Date: Mon, 23 May 2005 23:28:27 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: LANMAN and NT Hash ?s...basic

Speaking of Windows passwords in excess of 14 characters, when these
are permitted:

On Sun, May 15, 2005 at 02:47:31PM +0200, Simon Marechal wrote:
> I think so, the lmhash should be aad3b435b51404eeaad3b435b51404ee.

Oh, right now John does not load LM hashes with that value and reports
them as "NO PASSWORD" with "--show".  Perhaps I should enhance it to
also look at the NTLM hash field and only report the "NO PASSWORD" if
both LM and NTLM hashes correspond to an empty password.  If the LM
hash is that of an empty string, but the NTLM hash is not, report that
the password is longer than 14 characters instead.  This is something
to get back to after John 1.7.

> A quick google reveals from
> http://www.microsoft.com/technet/community/chats/trans/windowsnet/wnet_092104.mspx
> Host: Jesper (Microsoft)
> Q: Can you comment on disabling LM Hashing? Is there any other way than
> creating passwords of 14 characters or more?
> A: You can disable LM Hashes by using the settings documented in KB
> 299656. If you can't turn the setting on globally then using passwords
> longer than 14 characters works well. You can also use certain Unicode
> characters in the password. For instance, if you use characters between
> 0127 and 0156 you will not get an LM hash. You will break things if you
> turn off LM hashes though. Windows cluster services and RTC both use
> them. To work around that, turn on NtlmMinClientSec to at least 0x80010.
> You will also break Win9x, but I think of that as a security benefit.

-- 
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598  fp: 6429 0D7E F130 C13E C929  6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments

Hosted by DataForce ISP - Powered by Openwall GNU/*/Linux