Password Representation Flashcards
Passwords are stored in these two formats in Windows
LANMAN and NTLM
NT, 2000,XP, 2003 use this hash
LANMAN
Windows Vista and later use this hash
NTLM
Windows hashes are stored locally where
SAM database
Domain Controllers store hashes where
ntds.dit
LANMAN hashes max character limit
14 characters
if LANMAN hash is < 14 characters it does what
fixed padding it with null byte
LANMAN converts password to what
upper case
LANMAN split the password into
two 7 bit halves
whats the weakest part of LANMAN hashes
splitting into two 7 character pieces easier to crack
LANMAN uses each 7 bit piece and how does it encrypt it
use each piece as a DES key to encrypt a constant with one round of DES. fixed constant hard coded into LANMAN algorithm then concatenates each piece
Is there ever an 13 character LAN man password
No its a 7 character password and and 6 character other password. attack each sides independently
NT Hash is how many characters long
256
NT Hash is not split up and requires only one round of
MD4
LANMAN and NT Hashes are not salted T or F
True
When authenticating over the network what is used
Challenge responses: LANMAN Challenge/Response NTLM v1 NTLM v2 Kerberos
LANMAN Hash Challenge response -
Client sends authentication request with username in __________
Server sends a pseudo random challenge request to client
Client takes users hash to transform mathematically the challenge into a response
cleartext
Client forms response for from challenge padding to ___ bytes and splits into ___ ___byte pieces
21
3
7
In NTLMv2 the client uses the NT hash as a key in the
HMAC-MD5 to hash the username and domain name
In NTLMv2 uses the result of the username and domain name hashed is used as a key in another round of HMAC-MD5 this time with it applied to
server challenge
timestamp
client challenge in pseudo random fashion
which produces the NTLMv2 response and client challenge
Modern Linux/Unix MD5-based Password schemes
use any length password and a ______. These are hashed together using the _____ algorithm. The result is then hashed with the original password and _____ for thousand iterations mixing orders of result, password, and ______. stored in /etc/shadow or /etc/password preceded with ____ and a _____ with another $.
salt MD5 salt salt $1$ salt,
Traditional DES-based scheme - users password is truncated to __ characters. Then bit is removed from each character to make them 7 bit ASCII representations, yielding ___ bits.
Result is used as a DES key to encrypt a constant block of ___ bits all set to ___. A salt is to create an interim result then the ___ bit DES key is perturbed by the ____ for ____ times.
8 56 64 0 56 salt 25
