One final addendum to this ongoing thread

Drew Copley was kind enough to point out to me that can steal any user's
windows password simply by having them view a specially prepared page using
this exploit

What basically happens is that the server sends an 8 byte challenge to the
browser, the browser uses the lanman and nt password hashes to generate a
response by appending some zero's to the hash and then using it as a des key
to encode the message. This message explains it more thoroughly

http://www.insecure.org/sploits/l0phtcrack.lanman.problems.html

If you know the response and you know the challenge (obviously we do since
we control what's being sent) you can crack it quite easily using l0phtcrack
Amazing that that insecure lanman hash is still being sent after all that
time

Anyway great find Bitlance winter!!

Updated demo at

http://jelmer.homedns.org/test2.htm

Updated (very messy) code at

http://jelmer.homedns.org/code2.zip

This page does a pretty good job at describing the ntlm protocol

http://www.innovation.ch/java/ntlm.html

[ reply ]