FreeTDS Development Group

["Iliyan Peychev" <iliyan.peychev AT gmail.com>]

Hi Frediano,

Many thanks! I had no idea that NTLM2SessionResponse should be used in  
this case. How did you discover that?

I really appreciate what you did and I would like to donate to you/your  
project. Unfortunately, Bulgaria in not in the list with supported  
countries by PayPal. Is there another way to donate?

Thanks again,
Iliyan Peychev

On Wed, 28 Jun 2006 13:02:30 +0300, ZIGLIO, Frediano, VF-IT  
<Frediano.Ziglio AT vodafone.com> wrote:

> > Hi Frediano,
> >
> > I attach captured packets by using latest Ethereal.
> >
> > Here is legend:
> > 192.168.15.22 is client computer - Windows XP. Here is Query Analyzer.
> > 192.168.15.27 is computer, on which my "proxy" program is
> > started -  RedHat
> > Linux.
> > 192.168.15.3 is computer, on which is started MS SQL 2000
> > Standard edition.
> > OS - Windows 2003.
> > 192.168.15.19 is another computer, on which is started MS SQL
> > 2000 Standard
> > edition. OS - Windows 2003.
> >
> > Start Ethereal, load attached file, filter packets by TDS and
> > take a look on
> > packet 34. Here Query Analyzer sends login packet to the
> > "proxy" program.
> > "Proxy" forwards this packet to MS SQL servers (192.168.15.3 and
> > 192.168.15.19). These are packets 35 and 36.
> >
> > Next, in packet 37 MS SQL 2000 returns Type 2 message with
> > challenge (0xFC,
> > 0xDD, 0xA9, 0xF8, 0x88, 0x77, 0x0E, 0x88).
> > In packet 39 the other server, 192.168.15.19 also returns challenge.
> >
> > Packet 41 - my "proxy" program forwards result to Query Analyzer - the
> > result is returned packet from the first MS SQL server (
> > 192.168.15.3).
> >
> > Packet 43 - Query Analyzer sends Type 3 message, which is
> > being forwarded to
> > 192.168.15.3 (packet 44)  and server accepts it - packet 45.
> >
> > What is wrong is conversation with 192.168.15.19 - just
> > follow packets 47
> > and 48.
> >
> >
> > Here is the problem - when I try to calculate LM Response and
> > NTLM response
> > as described here:
> > http://davenport.sourceforge.net/ntlm.html#respondingToTheChallenge
> >
> > I always get wrong data. In practice - the password used in the above
> > examples is "test123".
> > Try to calculate LM response and NTLM response by using the
> > challenge, sent
> > by 192.168.15.3 - 0xFC, 0xDD, 0xA9, 0xF8, 0x88, 0x77, 0x0E, 0x88 and
> > password "test123" and compare the results with these, sent by Query
> > Analyzer in packet 41.
> >
> > As I wrote, the algorithm is not wrong, because I get correct
> > results with
> > "raw" NTLM messages - not like these in the attached file,
> > analyzed above.
> >
> > That is the problem. Any idea will be useful!
> >
> > Iliyan Peychev
>
> Well,
>
> > From capture we have all 3 message types
>
> 00000104  86 48 86 f7 12 01 02 02  a2 32 04 30 4e 54 4c 4d .H......
> .2.0NTLM
> 00000114  53 53 50 00 01 00 00 00  07 b2 08 a2 03 00 03 00 SSP.....
> ........
> 00000124  2d 00 00 00 05 00 05 00  28 00 00 00 05 01 28 0a -.......
> (.....(.
> 00000134  00 00 00 0f 50 41 56 45  4c 49 53 53             ....PAVE LISS
>
> 00000045  37 02 02 0a a2 81 dd 04  81 da 4e 54 4c 4d 53 53 7.......
> ..NTLMSS
> 00000055  50 00 02 00 00 00 0e 00  0e 00 38 00 00 00 05 82 P.......
> ..8.....
> 00000065  8a a2 fc dd a9 f8 88 77  0e 88 00 00 00 00 00 00 .......w
> ........
> 00000075  00 00 94 00 94 00 46 00  00 00 05 02 ce 0e 00 00 ......F.
> ........
> 00000085  00 0f 57 00 49 00 4e 00  32 00 30 00 30 00 33 00 ..W.I.N.
> 2.0.0.3.
> 00000095  02 00 0e 00 57 00 49 00  4e 00 32 00 30 00 30 00 ....W.I.
> N.2.0.0.
