[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <47396636.9030407@banquise.net>
Date: Tue, 13 Nov 2007 09:54:14 +0100
From: Simon Marechal <simon@...quise.net>
To: john-users@...ts.openwall.com
Subject: advice requested about NTLMv1 implementation
Hello,
as most people know it's quite easy once you have a valid account on a
window computer (not vista) to retrieve an NTLMv1 response to an
arbitrary challenge. This makes it quite useful when looking for a valid
user password.
This response is made of 3 chunks, based on the LM hash (which is made
of 2 chunks). The dependency is:
C/R LM
1st chunk 7 first bytes of the first LM chunk
2nd chunk last byte of 1st LM chunk and 6 first bytes of 2nd chunk
3rd chunk 2 last bytes of the second LM chunk
It should be clear here that there are only 2^16 3rd chunks for a given
challenge. Getting the last 2 bytes of the 2nd chunk's LM hash is thus
quite fast. In the same way, once you know the 2nd LM chunk, it's quite
easy to retrieve the last byte of the 1st.
It thus makes sense to only compute the LM hash, and do the full
computation on passwords whose last bytes match (with a false positive
rate of 1/2^16 and 1/2^8 for the 2nd and 1st chunk).
It's straightforward to alter the LM cipher to crack either the last
chunk or the first chunk, but I can't see a smart way to attack both in
the same cipher, as the split() function would retrieve chunks that are
computed differently. Would someone have a good advice on that?
--
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
