CVS update: samba/source/libsmb

Luke Leighton lkcl at samba.anu.edu.au
Mon Nov 22 06:24:01 EST 1999


Date:	Monday November 22, 1999 @ 6:24
Author:	lkcl

Update of /data/cvs/samba/source/libsmb
In directory samba:/tmp/cvs-serv11798/libsmb

Modified Files:
	clientgen.c pwd_cache.c smbencrypt.c 
Log Message:
you know what?  this sort of thing makes me laugh.  hmm, what functions
have we got.  and what data do we have.  hmm.. i wonder what the NTLMv2
user session key can be... hmmm... weell.... there's some hidden data
here, generated from the user password that doesn't go over-the-wire,
so that's _got_ to be involved.  and... that bit of data took a lot of
computation to produce, so it's probably _also_ involved... and md4 no, md5?
no, how about hmac_md5 yes let's try that one (the other's didn't work)
oh goodie, it worked!

i love it when this sort of thing happens.  took all of fifteen minutes to
guess it.  tried concatenating client and server challenges.  tried
concatenating _random_ bits of client and server challenges.  tried
md5 of the above.  tried hmac_md5 of the above.  eventually, it boils down
to this:

kr = MD4(NT#,username,domainname)
hmacntchal=hmac_md5(kr, nt server challenge)
sess_key = hmac_md5(kr, hmacntchal);



More information about the samba-cvs mailing list