Cracking a CHAP from Freeradius

[honeyfairy]

Hi there

Playing around with a Freeradius installation and trying to extract the plaintext password from the CHAP challenge/response. How do I go about doing this?

Here is a successful login [Freeradius log]

Code:

Service-Type = Login-User       User-Name = "testing"       CHAP-Challenge = 0x45c915d82d6725720xxxxxxxxxxxxxxxxx9048420a31292d3       CHAP-Password = 0x00777f2a3f6a2e66xxxxxxxxxxxxxxx1947b520c6777e0b25 [chap] login attempt by "testing" with CHAP password                                   [chap] Using clear text password "password" for user testing authentication. [chap] chap user testing authenticated succesfully

Here is a failed login [Freeradius log]

Code:

      Service-Type = Login-User       User-Name = "testing"       CHAP-Challenge = 0xc8274xxxxxxxxxxxxx +group CHAP { [chap] login attempt by "testing" with CHAP password [chap] Using clear text password "password" for user testing authentication. [chap] Password check failed ++[chap] = reject

Additional info:

Code:

   # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok [chap] Setting 'Auth-Type := CHAP' ++[chap] = ok ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop [files] users: Matched entry testing at line 1 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set.  Not setting to PAP ++[pap] = noop +} # group authorize = ok Found Auth-Type = CHAP

How could I start cracking this:       CHAP-Password = 0x00777f2a3f6a2e661947b520c6777e0b25