Assless-Chaps - Crack MSCHAPv2 Challenge/Responses Quickly Using A Database Of NT Hashes

Crack MSCHAPv2/NTLMv1 challenge/responses quickly using a database of NT hashes

Introduction

Assless CHAPs is an efficient way to recover the NT hash used in a MSCHAPv2/NTLMv1 exchange if you have the challenge and response (e.g. from a WiFi EAP WPE attack).

It requires a database of NT hashes, instructions on how to make these from existing lists or using hashcat with wordlists and rules are available below. I've included a sample database from SecLists. You'll need to bunzip it.

Technique

An MSCHAPv2 exchange does not require the clear-text password to be "cracked", rather we merely need the NThash used.

MSCHAPv2 splits the NThash into three parts, and uses each part as different keys to DES encrypt the same challenge (derived from the peer and authenticator challenges). The NTHash is split into two 7-byte keys, and one 2-byte key. This means the last key is padded with NULLs to make a key of the required length. This can be rapidly brute forced due to the efficiency of DES operation and a keyspace of 65 535. Once we have those two bytes, we can look up all NThashes in our database, that end in those two bytes. This provides a much smaller set of possible hashes to check.

This is a form of space vs time tradeoff, similar to a rainbow table. It's also a form of hash shucking.

Presentation

This was first presented at Defcon 29's RF Hacking Village. The slides are included in this repository.

Speed

Here is the comparison for three sample challenge/response's and three different wordlists, a small private one, rockyou, and the Have I Been Pwned list. These were done on my Macbook Pro 2016. Hashcat is using this hash schucking kernel and the two builtin GPUs and a pure rather than optimised kernel (as the latter doesn't exist yet). Hash3 isn't in the lists to simulate worst case performance. I'm not including the time hashcat takes to build the dictionary cache on first run.

Hash1

Small hashlist:

Rockyou hashlist:

HIBP hashlist:

Hash 2

Small hashlist:

Rockyou hashlist:

HIBP hashlist:

Hash 3

Hash 3 doesn't exist in any of the hashlists to simulate a worst case lookup performance.

Small hashlist:

Rockyou hashlist:

HIBP hashlist:

Installing

The rust version will require SQLite 3.6.8 or newer.

The python version requires python3, sqlite3 and pycryptodome.

The database creation utility requires python3 and the sqlite3 CLI.

Compiling

This only applies to the rust version. You'll need cargo.

With cargo installed, merely change to the assless-chaps-rs directory, and build it with: cargo build --release

The resulting binary will be in the target/release/ directory.

Usage

Assless requires the challenge, response and database of NThashes. Optionally, the python version can use the bundled optimised two byte lookup file. The simplest usage looks like this:

./assless-chaps <Challenge> <Response> <hashes.db>

or

python3 assless-chaps.py <Challenge> <Response> <hashes.db>

For example:

./assless-chaps 5d79b2a85966d347 556fdda5f67d2b746ca3315fd8b93adcab5c792790a92e87 rockyou.db or python3 assless-chaps.py 5d79b2a85966d347 556fdda5f67d2b746ca3315fd8b93adcab5c792790a92e87 rockyou.db

The output should look like:

The final full hash 8846f7eaee8fb117ad06bdd830b7586c is the NT hash for password.

Two bytes lookup - Python only for now

I spent some time building a list of all 65 535 possible two byte values sorted by most prevalent across a large corpus of passwords. This file is includes as twobytes. You can just pass it as the fourth argument to assless.

This typically saves a few rounds of DES, but doesn't make a large speed difference. It might if you're doing many hashes.

python3 assless-chaps.py 5d79b2a85966d347 556fdda5f67d2b746ca3315fd8b93adcab5c792790a92e87 rockyou.db twobytes

Creating your own hash dictionary

The mksqlitedb.py file will assist in turning a CSV hash file into the database.

python3 mksqlitedb.py <database name> <csv file>

The CSV file requires three columns:

The last two bytes of the hash (the last four ASCII characters) The first 7 bytes (the first 14 ASCII characters) The second 7 bytes (the 15-29th ASCII characters

For example, the hash 8846f7eaee8fb117ad06bdd830b7586c will become:

586c,8846f7eaee8fb1,17ad06bdd830b7

An example regexp transformation for this would be: echo 8846f7eaee8fb117ad06bdd830b7586c | sed "s/^\(.\{14\}\)\(.\{14\}\)\(.\{4\}\)$/\3,\1,\2/"

You can either take an existing list of hashes (such as the Have I Been Pwned lists or generate your own from hashcat and your favourite wordlist/rules combinations.

Using Have I Been Pwned

The HIBP password lists are already downloadable as NT Hashes, one just needs to remove the count form the file and convert them to CSV format to be imported into the database.

This can be done using the standard Unix utility sed like so:

sed "s/^\(.\{14\}\)\(.\{14\}\)\(.\{4\}\):.*/\3,\1,\2/ pwned-passwords-ntlm-ordered-by-hash.txt" > hibp.csv

After which it can be imported using mksqlitedb.py hibp.db hibp.xsc.

Using hashcat to create a hash csv file from wordlists and rules

You'll need to make a small code change to the mode 1000 OpenCL module to make it spit out every hash, rather than only those matching your crack candidate. By default, it will generate the hash in the right CSV format required.

Change to your hashcat OpenCL directory: cd hashcat/OpenCL Apply the patch: patch < m01000_a0-pure.cl.patch Prepare a file with an impossible to crack NT hash like echo 11111111111111111111111111111111 > impossible_hash Crack as normal, but disable your potfile and redirect the output to a file: hashcat -m1000 impossible_hash rockyou.txt -r best64.rule --potfile-disable --quiet > rockyou.csv Create your hashes database: python3 mksqlitedb.py rockyou.db rockyou.csv

A note on disk space and file sizes

The SQLite database is typically 61% larger that the CSV file used to create it. It can also take some time to create the database depending on the size of files. Prepare your filesystem requirements accordingly.

Here is an example using the rockyou dictionary:

Base rockyou dictionary 129M hashcat generated rockyou.csv 462M Resulting SQLite database rockyou.db 746M BZip2 maximum compression rockyou.db.bz2 339M

You could save space by converting and inserting each hash dynamically and skipping the need for the intermediary CSV file.

NTLMv1 SSP

NTLMv1 will work in exactly the same way, unless it's using SSP. You'll know if SSP is in use if you get an LM response that ends in a bunch of zeros. You can use the included ntlm-ssp.py to produce the server challenge that assless will need.

Run it like this: python3 ntlm-ssp.py <lm response> <challenge>

For example if we use the example NTLMv1-SSP challenge response from the hashcat example hashes: u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c

You would pass in the LM and challenge like so:

python3 ntlm-ssp.py 338d08f8e26de93300000000000000000000000000000000 cb8086049ec4736c

And get the following response:

The server challenge is: 724edf24aea0d68b

Which can then be cracked with assless-chaps like normal:

./assless-chaps 724edf24aea0d68b 9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41 hashes.db