FreeTDS Development Group

["Iliyan Peychev" <iliyan.peychev AT gmail.com>]

Hi Frediano,

I attach captured packets by using latest Ethereal.

Here is legend:
192.168.15.22 is client computer - Windows XP. Here is Query Analyzer.
192.168.15.27 is computer, on which my "proxy" program is started -  RedHat
Linux.
192.168.15.3 is computer, on which is started MS SQL 2000 Standard edition.
OS - Windows 2003.
192.168.15.19 is another computer, on which is started MS SQL 2000 Standard
edition. OS - Windows 2003.

Start Ethereal, load attached file, filter packets by TDS and take a look on
packet 34. Here Query Analyzer sends login packet to the "proxy" program.
"Proxy" forwards this packet to MS SQL servers (192.168.15.3 and
192.168.15.19). These are packets 35 and 36.

Next, in packet 37 MS SQL 2000 returns Type 2 message with challenge (0xFC,
0xDD, 0xA9, 0xF8, 0x88, 0x77, 0x0E, 0x88).
In packet 39 the other server, 192.168.15.19 also returns challenge.

Packet 41 - my "proxy" program forwards result to Query Analyzer - the
result is returned packet from the first MS SQL server ( 192.168.15.3).

Packet 43 - Query Analyzer sends Type 3 message, which is being forwarded to
192.168.15.3 (packet 44)  and server accepts it - packet 45.

What is wrong is conversation with 192.168.15.19 - just follow packets 47
and 48.


Here is the problem - when I try to calculate LM Response and NTLM response
as described here:
http://davenport.sourceforge.net/ntlm.html#respondingToTheChallenge

I always get wrong data. In practice - the password used in the above
examples is "test123".
Try to calculate LM response and NTLM response by using the challenge, sent
by 192.168.15.3 - 0xFC, 0xDD, 0xA9, 0xF8, 0x88, 0x77, 0x0E, 0x88 and
password "test123" and compare the results with these, sent by Query
Analyzer in packet 41.

As I wrote, the algorithm is not wrong, because I get correct results with
"raw" NTLM messages - not like these in the attached file, analyzed above.

That is the problem. Any idea will be useful!

Iliyan Peychev


2006/6/25, Frediano Ziglio <freddyz77 AT tin.it>:
> Hi!
>   Probably there is some bit that enable feature like crypting or some
> other feature. It would be helpful if you could use a test account and
> post some network capture. Or, if you prefer, post privately to me.
> I never say a SPNEGO with mssql...
>
> freddy77
>
>
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds



--
Iliyan Peychev

Attachment: output.cap.zip
Description: Zip archive