Could not recover last 2 bytes of hash from the challenge/response. #19

atgithub11 · 2017-07-13T20:35:27Z

Hi,

Installed hostapd-wpe by cloning https://github.com/OpenSecurityResearch/hostapd-wpe and all steps were followed as written in the documentation, including applying hostapd-wpe.patch. But each time we run asleap against the captured hashes, following is presented:

Could not recover last 2 bytes of hash from the challenge/response. Sorry it didn't work out.

There was a fix for FreeRADIUS(with_ntdomain_hack = yes) but is there anything similar required for hostapd-wpe?

Also, on another issue raised under aircrack-ng aircrack-ng/aircrack-ng#104
one user had commented that this has been fixed in 2.6 release.

Can someone clarify further on this?

Thanks,

~ A

The text was updated successfully, but these errors were encountered:

Mister-X- · 2017-07-13T20:58:06Z

Obvious questions:

What have you changed in the config files?
What username/password did you use and EAP method? Some logs would be nice (with the user/pass you mention.
What client did you use? Android 4, 5, 6, 7? iOS? Windows? Linux?

atgithub11 · 2017-07-13T21:27:59Z

My bad.. should have added these details:

What have you changed in the config files?
No additional changes made other than those mentioned in documentation here.

What username/password did you use and EAP method? Some logs would be nice (with the user/pass you mention.
If I enter credentials manually when connecting to this AP then the resulting Hash works well with asleap.

It's only when a device tries to authenticate using cached credentials when we are running into this issue. It does record username with **DOMAIN**username
Method is EAP-MSCHAPv2

What client did you use? Android 4, 5, 6, 7? iOS? Windows? Linux?
Client is Windows.

ama21n · 2017-09-21T03:00:57Z

I've had this problem for a couple of years now and just installed a fresh copy of v2.6, it seems the issue is still present and extremely easy to replicate. I simply used an iPhone to connect using the following 2 usernames, both with password 'aaa':

aaa
dom\aaa

Relevant outputs below:

# uname -a
Linux kali 4.4.0-kali1-686 #1 SMP Debian 4.4.2-3kali1 (2016-02-23) i686 GNU/Linux

# ./hostapd-wpe -v
hostapd-wpe v2.6

# cat /tmp/dict.txt
pass
aaa
bbb

Challenge/response with domain
username: dom\aaa
challenge: a1:f9:d9:95:8b:ce:a7:51
response: 75:ab:6b:2a:e7:a9:d6:1e:57:83:33:1f:3d:ab:e0:b6:dc:c5:10:63:28:4d:5a:ea
jtr NETNTLM: dom\aaa:$NETNTLM$a1f9d9958bcea751$75ab6b2ae7a9d61e5783331f3dabe0b6dcc51063284d5aea

Challenge/response without domain
username: aaa
challenge: 4e:f3:ca:26:a8:db:91:d7
response: ad:0f:74:12:04:b8:a5:8d:0f:80:79:2f:b2:05:eb:6c:bd:99:a3:98:70:a7:3d:99
jtr NETNTLM: aaa:$NETNTLM$4ef3ca26a8db91d7$ad0f741204b8a58d0f80792fb205eb6cbd99a39870a73d99

Asleap crack attempt with domain user challenge/response
# asleap -C a1:f9:d9:95:8b:ce:a7:51 -R 75:ab:6b:2a:e7:a9:d6:1e:57:83:33:1f:3d:ab:e0:b6:dc:c5:10:63:28:4d:5a:ea -W /tmp/dict.txt
asleap 2.2 - actively recover LEAP/PPTP passwords. [email protected]
Using wordlist mode with "/tmp/dict.txt".
Could not recover last 2 bytes of hash from the
challenge/response. Sorry it didn't work out.

Asleap crack attempt with non-domain user challenge/response
# asleap -C 4e:f3:ca:26:a8:db:91:d7 -R ad:0f:74:12:04:b8:a5:8d:0f:80:79:2f:b2:05:eb:6c:bd:99:a3:98:70:a7:3d:99 -W /tmp/dict.txt
asleap 2.2 - actively recover LEAP/PPTP passwords. [email protected]
Using wordlist mode with "/tmp/dict.txt".
hash bytes: eff6
NT hash: e24106942bf38bcf57a6a4b29016eff6
password: aaa

Is someone able to assist?

Rogdham · 2017-10-04T13:02:35Z

I believe the issue it the one I fixed in #4.

I will try and update that patch to match v2.6.

Rogdham · 2017-10-04T17:28:38Z

I've updated #4 and confirmed it working with v2.6.

