I was gonna post about how NTLM passwords are much better than they used to be, to the point that they can't really be brute forced, but it looks like this just sorta goes "Yeah, that sounds like a lot of work, I'll just use shenanigans to make the password whatever I want it to be."
Have they sorted the old problem (over a decade old, so probably) whereby longer passwords were split and hashed
separately, so you only need to brute force half-n-half? (Rather than, you know,
at least using the result of the low-order hash to salt the hashing of the higher-order one... And there's better ways of doing that, even!)
Not that it matters to me, I've built up quite a number of useful tools for Windows, including the one that just goes straight into the Hives and nukes/resets passwords, unlocks locked accounts, adds accounts to admin groups, etc... I no longer (much to my regret) really have to
know how they do this, once they've proved themselves as worthwhile. Very few of them enable subtle "Spooks"-style cracking, but when I'm trying to get around malicious damage/locking and am doing it on behalf of the legitimate user that's not a problem.
(I have rarely had to crack through Linux security - for reasons ranging from their being less represented amongst the kind of person who needs such simple problems solving through to them being 'higher hanging fruit' both technologically and again w.r.t. to their liveware vulnerabilities - and I'd probably have to gather the tools I used together again. The last copy of John I had handy got 'quarantined' by an overzealous AV, because it was a "hacker tool". Which it is, of course, give or take.)