Module 5500 - different results for same hash (with or without client challenge part)
#7
(04-18-2019, 08:26 PM)philsmd Wrote: the domain is actually not used in computing the response and therefore can be skipped/ignored/anything, but the client challenge must be specified (e.g. 338d08f8e26de93300000000000000000000000000000000 in the example hash) if used (not empty).

Client challenge is missing. All that i have is: user (string), domain (same as user), response (hash) & challenge (hash):

Code:
mschapv2: Wed Jan 21 11:22:33 2019
     domain\username:     testuser
     username:            testuser
     challenge:           X1:XX:XX:XX:XX:XX:XX:X8
     response:            Y1:YY:YY:YY:YY:YY:YY:YY:YY:YY:YY:YY:YY:YY:YY:YY:YY:YY:YY:YY:YY:YY:YY:Y4


I build this hash from it:
Code:
   testuser::::Y1YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY4:X1XXXXXXXXXXXXX8


HashCat accept it. But it fail to find solution. (pswd should be easy to find, some CTF stuf...) So i start thinking that domain can play some role in it. I have also examples where domain is empty and HashCat find solution without problems ...
Reply


Messages In This Thread
RE: Module 5500 - different results for same hash (short vs full format) - by Martin2 - 04-18-2019, 09:26 PM