[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 12 Nov 2011 01:10:01 +0100
From: rootkit rootkit <rootkit77@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: NTLM challenge/response cracking (again...)
On Fri, Nov 11, 2011 at 11:38 PM, Solar Designer <solar@...nwall.com> wrote:
>> username:::19448aa9bd58a2adb6e690256fae100d47456f959bb61fa1:e6b41f380a23789abedd5a701c1c32bd0101000000000000:d3c4518b1ae3f15a
>
> this Google web search:
>
> http://www.google.com/search?q=ntlm+0101000000000000
>
> suggests that you have NTLMv2 here. In JtR's NETNTLMv2_fmt_plug.c you
> can see that test vectors do indeed include the username. So please try
> to format your sample according to those and include the right username
> and domain, then let john-users know what happens.
Thanks for your answer Alex.
I'm a little bit confused now. From NETNTLMv2_fmt_plug.c I see that
the challenge/response should be in the following format
USERNAME::DOMAIN:SERVER CHALLENGE:NTLMv2 RESPONSE:CLIENT CHALLENGE
where ServerChallenge is 8 bytes, NTLMv2Response is 16 bytes, and
ClientChallenge is variable (90 bytes in the example provided).
My sample looks more to be in the NTLM format. From NETNTLM_fmt_plug.c
USERNAME:::LM RESPONSE:NTLM RESPONSE:CHALLENGE
with both LMResponse and NTLMResponse being 24 bytes.
How should I format it in the NETNTLMv2 cracking mode?
I take a wild guess here: maybe ettercap does not recognize NTLMv2
(development stopped in 2005) and is trunkating the NTLMv2 response at
the 24th byte. That would explain why all my captured hashes terminate
with 0101000000000000.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
