Uses a flaw in the implementation of Microsoft's NetUserChangePassword API to guess/change the users password. Works best in internal networks, even if all SHARES on the Domain Controllers are disabled, the possibility for users to change their passwords is still given.
cupass.exe