john-users - NetLMv2 / NetNTLMv2 Bug Fix Patch

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 14 May 2010 15:11:27 -0500
From: jmk <jmk@...fus.net>
To: john-users@...ts.openwall.com
Subject: NetLMv2 / NetNTLMv2 Bug Fix Patch

Hi,

I've uploaded a small patch against John 1.7.5 + Jumbo 3 for my
NetLMv2/NetNTLMv2 formats:

http://openwall.info/wiki/john/patches
http://www.foofus.net/jmk/tools/jtr/john-1.7.5-jumbo-3-netv2-fix.diff

The patch makes the following changes:

* Fixes a bug which surfaces when cracking NTLMv2 authentication
exchanges with very long client challenges. These seem to occur when
both ends of the exchange are Windows 7 hosts. 

* Fixes domain parsing for LMv2. I was previously upper-casing the
domain name and should not have been.

* Makes username format for NTLMv2/LMv2 more flexible. The file can now
contain either "DOMAIN\USER:::" or "USER::DOMAIN:".

Please let me know if there are any questions or issues.

Thanks,
Joe