john-users - advice requested about NTLMv1 implementation

Openwall wordlists collection for password cracking (20+ languages)

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 13 Nov 2007 09:54:14 +0100
From: Simon Marechal <simon@...quise.net>
To: john-users@...ts.openwall.com
Subject: advice requested about NTLMv1 implementation

Hello,

	as most people know it's quite easy once you have a valid account on a 
window computer (not vista) to retrieve an NTLMv1 response to an 
arbitrary challenge. This makes it quite useful when looking for a valid 
user password.

	This response is made of 3 chunks, based on the LM hash (which is made 
of 2 chunks). The dependency is:

C/R		LM
1st chunk	7 first bytes of the first LM chunk
2nd chunk	last byte of 1st LM chunk and 6 first bytes of 2nd chunk
3rd chunk	2 last bytes of the second LM chunk

It should be clear here that there are only 2^16 3rd chunks for a given 
challenge. Getting the last 2 bytes of the 2nd chunk's LM hash is thus 
quite fast. In the same way, once you know the 2nd LM chunk, it's quite 
easy to retrieve the last byte of the 1st.

	It thus makes sense to only compute the LM hash, and do the full 
computation on passwords whose last bytes match (with a false positive 
rate of 1/2^16 and 1/2^8 for the 2nd and 1st chunk).

	It's straightforward to alter the LM cipher to crack either the last 
chunk or the first chunk, but I can't see a smart way to attack both in 
the same cipher, as the split() function would retrieve chunks that are 
computed differently. Would someone have a good advice on that?

-- 
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.