[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20070413045505.GA28109@openwall.com>
Date: Fri, 13 Apr 2007 08:55:05 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: LM/NTLMv1 challenge/response cracking
On Thu, Apr 12, 2007 at 04:43:16PM -0500, jmk wrote:
> I've posted my attempt at LM/NTLMv1 challenge/response cracking:
>
> http://www.foofus.net/~jmk/tools/jtr/lm_chall_resp.diff
Thank you! I think that someone might find this useful.
> It seems to work to crack hashes in the old .lc format which is what
> Cain & Abel appears to use:
>
> username:::lm response:ntlm response:challenge
>
> My implementation is probably pretty poor. This was my first attempt at
> hacking in a new format into John and I was thoroughly confused.
> Fortunately, while probably not as efficient as it could be, it seems to
> work for what I wanted. ;) Any comments on what I should have done
> different are welcome.
Well, the first difficulty that a user of this patch will face is that
it looks like it should be applied on top of another patch, but it is
not immediately obvious what that other patch is. Perhaps it's either
john-1.7-all-4.diff or john-1.7.2-all-3.diff, but somehow your patch is
against patched 1.7.0.2. One way to make this more obvious is to
include the previous patch filename in the old directory name, but then
you'd need to generate the diff manually rather than with SVN.
A better approach could be to make this patch against a JtR release with
no other patches. Erik might merge it into the jumbo patch later. A
proper filename for your patch would be john-1.7.2-lm-ntlm-cr-jmk-1.diff
(if you make it against 1.7.2) or maybe john-1.7.2-netlm-ntlm1-jmk-1.diff.
Another observation is that you seem to be confused by the issue with
case sensitivity of hex-encoded hashes. You've set FMT_SPLIT_UNIFIES_CASE
for one of two "formats" added by your patch, although it is needed for
both, and you're not providing an appropriate split() function for either
(so your setting FMT_SPLIT_UNIFIES_CASE is a lie). I understand that
this stuff is confusing; I should address it within the JtR core when I
get around to re-working it.
> One quick question... The LM response is based on an upper-case version
> of the user's password. I believe that John should only be testing
> case-insensitive passwords here and the netlm code upper-cases the test
> value when generating the response to compare, so the results are
> accurate. However, in some cases when it succeeds, John reports a
> mixed-case password. How do I force John to always display the
> upper-case version of that password?
You should move your conversion to uppercase from netlm_crypt_all() to
netlm_set_key(), such that netlm_get_key() will return the converted
string.
> I while back a coworker of mine modified John to log the time it took to
> crack a hash. This has been useful for us when cracking a hash that
> already existed in the .pot file and we would like to know how long it
> initially took to break. FWIW, I've posted his work here:
>
> http://www.foofus.net/~jmk/tools/jtr/readme.html
Thanks. Some people had been asking for this kind of functionality
before I added the .log files. I am unsure if it's still needed along
with the .log files, which already include timestamps and usernames.
As it relates to cracking NTLM hashes based on already-cracked LM ones,
this is currently achieved with another hack:
http://www.openwall.com/lists/john-users/2006/07/08/2
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: 5B341F15 fp: B3FB 63F4 D7A3 BCCC 6F6E FC55 A2FC 027C 5B34 1F15
http://www.openwall.com - bringing security into open computing environments
--
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
