john-users - Re: JtR & NTLMv2 passwords

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / community lists wiki CVSweb mirrors signatures
bringing security into open environments

Order Openwall Wordlists CD (20+ languages) with delivery worldwide or download

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Tue, 2 May 2006 18:52:36 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: JtR & NTLMv2 passwords

On Tue, May 02, 2006 at 02:18:13PM +0200, Guillaume Arcas wrote:
> I'm a bit confused about the ability of JtR to crack Windows passwords that use
> NTLMv2 format.

This question itself is confusing.

My (limited) understanding is that NTLMv2 is a revision of the NTLM
authentication protocol as described, for example, here:

	http://davenport.sourceforge.net/ntlm.html

However, even when NTLMv2 is in use, the underlying password hashes
that are stored on Windows systems are plain NTLM, not NTLMv2 (there's
no such thing as an NTLMv2 password hash; instead, there are NTLMv2
challenge responses).

JtR supports LM and NTLM hashes (the latter with the contributed patch)
that are stored on Windows systems.

JtR does not support sniffed NTLM protocol challenge/response pairs.

-- 
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598  fp: 6429 0D7E F130 C13E C929  6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments

Was I helpful?  Please give your feedback here: http://rate.affero.net/solar