Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 14 Jan 2014 07:55:42 +0100
From: magnum <john.magnum@...hmail.com>
To: john-users@...ts.openwall.com
Subject: Re: Cracking MSChap v2

On 2014-01-13 23:54, Rob Fuller wrote:
> Looked through the source and mailing list, but couldn't find it, has there
> been any work on cracking NetNTLMv1 down to NTLM hashes?
>
> http://markgamache.blogspot.com/2013/01/ntlm-challenge-response-is-100-broken.html
> https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/

Not exactly (would be easy but not that quick on CPU) but we do brute 
force the last third. Here are figures without taking this advantage:

Benchmarking: netntlm-naive, NTLMv1 C/R [MD4 DES (ESS MD5) DES 128/128 
AVX-16 naive]... DONE
Many salts:	80125K c/s real, 79332K c/s virtual
Only one salt:	6513K c/s real, 6513K c/s virtual

Benchmarking: mschapv2-naive, MSCHAPv2 C/R [MD4 DES DES 128/128 AVX-16 
naive]... DONE
Many salts:	78937K c/s real, 78937K c/s virtual
Only one salt:	6808K c/s real, 6808K c/s virtual

...and here are figures when we exploit this:

Benchmarking: netntlm, NTLMv1 C/R [MD4 DES (ESS MD5) 128/128 AVX 16x]... 
DONE
Many salts:	6959M c/s real, 6959M c/s virtual
Only one salt:	29785K c/s real, 29785K c/s virtual

Benchmarking: MSCHAPv2, C/R [MD4 DES (ESS MD5) 128/128 AVX 16x]... DONE
Many salts:	7097M c/s real, 7168M c/s virtual
Only one salt:	30756K c/s real, 30756K c/s virtual

In the latter case and multiple salts, we're approaching speeds normally 
only seen with GPU.

magnum

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.