively strong algorithms (DES and MD4), finding the right password may take a long time. But because most users prefer passwords that they can easily remember, brute-force and dictionary attacks are often the most effective methods for a malicious user to find a password. So the strength of a password depends on how many characters are in the password, how well the password is protected from being revealed by the owner, and how difficult the password is to guess.

Currently, several attack methods are based on guessing weak passwords by using dictionary, brute force and rainbow attacks.

Get more information about Proactive Password Auditor
Get full version of Proactive Password Auditor

(c) 2009 ElcomSoft Co.Ltd.