[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20100910164941.GA19599@openwall.com>
Date: Fri, 10 Sep 2010 20:49:41 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Attacking Windows-ALT chars in LM Hashes
On Fri, Sep 10, 2010 at 08:20:07AM +0200, Magnum, P.I. wrote:
> On 09/09/2010 10:02 PM, Solar Designer wrote:
> >Apparently, these 8-bit character codes are passed into LM hashes as-is
> >(assuming that those hashes are produced at all).
>
> Well, they are first converted from [in this case] cp1252 to utf-16le.
>
> JtR however, cheats when doing this conversion: it just puts a 0x00
> between each char.
I think you confused LM (DES-based, 8 bits per char, two 56-bit keys)
and NTLM (MD4-based, 16 bits per char).
Your comments, above and below, probably apply to NTLM, but not to LM.
> This works for most of the charset when converting
> from iso-8859-1 to utf-16le, but will fail on anything else. Thus,
> without rewriting JtR you will never ever crack a LM password containing
> a character whose utf-16le msb is not 0x00. There is no workaround.
>
> In this case of ALT-0xxx keyboard codes, I guess this all means that if
> the character is the same position in iso-8859-1 as in cp1252, it will
> work, otherwise it will not.
>
> This is a complex matter. I think I got it right, anyway this is the
> gist of it.
Thank you! Even if the original question was about LM, it is very
useful to have this info about NTLM on the list as well.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
