[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <2068.84.188.231.221.1146589886.squirrel@www.jpberlin.de>
Date: Tue, 2 May 2006 19:11:26 +0200 (CEST)
From: rembrandt@...erlin.de
To: john-users@...ts.openwall.com
Subject: Re: JtR & NTLMv2 passwords
> On Tue, May 02, 2006 at 02:18:13PM +0200, Guillaume Arcas wrote:
>> I'm a bit confused about the ability of JtR to crack Windows passwords
>> that use
>> NTLMv2 format.
>
> This question itself is confusing.
>
> My (limited) understanding is that NTLMv2 is a revision of the NTLM
> authentication protocol as described, for example, here:
>
> http://davenport.sourceforge.net/ntlm.html
>
> However, even when NTLMv2 is in use, the underlying password hashes
> that are stored on Windows systems are plain NTLM, not NTLMv2 (there's
> no such thing as an NTLMv2 password hash; instead, there are NTLMv2
> challenge responses).
>
> JtR supports LM and NTLM hashes (the latter with the contributed patch)
> that are stored on Windows systems.
>
> JtR does not support sniffed NTLM protocol challenge/response pairs.
That is correct but there are sniffers.
Attackers could DoS a special Port at a e.g. Domaincontroler to make it
(and all Clients) fall back to NTLMv1 but since 2000 NTLMv2 is the default
(if you don`t force them to fall back :)).
With NTLMv2 they simply corrected a misstake wich leads to an easy to
build up Codebook (aka "Rainbowbook") (~80GB) for NTLMv1.
Supporting NTLMv2 would be neat indeed because Bruteforc eis the only way
to crack this stuff (as far as I know).
Rembrandt
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