> 000000A5  33 00 01 00 0e 00 57 00  49 00 4e 00 32 00 30 00 3.....W.
> I.N.2.0.
> 000000B5  30 00 33 00 04 00 32 00  77 00 69 00 6e 00 32 00 0.3...2.
> w.i.n.2.
> 000000C5  30 00 30 00 33 00 2e 00  69 00 73 00 73 00 77 00 0.0.3...
> i.s.s.w.
> 000000D5  69 00 6e 00 2e 00 69 00  73 00 73 00 2d 00 62 00 i.n...i.
> s.s.-.b.
> 000000E5  67 00 2e 00 63 00 6f 00  6d 00 03 00 32 00 77 00 g...c.o.
> m...2.w.
> 000000F5  69 00 6e 00 32 00 30 00  30 00 33 00 2e 00 69 00 i.n.2.0.
> 0.3...i.
> 00000105  73 00 73 00 77 00 69 00  6e 00 2e 00 69 00 73 00 s.s.w.i.
> n...i.s.
> 00000115  73 00 2d 00 62 00 67 00  2e 00 63 00 6f 00 6d 00 s.-.b.g.
> ..c.o.m.
> 00000125  00 00 00 00                                      ....
>
> 00000150  9d 04 81 9a 4e 54 4c 4d  53 53 50 00 03 00 00 00 ....NTLM
> SSP.....
> 00000160  18 00 18 00 6a 00 00 00  18 00 18 00 82 00 00 00 ....j...
> ........
> 00000170  0a 00 0a 00 48 00 00 00  0e 00 0e 00 52 00 00 00 ....H...
> ....R...
> 00000180  0a 00 0a 00 60 00 00 00  00 00 00 00 9a 00 00 00 ....`...
> ........
> 00000190  05 82 88 a2 05 01 28 0a  00 00 00 0f 50 00 41 00 ......(.
> ....P.A.
> 000001A0  56 00 45 00 4c 00 73 00  74 00 65 00 66 00 61 00 V.E.L.s.
> t.e.f.a.
> 000001B0  6e 00 73 00 50 00 41 00  56 00 45 00 4c 00 75 a4 n.s.P.A.
> V.E.L.u.
> 000001C0  50 b3 20 bc 43 de 00 00  00 00 00 00 00 00 00 00 P. .C...
> ........
> 000001D0  00 00 00 00 00 00 38 04  f5 f9 69 1f 46 46 88 af ......8.
> ..i.FF..
> 000001E0  78 64 6e 83 eb 8b 19 22  48 ae 91 6c 1f 3b       xdn...."
> H..l.;
>
> I wrote this spnegontlm.java test
>
> import java.security.Security;
>
> import gnu.crypto.jce.GnuCrypto;
>
> import Responses;
>
> public class spnegontlm {
>
>   private static void printHex(byte[] data) {
>         for (int i = 0; i < data.length; ++i)
>                 System.out.print(Integer.toHexString(data[i] |
> 0xff000000).substring(6)+" ");
>         System.out.println("");
>   }
>
>   public static void main(String[] args) throws java.lang.Exception {
>         Security.addProvider(new gnu.crypto.jce.GnuCrypto());
>
>         String pass = "test123";
>
>         byte[] challenge = new byte[] {
>                 (byte) 0xfc, (byte) 0xdd, (byte) 0xa9, (byte) 0xf8,
> (byte) 0x88, (byte) 0x77, (byte) 0x0e, (byte) 0x88
>         };
>         byte[] clientChallenge = new byte[] {
>                 (byte) 0x75, (byte) 0xa4, (byte) 0x50, (byte) 0xb3,
> (byte) 0x20, (byte) 0xbc, (byte) 0x43, (byte) 0xde
>         };
>         printHex(challenge);
>
>         printHex(Responses.getLMResponse(pass, challenge));
>         printHex(Responses.getNTLMResponse(pass, challenge));
>         printHex(Responses.getNTLM2SessionResponse(pass, challenge,
> clientChallenge));
>   }
>
> }
>
> challenge is buffer you spot while clientChallenge came from message 3
> (in LM response)
>
> compiled (under Linux) with
>
> gcj -C Responses.java -I/usr/share/java/gnu-crypto-2.0.1.jar
> gcj -C spnegontlm.java -I/usr/share/java/gnu-crypto-2.0.1.jar
>
> (Responses.java from davenport link)
>
> Copied Responses.class and spnegontlm.class to a windows machine (where
> I have sun java installed) with a lib directory from gnu-crypto and
> executed with
>
> java -cp lib\gnu-crypto.jar;. spnegontlm
>
> output is
>
> fc dd a9 f8 88 77 0e 88
> 91 95 49 1c c1 32 fb 5c 9b 30 1a 0f 43 c0 b6 b7 56 78 c4 c7 92 2b 76 09
> 8e d1 4f 19 fc 56 d8 96 28 cb 2d d0 ab b0 ab ad 20 82 b5 66 90 7f 1c 2b
> 38 04 f5 f9 69 1f 46 46 88 af 78 64 6e 83 eb 8b 19 22 48 ae 91 6c 1f 3b
>
> As you can see NTLM2SessionResponse is the same as NTLM response from
> type 3 ntlmssp packet.
>
> freddy77
>
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds