[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 7 Feb 2012 23:28:03 +0100
From: A BC <miaou.pbl@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: DES - not "traditional DES-based" - (VNC hash) with JtR
Thank you all for your answers.
I am not really used to mailing lists, so I will just answer this mail for
all the previous.
First, thanks for the attention and the suggestions.
Next, I forgot to sign. A BC is just a Google personality. Miaou is better.
(...)
Rich, thanks for the link. Alexander made it clearer I want to unhash a
challenge/response that has already been sniffed. I wish I may use that to
gain an access to the machine...
But I did not knew that VNC store localy the access-pwd only encrypted with
a DES-like with a fixed "secret" key...
Corbin, I am glad you would have a solution ! I think it is not exactly
like the tripcode (I have seen your old post about them :
http://www.openwall.com/lists/john-users/2011/08/13/1). In Tripcodes, salt
is used into crypt(3) (I am not very sure how, so...) which gives a salted
DES encryption of 8 null bytes with the password given. but here, it is a
regular DES encryption with the password. The salting with VNC is that the
data to be encrypted by DES are not null bytes. They are 16 bytes chosen by
the server (challenge). This is indeed simplier than crypt(3). In fact, the
block size is 8 bytes with DES. So the 8 other bytes are to ensure
uniqueness of the encryption (password is padded or truncated to 8 bytes).
Next :
On Tue, Feb 7, 2012 at 4:59 PM, Solar Designer <solar@...nwall.com> wrote:
> If you want to try yourself, you may want to look at these source files
> as samples for challenge/response cracking:
>
> NETLM_fmt_plug.c
> NETSPLITLM_fmt_plug.c
> NETNTLM_fmt_plug.c
> MSCHAPv2_fmt_plug.c
>
I will look at them these asap
> > I am thinking about how JtR implements its algorithms, but it seems very
> > complicated.
>
> It is not - it's just that existing implementations quickly become
> complicated when they gain some optimizations. Besides the files I
> referenced above (which already got some "unnecessary" complexity), you
> may look at e.g. dummy.c, rawSHA_fmt_plug.c, rawSHA256_fmt.c, and
> XSHA_fmt_plug.c for simpler samples. The last one of these is for a
> salted hash type - similar to what you'll need in that aspect (you may
> treat the challenge as a salt). Then proceed with the more relevant
> samples referenced above. Also, read the comments in formats.h.
>
And I will start with these.
Thanks, you have enlighted my path among JtR source !
> Oh, and please post a test vector or several (sniffed challenge/response
> pairs and their corresponding known passwords).
>
Where ? On this list ?
What format is prefered for JtR : base64, hex (2 digits/byte) ?
I am building a FakeServer to obtain them : I installed vinagre, which I
connect to the server. The server gives him a challenge, vinagre asks for a
pass, responds to the server. The response IS ok.
The thing sounds so simple that I might just implement this when I feel
> like it - or anyone else can. ;-)
>
I will try to dive in JtR's source, but you may be faster.
Thanks,
Miaou
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