@atgithub11 @ama21n : could you try it on your side and report your results?

ama21n · 2017-10-05T05:24:49Z

Yep, works perfectly for me. Great stuff Rogdham!

ama21n · 2018-04-17T01:46:06Z

I've just tried this again using the same build that was previously working, and I can see the domain gets passed through again both with windows 10 and with iPhone 6 (version 11.3). This causes cracking to fail once again... See below:

**mschapv2: Mon Apr 16 21:30:41 2018
username: dom\aaa
challenge: a5:0a:68:f6:5a:07:b6:c6
response: 43:11:9c:ce:5a:8e:81:32:72:3c:6b:78:7b:0b:35:f8:53:e4:d5:c8:e8:49:3e:2d
jtr NETNTLM: dom\aaa:$NETNTLM$a50a68f65a07b6c6$43119cce5a8e8132723c6b787b0b35f853e4d5c8e8493e2d

Could not recover last 2 bytes of hash from the challenge/response. Sorry it didn't work out.**

I rebuilt hostapd version 2.6 (on Linux kali 4.4.0-kali1-686 #1 SMP Debian 4.4.2-3kali1) with the patch referenced above again just to be doubly sure, same result. Any reason why this might be happening, or any further output I could provide to help troubleshoot?

Rogdham · 2018-04-17T07:51:24Z

**mschapv2: Mon Apr 16 21:30:41 2018
username: dom\aaa
challenge: a5:0a:68:f6:5a:07:b6:c6
response: 43:11:9c:ce:5a:8e:81:32:72:3c:6b:78:7b:0b:35:f8:53:e4:d5:c8:e8:49:3e:2d
jtr NETNTLM: dom\aaa:$NETNTLM$a50a68f65a07b6c6$43119cce5a8e8132723c6b787b0b35f853e4d5c8e8493e2d

Could not recover last 2 bytes of hash from the challenge/response. Sorry it didn't work out.**

Helldo @ama21n,

Your challenges and response seems to be working on my side:

$ asleap -C a5:0a:68:f6:5a:07:b6:c6 -R 43:11:9c:ce:5a:8e:81:32:72:3c:6b:78:7b:0b:35:f8:53:e4:d5:c8:e8:49:3e:2d -W rockyou.txt 
asleap 2.2 - actively recover LEAP/PPTP passwords. <[email protected]>
Using wordlist mode with "rockyou.txt".
	hash bytes:        eff6
	NT hash:           e24106942bf38bcf57a6a4b29016eff6
	password:          aaa

So it seems that the challenge/response captured by hostapd-wpe are valid.

How did you call asleep?

ama21n · 2018-04-17T08:44:08Z

Ahh, you're spot on, not sure what I typed earlier, bash history's been blasted... i'm blaming jetlag ;) thanks for verifying rogdham

fer19861986 · 2022-03-17T23:38:49Z

I'm facing the same error
Could not recover last 2 bytes of hash from the challenge/response. Sorry it didn't work out.
I'm trying with the same challenge/response that was posted before. The same command worked for others users.
However when I run the same command I got this error.

└─$ asleap -v -C a5:0a:68:f6:5a:07:b6:c6 -R 43:11:9c:ce:5a:8e:81:32:72:3c:6b:78:7b:0b:35:f8:53:e4:d5:c8:e8:49:3e:2d -W test.txt   
asleap 2.3 - actively recover LEAP/PPTP passwords. <[email protected]>
Using wordlist mode with "test.txt".
        Attempting to recover last 2 of hash.
        Could not recover last 2 bytes of hash from the
        challenge/response.  Sorry it didn't work out.

I'm using the following password dictionary which contains the correct password aaa

└─$ cat test.txt                                                                                                                           
a
aa
aaa
aaaa
aaaaa

in a previous message @Rogdham executed the same command and it worked

Helldo @ama21n,

Your challenges and response seems to be working on my side:

$ asleap -C a5:0a:68:f6:5a:07:b6:c6 -R 43:11:9c:ce:5a:8e:81:32:72:3c:6b:78:7b:0b:35:f8:53:e4:d5:c8:e8:49:3e:2d -W rockyou.txt 
asleap 2.2 - actively recover LEAP/PPTP passwords. <[email protected]>
Using wordlist mode with "rockyou.txt".
	hash bytes:        eff6
	NT hash:           e24106942bf38bcf57a6a4b29016eff6
	password:          aaa

I'm running asleap version 2.3 (the one included in the current KALI distribution)

└─$ asleap -V                                                                                                                              
asleap 2.3 - actively recover LEAP/PPTP passwords. <[email protected]>
Version $Id: asleap.c,v 1.30 2007/05/10 19:29:06 jwright Exp $

I'm running the following Kali distro

└─$ uname -a
Linux kali 5.9.0-kali1-amd64 #1 SMP Debian 5.9.1-1kali2 (2020-10-29) x86_64 GNU/Linux

I've try to run asleap version 2.2 instead of 2.3, however I'm not able to compile it.

