[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <1266273034.16828.37.camel@localhost>
Date: Mon, 15 Feb 2010 16:30:34 -0600
From: jmk <jmk@...fus.net>
To: john-users@...ts.openwall.com
Subject: Re: NTLMv2 Challenge/Response Cracking
On Sun, 2010-02-14 at 07:39 +0300, Solar Designer wrote:
> Thank you for contributing this. Going forward, I suggest that you (and
> others) base your patches on the latest version of JtR (with the jumbo
> patch), which would be 1.7.4.2-jumbo-2 this time. Also, I suggest that
> you start making more use of the wiki to publish patches:
>
> http://openwall.info/wiki/john/patches
I'll plan to post to the Wiki in the future. My comprehension of how
John really works is pretty limited. As such, I'm often not sure if my
approach with these formats is valid. I assumed the mailing list was the
easiest method to get feedback and flush out issues.
> Anyway, I've integrated your patch into john-1.7.3.4-jumbo-3 and
> john-1.7.4.2-jumbo-3, which I've just released. I've also added your
> netntlm.pl to the run directory. And I've edited your loader.c hacks
> replacing the unreasonable uses of sprintf() - I did not test these
> changes at all (other than that they compile), so I'd appreciate it if
> you review and/or test them. Finally, I noticed that you use
> fmt_default_binary_hash() and fmt_default_get_hash() in your "formats",
> which will result in poor performance when many hashes are loaded at
> once - you could want to correct that in a new revision of your code.
Thanks - I'll take a look at the modifications and test them against my
test set of NTLMv2 challenge/responses.
I just noticed that my netntlm.pl script relies on the ability to
specify a temporary John config, which it creates. The script sets the
first 7 characters of the password (i.e. the seed -- looked up via
Rainbow Tables) in it and brutes the rest. I've posted an example config
below. This has worked for me for the past few years. Is this an OK
approach, when you know the first 7 characters of a password that may be
anywhere from 7 to 14 characters? If so, I can extract the "--config"
option modifications and post the diff.
Joe
---- Example Config ----
[Incremental:LM]
File = /usr/share/john/lanman.chr
MinLen = 1
MaxLen = 7
CharCount = 69
[List.External:HalfLM]
void filter()
{
word[13] = word[6];
word[12] = word[5];
word[11] = word[4];
word[10] = word[3];
word[9] = word[2];
word[8] = word[1];
word[7] = word[0];
word[6] = 'g';
word[5] = 'f';
word[4] = 'e';
word[3] = 'd';
word[2] = 'c';
word[1] = 'b';
word[0] = 'A';
}
[List.Rules:Wordlist]
l
lMT[*0]T[*1]T[*2]T[*3]T[*4]T[*5]T[*6]T[*7]T[*8]T[*9]T[*A]T[*B]T[*C]T[*D]Q
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
