{"action":"created","issue":{"url":"https://api.github.com/repos/aircrack-ng/aircrack-ng/issues/90","repository_url":"https://api.github.com/repos/aircrack-ng/aircrack-ng","labels_url":"https://api.github.com/repos/aircrack-ng/aircrack-ng/issues/90/labels{/name}","comments_url":"https://api.github.com/repos/aircrack-ng/aircrack-ng/issues/90/comments","events_url":"https://api.github.com/repos/aircrack-ng/aircrack-ng/issues/90/events","html_url":"https://github.com/aircrack-ng/aircrack-ng/pull/90","id":194075625,"number":90,"title":"HostAPd-WPE patch: fix challenge_hash when user starts with \"domain\\\"","user":{"login":"ClementNotin","id":550823,"avatar_url":"https://avatars.githubusercontent.com/u/550823?v=3","gravatar_id":"","url":"https://api.github.com/users/ClementNotin","html_url":"https://github.com/ClementNotin","followers_url":"https://api.github.com/users/ClementNotin/followers","following_url":"https://api.github.com/users/ClementNotin/following{/other_user}","gists_url":"https://api.github.com/users/ClementNotin/gists{/gist_id}","starred_url":"https://api.github.com/users/ClementNotin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ClementNotin/subscriptions","organizations_url":"https://api.github.com/users/ClementNotin/orgs","repos_url":"https://api.github.com/users/ClementNotin/repos","events_url":"https://api.github.com/users/ClementNotin/events{/privacy}","received_events_url":"https://api.github.com/users/ClementNotin/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-12-07T15:13:34Z","updated_at":"2016-12-09T07:31:43Z","closed_at":"2016-12-08T23:19:43Z","pull_request":{"url":"https://api.github.com/repos/aircrack-ng/aircrack-ng/pulls/90","html_url":"https://github.com/aircrack-ng/aircrack-ng/pull/90","diff_url":"https://github.com/aircrack-ng/aircrack-ng/pull/90.diff","patch_url":"https://github.com/aircrack-ng/aircrack-ng/pull/90.patch"},"body":"This patch is similar to @Rogdham https://github.com/OpenSecurityResearch/hostapd-wpe/pull/4\r\n\"username\" was correctly used instead of \"user\", but it was not yet defined so random/uninitialized data was used instead of the real username, without the \"domain\\\" part. This is confirmed by compilation warnings stating that \"username(_len) may be used uninitialized\".\r\n![2016-12-07_14-59-42](https://cloud.githubusercontent.com/assets/550823/21013824/bab12248-bd5b-11e6-86c3-73769d01a148.png)\r\n\r\nI have just moved down the two lines with challenge_hash() and wpe_log_chalresp(), after the \"username\" var is set and modified to remove the \"domain\\\" part.\r\n\r\nI have tested my patch with known credentials (both with and without the domain part to be sure to prevent regression).\r\n\r\nJohn is unable to crack the following NETNTLM hashes generated with the current code:\r\n```\r\nmschapv2: Wed Dec  7 15:42:05 2016\r\n\t username:\tdom\\user\r\n\t challenge:\t3b:9b:4b:54:f6:05:e3:5b\r\n\t response:\tbf:85:36:6c:ce:1b:7f:3c:28:55:b9:19:6d:94:33:d1:c8:54:5f:9f:05:9b:80:f0\r\n\t jtr NETNTLM:\tdom\\user:$NETNTLM$3b9b4b54f605e35b$bf85366cce1b7f3c2855b9196d9433d1c8545f9f059b80f0\r\n```\r\n```\r\nmschapv2: Wed Dec  7 15:45:45 2016\r\n\t username:\tuser\r\n\t challenge:\t00:b5:35:ad:96:5c:bf:78\r\n\t response:\ta2:89:7a:27:78:e6:f4:fc:49:4b:e4:03:55:02:4e:60:c5:4e:73:44:21:4d:a4:64\r\n\t jtr NETNTLM:\tuser:$NETNTLM$00b535ad965cbf78$a2897a2778e6f4fc494be40355024e60c54e7344214da464\r\n```\r\nasleap is also unable to crack the C/R with the well-known message \"Could not recover last 2 bytes of hash from the challenge/response.  Sorry it didn't work out.\"\r\n\r\nAnd John successfully cracks the following hashes (password is \"test\") generated with my patch:\r\n```\r\nmschapv2: Wed Dec  7 15:46:17 2016\r\n\t username:\tuser\r\n\t challenge:\t54:c6:0d:f1:94:d8:93:b1\r\n\t response:\t91:8e:2a:a0:0c:3d:e1:38:ed:a6:66:ea:5f:00:5a:fa:7c:d1:0c:1b:2d:76:0d:26\r\n\t jtr NETNTLM:\tuser:$NETNTLM$54c60df194d893b1$918e2aa00c3de138eda666ea5f005afa7cd10c1b2d760d26\r\n```\r\n```\r\nmschapv2: Wed Dec  7 15:42:53 2016\r\n\t username:\tdom\\user\r\n\t challenge:\t3a:6f:d9:22:70:13:e3:4a\r\n\t response:\ta0:29:1f:3e:34:8f:70:7f:dd:43:42:16:93:eb:81:b3:bb:31:31:0c:c5:38:5a:4b\r\n\t jtr NETNTLM:\tdom\\user:$NETNTLM$3a6fd9227013e34a$a0291f3e348f707fdd43421693eb81b3bb31310cc5385a4b\r\n```\r\nSame observation with asleap successfully cracking the C/R."},"comment":{"url":"https://api.github.com/repos/aircrack-ng/aircrack-ng/issues/comments/265951538","html_url":"https://github.com/aircrack-ng/aircrack-ng/pull/90#issuecomment-265951538","issue_url":"https://api.github.com/repos/aircrack-ng/aircrack-ng/issues/90","id":265951538,"user":{"login":"ClementNotin","id":550823,"avatar_url":"https://avatars.githubusercontent.com/u/550823?v=3","gravatar_id":"","url":"https://api.github.com/users/ClementNotin","html_url":"https://github.com/ClementNotin","followers_url":"https://api.github.com/users/ClementNotin/followers","following_url":"https://api.github.com/users/ClementNotin/following{/other_user}","gists_url":"https://api.github.com/users/ClementNotin/gists{/gist_id}","starred_url":"https://api.github.com/users/ClementNotin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ClementNotin/subscriptions","organizations_url":"https://api.github.com/users/ClementNotin/orgs","repos_url":"https://api.github.com/users/ClementNotin/repos","events_url":"https://api.github.com/users/ClementNotin/events{/privacy}","received_events_url":"https://api.github.com/users/ClementNotin/received_events","type":"User","site_admin":false},"created_at":"2016-12-09T07:31:43Z","updated_at":"2016-12-09T07:31:43Z","body":"Good! I hope this will get packaged soon into Kali."}}
{"actor":{"display_login":"ClementNotin"}}