RE: COELACANTH: Phreak Phishing Expedition]
One final addendum to this ongoing thread
Drew Copley was kind enough to point out to me that can steal any user's
windows password simply by having them view a specially prepared page using
this exploit
What basically happens is that the server sends an 8 byte challenge to the
browser, the browser uses the lanman and nt password hashes to generate a
response by appending some zero's to the hash and then using it as a des key
to encode the message. This message explains it more thoroughly
http://www.insecure.org/sploits/l0phtcrack.lanman.problems.html
If you know the response and you know the challenge (obviously we do since
we control what's being sent) you can crack it quite easily using l0phtcrack
Amazing that that insecure lanman hash is still being sent after all that
time
Anyway great find Bitlance winter!!
Updated demo at
http://jelmer.homedns.org/test2.htm
Updated (very messy) code at
http://jelmer.homedns.org/code2.zip
This page does a pretty good job at describing the ntlm protocol
http://www.innovation.ch/java/ntlm.html