[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 2 May 2006 18:52:36 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: JtR & NTLMv2 passwords
On Tue, May 02, 2006 at 02:18:13PM +0200, Guillaume Arcas wrote:
> I'm a bit confused about the ability of JtR to crack Windows passwords that use
> NTLMv2 format.
This question itself is confusing.
My (limited) understanding is that NTLMv2 is a revision of the NTLM
authentication protocol as described, for example, here:
http://davenport.sourceforge.net/ntlm.html
However, even when NTLMv2 is in use, the underlying password hashes
that are stored on Windows systems are plain NTLM, not NTLMv2 (there's
no such thing as an NTLMv2 password hash; instead, there are NTLMv2
challenge responses).
JtR supports LM and NTLM hashes (the latter with the contributed patch)
that are stored on Windows systems.
JtR does not support sniffed NTLM protocol challenge/response pairs.
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments
Was I helpful? Please give your feedback here: http://rate.affero.net/solar
Powered by blists - more mailing lists
Powered by Openwall GNU/*/Linux -
Powered by OpenVZ
