Date: Sun, 18 Nov 2012 11:44:04 +0100 From: buawig <buawig@...il.com> To: john-users@...ts.openwall.com Subject: Re: cracking passwords with a kerberos traffic dump [implementation confirmed to work] >>> As in standard Kerberos? It would surprise me a whole lot if >>> Microsoft do not use the Unicode version of the password, or (even >>> more likely) the 16 byte NT hash as input just like in mskrb5, as >>> opposed to the plain string you use now. >> >> Ok, this makes it clear why I was not be able to crack it. So the >> outcome will be a MS specific john format (mskrb5-18). > > I don't think that it is necessary to modify krb-ng_fmt_plug.c to > support M$ AD specifically as M$ AD follows RFC. Indeed it works, I was able to crack the known password* with you latest krb-ng_fmt_plug.c! So to not have to store the plaintext passwords the KDC stores the per-user long term AES key generated from the password via PBKDF2, correct? (I agree that this master key is equivalent to the password in the kerberos world but in my opinion it is still better to store the AES key as opposed to the actual password that was used to generate that AES key.) > As I suspected, the problem turned out to be that the fast PBKDF2 > doesn't handle long passwords. I have switched back to safer but > slower implementation of PBKDF2 and I can successfully crack > M$ AD long passwords (> 16 chars). To add some figures for how big the slowdown actually is on my side: - 390 c/s (faster implementation with pw length limitation) - 220 c/s (>16 password length support PBKDF2 implementation) I'll keep the faster implementation too, as cracking something with that speed and >16 pw length is not very likely anyway. Thank you very much for the great work! *) My Password properties: >16 chars long, including special symbols (but still ASCII), no Unicode characters are present in the password.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.