No subject
Fri May 2 19:13:14 EDT 2003
/* setup LanManager password */
char lm_pw[14];
int len =3D strlen(passw);
if (len > 14) len =3D 14;
for (idx=3D0; idx<len; idx++)
lm_pw[idx] =3D toupper(passw[idx]);
for (; idx<14; idx++)
lm_pw[idx] =3D 0;
/* create LanManager hashed password */
unsigned char magic[] =3D { 0x4B, 0x47, 0x53, 0x21, 0x40, 0x23, 0x24,
0x25 };
unsigned char lm_hpw[21];
des_key_schedule ks;
setup_des_key(lm_pw, ks);
des_ecb_encrypt(magic, lm_hpw, ks);
setup_des_key(lm_pw+7, ks);
des_ecb_encrypt(magic, lm_hpw+8, ks);
memset(lm_hpw+16, 0, 5);
/* create NT hashed password */
int len =3D strlen(passw);
char nt_pw[2*len];
for (idx=3D0; idx<len; idx++)
{
nt_pw[2*idx] =3D passw[idx];
nt_pw[2*idx+1] =3D 0;
}
unsigned char nt_hpw[21];
MD4_CTX context;
MD4Init(&context);
MD4Update(&context, nt_pw, 2*len);
MD4Final(nt_hpw, &context);
memset(nt_hpw+16, 0, 5);
This code crypt clear text password (as you can see it not use any
information from network).
> For me this is strange, but all texts suggests the use of password of use=
r to
> encrypt the servernonce for build the last packet (0x11). And if it don't=
is
> used, what we have use ?
>=20
>=20
> Sample of MS Query Analyser:
> >>100100CC00000100C40000000100007100000000000000075004000000000000E083000=
0B4000000160400005600000000000000000000005600150080000600000000008C00040094=
000000940000000050FC253F5794003000C40000004D0053002000530051004C00200051007=
500650072007900200041006E0061006C0079007A0065007200760074007300310030003000=
4F004400420043004E544C4D535350000100000007B200A0070007002900000009000900200=
00000534154454C4C495445444F4DD64E494F
>=20
> <<0401004900000000ED3E004E544C4D53535000020000000E000E0030000000058201002=
DCF9C3F554646FD0000000000000000000000003E00000044004F004D00CD004E0049004F00
>=20
> >>110100B2000001004E544C4D5353500003000000180018007A000000180018009200000=
00E000E00400000001A001A004E000000120012006800000000000000AA0000000582000044=
004F004D00CD004E0049004F00410064006D0069006E006900730074007200610064006F007=
20053004100540045004C004C00490054004500999A24312075654311A9967A04ADF2B1C1BB=
E9AE936372528152CF091999F4C6FB2D6C8ADC73335CDB496382C9EEED27
>=20
> <<0401019800000000E31B0001066D0061007300740065007200066D00610073007400650=
07200AB620045160000020025004300680061006E0067006500640020006400610074006100=
6200610073006500200063006F006E007400650078007400200074006F00200027006D00610=
0730074006500720027002E0006560054005300310030003000000000E31700020A75007300=
5F0065006E0067006C0069007300680000AB660047160000010027004300680061006E00670=
06500640020006C0061006E00670075006100670065002000730065007400740069006E0067=
00200074006F002000750073005F0065006E0067006C006900730068002E000656005400530=
0310030003000000000E30F000305690073006F005F003100010000E30B0005043100300033=
00330000E30F00060631003900360036003100310000AD36000107000000164D00690063007=
2006F0073006F00660074002000530051004C00200053006500720076006500720000000000=
0700034AE3130004043400300039003600043400300039003600FD0000000000000000
>=20
> I can easily simulate and capture the comunications of MSSQL Server with
> ethereal in the enterprise that I work.
>=20
I think at this time ethereal are no more necessary...
>=20
> Regards,
> Fernando !!
>=20
Good Luck
Frediano Ziglio (aka freddy77)
More information about the FreeTDS
mailing list