diff -rub john-1.7.5-jumbo-3/src/NETNTLM_fmt.c john-1.7.5-jumbo-3-jmk/src/NETNTLM_fmt.c --- john-1.7.5-jumbo-3/src/NETNTLM_fmt.c 2010-05-13 16:39:16.530750997 -0500 +++ john-1.7.5-jumbo-3-jmk/src/NETNTLM_fmt.c 2010-05-14 14:23:37.061446790 -0500 @@ -10,7 +10,7 @@ * attempts should be stored using the L0phtCrack 2.0 LC format, specifically: * username:unused:unused:lm response:ntlm response:challenge. For example: * - * CORP\Administrator:::25B2B477CE101D83648BB087CE7A1C217F51C7FC64C0EBB1:: + * CORP\Administrator:::25B2B477CE101D83648BB087CE7A1C217F51C7FC64C0EBB1: * C8BD0C1630A9ECF7A95F494A8F0B2CB4A3F25B1225514304:1122334455667788 * * It should be noted that a NTLM authentication response is not same as a NTLM diff -rub john-1.7.5-jumbo-3/src/NETNTLMv2_fmt.c john-1.7.5-jumbo-3-jmk/src/NETNTLMv2_fmt.c --- john-1.7.5-jumbo-3/src/NETNTLMv2_fmt.c 2010-05-13 16:39:16.530750997 -0500 +++ john-1.7.5-jumbo-3-jmk/src/NETNTLMv2_fmt.c 2010-05-13 16:40:26.840780067 -0500 @@ -60,7 +60,7 @@ #define DOMAIN_LENGTH 15 /* lmcons.h - CNLEN / DNLEN */ #define BINARY_SIZE 16 #define SERVER_CHALL_LENGTH 16 -#define CLIENT_CHALL_LENGTH_MAX 512 /* FIX - Max Target Information Size Unknown */ +#define CLIENT_CHALL_LENGTH_MAX 2048 /* FIX - Max Target Information Size Unknown */ #define SALT_SIZE_MAX USERNAME_LENGTH + DOMAIN_LENGTH + 3 + SERVER_CHALL_LENGTH/2 + CLIENT_CHALL_LENGTH_MAX/2 #define CIPHERTEXT_LENGTH 32 #define TOTAL_LENGTH 12 + USERNAME_LENGTH + DOMAIN_LENGTH + SERVER_CHALL_LENGTH + CLIENT_CHALL_LENGTH_MAX + CIPHERTEXT_LENGTH @@ -230,6 +230,7 @@ int identity_length = 0; int16 identity_usc[129]; int identity_usc_length = 0; + int challenge_size = 0; memset(ntlm, 0, 16); memset(ntlm_v2_hash, 0, 16); @@ -277,10 +278,12 @@ The length of the challenge was set in netntlmv2_get_salt(). We find the server challenge and blob following the identity and challenge size value. - challenge -> Identity \0 Size \0 Server Challenge + Client Challenge (Blob) + challenge -> Identity \0 Size (2 bytes) \0 Server Challenge + Client Challenge (Blob) */ + challenge_size = (*(challenge + identity_length + 1) << 8) | *(challenge + identity_length + 2); + hmac_md5_init_limK_to_64(ntlm_v2_hash, 16, &ctx); - hmac_md5_update(challenge + identity_length + 1 + 2, (int)(*(challenge + identity_length + 1)), &ctx); + hmac_md5_update(challenge + identity_length + 1 + 2 + 1, challenge_size, &ctx); hmac_md5_final(output, &ctx); } @@ -331,17 +334,18 @@ /* CIPHERTEXT == NTLMV2_RESPONSE (16 bytes / 32 characters) */ challenge_size = (strlen(ciphertext) - CIPHERTEXT_LENGTH - 2) / 2; - /* Set challenge size in response - use NULL separators */ - memset(binary_salt + identity_length + 1, challenge_size, 1); + /* Set challenge size in response - 2 bytes - use NULL separators */ + memset(binary_salt + identity_length + 1, (challenge_size & 0xFF00) >> 8, 1); + memset(binary_salt + identity_length + 2, challenge_size & 0x00FF, 1); /* Set server challenge - add NULL separator after challenge size */ for (i = 0; i < SERVER_CHALL_LENGTH / 2; i++) - binary_salt[identity_length + 1 + 1 + 1 + i] = (atoi16[ARCH_INDEX(ciphertext[i*2])] << 4) + atoi16[ARCH_INDEX(ciphertext[i*2+1])]; + binary_salt[identity_length + 1 + 2 + 1 + i] = (atoi16[ARCH_INDEX(ciphertext[i*2])] << 4) + atoi16[ARCH_INDEX(ciphertext[i*2+1])]; /* Set client challenge */ ciphertext += SERVER_CHALL_LENGTH + 1 + CIPHERTEXT_LENGTH + 1; for (i = 0; i < strlen(ciphertext) / 