Passing the hash

[beagle]

I've got a question. There's a technique called "Passing the hash", in which you simply feed the encrypted password into the challenge issued by the server you're trying to hack, rather than decrypt it using a password cracking tool such as 10phtcrack, which takes time and energy. You can then gain access to the server without knowledge of a valid password, just it's encrypted hash.
That's in theory, anyway. My question is: What if the server has restrictions on it that require the password to be unencrypted? Is there a way around that, or do you have to decrypt the password yourself?
Please reply.

[int3grate]

I've got a question. There's a technique called "Passing the hash", in which you simply feed the encrypted password into the challenge issued by the server you're trying to hack, rather than decrypt it using a password cracking tool such as 10phtcrack, which takes time and energy. You can then gain access to the server without knowledge of a valid password, just it's encrypted hash.
That's in theory, anyway. My question is: What if the server has restrictions on it that require the password to be unencrypted? Is there a way around that, or do you have to decrypt the password yourself?
Please reply.

This only works on Windows with NTLM passwords stored by the LSA (local security authority). This is useful for getting access to SMB shares and Terminal Services with stolen password hashes. Most modern networks use Kerberos or a stronger authentication protocol for almost everything, so these types of attacks are becoming less prevalent.

[beagle]

So I discovered.

[int3grate]

It's a pretty good attack, and not many people know about it. There's a nice toolkit, created by core security that will allow you to exploit these flaws. Learn more about it here: http://oss.coresecurity.com/projects/pshtoolkit.htm

[beagle]

Whoa. That site is AWESOME! I just downloaded IAM.exe from it.

[yourmysin]

Insecure javascript implementations of hashing functions will allow you to replay the hash rather then cracking it. Sorry if this is a bit off topic but I figured it may spike your interest.

Quite a few web development agencies use javascript hashing functions to prevent packet sniffers from grabbing the plaintext password of an insecure web page.