Date: Sat, 12 Nov 2011 01:10:01 +0100 From: rootkit rootkit <rootkit77@...il.com> To: john-users@...ts.openwall.com Subject: Re: NTLM challenge/response cracking (again...) On Fri, Nov 11, 2011 at 11:38 PM, Solar Designer <solar@...nwall.com> wrote: >> username:::19448aa9bd58a2adb6e690256fae100d47456f959bb61fa1:e6b41f380a23789abedd5a701c1c32bd0101000000000000:d3c4518b1ae3f15a > > this Google web search: > > http://www.google.com/search?q=ntlm+0101000000000000 > > suggests that you have NTLMv2 here. In JtR's NETNTLMv2_fmt_plug.c you > can see that test vectors do indeed include the username. So please try > to format your sample according to those and include the right username > and domain, then let john-users know what happens. Thanks for your answer Alex. I'm a little bit confused now. From NETNTLMv2_fmt_plug.c I see that the challenge/response should be in the following format USERNAME::DOMAIN:SERVER CHALLENGE:NTLMv2 RESPONSE:CLIENT CHALLENGE where ServerChallenge is 8 bytes, NTLMv2Response is 16 bytes, and ClientChallenge is variable (90 bytes in the example provided). My sample looks more to be in the NTLM format. From NETNTLM_fmt_plug.c USERNAME:::LM RESPONSE:NTLM RESPONSE:CHALLENGE with both LMResponse and NTLMResponse being 24 bytes. How should I format it in the NETNTLMv2 cracking mode? I take a wild guess here: maybe ettercap does not recognize NTLMv2 (development stopped in 2005) and is trunkating the NTLMv2 response at the 24th byte. That would explain why all my captured hashes terminate with 0101000000000000.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.