Re: [PEN-TEST] NT 4.0 and MD4 Hash

[Ryan Russell <ryan () SECURITYFOCUS COM>]

On Wed, 6 Dec 2000, Chad Gough wrote:

> LanMan Hash: 5B4334DA1FB3A5FBAAD3B435B51404EE
> NT hash:    827B5320B42E9FD95CBB0E63451B701E
>
> However, when I MD4 encrypt the string magic I get the following as a
> result:
> 5982FE41BF9A10BB937BD0AB095192B3
>
> The SANS article mentions a unicode convert prior to hashing.  I get
> the string "6D61676963" from a unicode conversion of magic.
>
>
> Neither of these values will equate to the L0pht value.

I think you have to pad it out, as well.

In any case, the L0phtcrack command-line source can be downloaded.  Grab
it, look in ztest.c, and find the md4hash function.  That's the piece
you're looking for.

                                        Ryan