2; ++i) - binary_salt[identity_length + 1 + 1 + 1 + SERVER_CHALL_LENGTH / 2 + i] = (atoi16[ARCH_INDEX(ciphertext[i*2])] << 4) + atoi16[ARCH_INDEX(ciphertext[i*2+1])]; + binary_salt[identity_length + 1 + 2 + 1 + SERVER_CHALL_LENGTH / 2 + i] = (atoi16[ARCH_INDEX(ciphertext[i*2])] << 4) + atoi16[ARCH_INDEX(ciphertext[i*2+1])]; /* Return a concatenation of the server and client challenges and the identity value */ return (void*)binary_salt; diff -rub john-1.7.5-jumbo-3/src/loader.c john-1.7.5-jumbo-3-jmk/src/loader.c --- john-1.7.5-jumbo-3/src/loader.c 2010-05-13 16:39:16.530750997 -0500 +++ john-1.7.5-jumbo-3-jmk/src/loader.c 2010-05-14 14:23:03.431452473 -0500 @@ -260,45 +260,45 @@ sprintf(source, "%s\n", uid); } } - else if (options.format && (strncmp(options.format, "netlmv2", 7)==0)) { + else if (options.format && ((strncmp(options.format, "netlmv2", 7)==0) || + (strncmp(options.format, "netntlmv2", 9)==0))) { char *srv_challenge = ldr_get_field(&line, db_options->field_sep_char); - char *netlmv2 = ldr_get_field(&line, db_options->field_sep_char); + char *nethashv2 = ldr_get_field(&line, db_options->field_sep_char); char *cli_challenge = ldr_get_field(&line, db_options->field_sep_char); char *identity = NULL; int i; - identity = (char *) mem_alloc(strlen(*login) + strlen(uid) + 1); - strcpy(identity, *login); - strcat(identity, uid); + /* DOMAIN\USER: -or- USER::DOMAIN: */ + if ((tmp = strstr(*login, "\\")) != NULL) { + identity = (char *) mem_alloc(strlen(*login)); + strcpy(identity, tmp + 1); - /* Upper-Case Username and Domain */ + /* Upper-Case Username - Not Domain */ for(i=0; i= 'a') && (identity[i] <= 'z')) identity[i] ^= 0x20; - tmp = (char *) mem_alloc_tiny(9 + strlen(identity) + 1 + strlen(srv_challenge) + 1 + strlen(netlmv2) + 1 + strlen(cli_challenge) + 1, MEM_ALIGN_NONE); - sprintf(tmp, "$NETLMv2$%s$%s$%s$%s", identity, srv_challenge, netlmv2, cli_challenge); - *ciphertext = tmp; - - MEM_FREE(identity); + strncat(identity, *login, tmp - *login); } - else if (options.format && (strncmp(options.format, "netntlmv2", 9)==0)) { - char *srv_challenge = ldr_get_field(&line, db_options->field_sep_char); - char *netntlmv2 = ldr_get_field(&line, db_options->field_sep_char); - char *cli_challenge = ldr_get_field(&line, db_options->field_sep_char); - char *identity = NULL; - int i; - + else { identity = (char *) mem_alloc(strlen(*login) + strlen(uid) + 1); strcpy(identity, *login); - strcat(identity, uid); - /* Upper-Case Username - Not Domain */ - for(i=0; i= 'a') && (identity[i] <= 'z')) identity[i] ^= 0x20; - tmp = (char *) mem_alloc_tiny(9 + strlen(identity) + 1 + strlen(srv_challenge) + 1 + strlen(netntlmv2) + 1 + strlen(cli_challenge) + 1, MEM_ALIGN_NONE); - sprintf(tmp, "$NETNTLMv2$%s$%s$%s$%s", identity, srv_challenge, netntlmv2, cli_challenge); + strcat(identity, uid); + } + + if (strncmp(options.format, "netlmv2", 7)==0) { + tmp = (char *) mem_alloc_tiny(9 + strlen(identity) + 1 + strlen(srv_challenge) + 1 + strlen(nethashv2) + 1 + strlen(cli_challenge) + 1, MEM_ALIGN_NONE); + sprintf(tmp, "$NETLMv2$%s$%s$%s$%s", identity, srv_challenge, nethashv2, cli_challenge); *ciphertext = tmp; + } + else { + tmp = (char *) mem_alloc_tiny(9 + strlen(identity) + 1 + strlen(srv_challenge) + 1 + strlen(nethashv2) + 1 + strlen(cli_challenge) + 1, MEM_ALIGN_NONE); + sprintf(tmp, "$NETNTLMv2$%s$%s$%s$%s", identity, srv_challenge, nethashv2, cli_challenge); + *ciphertext = tmp; + } MEM_FREE(identity); }