Cracking a CHAP from Freeradius

[honeyfairy]

Hi there

Playing around with a Freeradius installation and trying to extract the plaintext password from the CHAP challenge/response. How do I go about doing this?

Here is a successful login [Freeradius log]

Code:

Service-Type = Login-User
      User-Name = "testing"
      CHAP-Challenge = 0x45c915d82d6725720xxxxxxxxxxxxxxxxx9048420a31292d3
      CHAP-Password = 0x00777f2a3f6a2e66xxxxxxxxxxxxxxx1947b520c6777e0b25



[chap] login attempt by "testing" with CHAP password                                  
[chap] Using clear text password "password" for user testing authentication.
[chap] chap user testing authenticated succesfully

Here is a failed login [Freeradius log]

Code:

      Service-Type = Login-User
      User-Name = "testing"
      CHAP-Challenge = 0xc8274xxxxxxxxxxxxx

+group CHAP {
[chap] login attempt by "testing" with CHAP password
[chap] Using clear text password "password" for user testing authentication.
[chap] Password check failed
++[chap] = reject

Additional info:

Code:

  
# Executing section authorize from file /etc/raddb/sites-enabled/default
+group authorize {
++[preprocess] = ok
[chap] Setting 'Auth-Type := CHAP'
++[chap] = ok
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "testing", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] = noop
[eap] No EAP-Message, not doing EAP
++[eap] = noop
[files] users: Matched entry testing at line 1
++[files] = ok
++[expiration] = noop
++[logintime] = noop
[pap] WARNING: Auth-Type already set.  Not setting to PAP
++[pap] = noop
+} # group authorize = ok
Found Auth-Type = CHAP

How could I start cracking this:       CHAP-Password = 0x00777f2a3f6a2e661947b520c6777e0b25