Could someone give me a clue about what is going on?

Rogdham · 2022-03-18T06:55:31Z

@fer19861986 the version of asleap currently distributed in Kali is broken; see the relevant issue on GitHub here.

For now I suggest reverting on asleap version 2.2 or building it from source yourself.

Alternatively, you could use John The Ripper instead, like so:

# put the "jtr NETNTLM:" part in hash.txt

$ cat hash.txt
aaa:$NETNTLM$4ef3ca26a8db91d7$ad0f741204b8a58d0f80792fb205eb6cbd99a39870a73d99

# use JTR to crack it, e.g. with the dictionary in test.txt

$ john --format=netntlm -w:test.txt hash.txt
Using default input encoding: UTF-8
Loaded 1 password hash (netntlm, NTLMv1 C/R [MD4 DES (ESS MD5) 128/128 AVX 4x3])
Warning: no OpenMP support for this hash type, consider --fork=8
Press 'q' or Ctrl-C to abort, almost any other key for status
Warning: Only 5 candidates left, minimum 1020 needed for performance.
aaa              (aaa)
1g 0:00:00:00 DONE (2022-03-18 07:59) 100.0g/s 500.0p/s 500.0c/s 500.0C/s a..aaaaa
Use the "--show --format=netntlm" options to display all of the cracked passwords reliably
Session completed

atezet · 2022-11-23T13:40:03Z

For now I suggest reverting on asleap version 2.2 or building it from source yourself.

@Rogdham Any help on how to revert to version 2.2?

Rogdham · 2022-11-23T18:59:53Z

@arjentz I really don't know. However you could always try to build from source (should be fast & straightforward like running the commands below), or simply using john as I mentioned in my last message.

$ git clone https://github.com/joswr1ght/asleap
$ cd asleap
$ make
$ ./asleap -V

atezet · 2022-11-23T21:25:22Z

Thanks. That's what I tried (and checked out an old version), but it didn't work because it couldn't find -lxcrypt and that's where I got stuck. I hoped there was some easier way to install an older version that I overlooked.

Anyway, john worked perfectly. I just wanted to try out asleap as well.

Rogdham · 2022-11-24T09:14:42Z

I suggest reporting issues when installing asleap on their repository 😉

ama21n mentioned this issue Sep 21, 2017

hostapd-wpe and with_ntdomain_hack aircrack-ng/aircrack-ng-archive#104

Closed

Rogdham mentioned this issue Oct 4, 2017

Fix challenge_hash when user starts with "domain\" #4

Merged

brad-anton closed this as completed Nov 22, 2017

aircrack-ng mentioned this issue Mar 10, 2018

hostapd-wpe and with_ntdomain_hack aircrack-ng/aircrack-ng#1793

Closed

AdonisPro mentioned this issue Feb 28, 2022

V 2.6 and V 2.9 both gives: Could not recover last 2 bytes of hash from the challenge/response. Sorry it didn't work out #32

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Could not recover last 2 bytes of hash from the challenge/response. #19

Could not recover last 2 bytes of hash from the challenge/response. #19

atgithub11 commented Jul 13, 2017 •

edited

Loading

Mister-X- commented Jul 13, 2017

atgithub11 commented Jul 13, 2017

ama21n commented Sep 21, 2017

Rogdham commented Oct 4, 2017

Rogdham commented Oct 4, 2017

ama21n commented Oct 5, 2017

ama21n commented Apr 17, 2018

Rogdham commented Apr 17, 2018 •

edited

Loading

ama21n commented Apr 17, 2018

fer19861986 commented Mar 17, 2022 •

edited

Loading

Rogdham commented Mar 18, 2022 •

edited

Loading

atezet commented Nov 23, 2022

Rogdham commented Nov 23, 2022

atezet commented Nov 23, 2022

Rogdham commented Nov 24, 2022

Could not recover last 2 bytes of hash from the challenge/response. #19

Could not recover last 2 bytes of hash from the challenge/response. #19

Comments

atgithub11 commented Jul 13, 2017 • edited Loading

Mister-X- commented Jul 13, 2017

atgithub11 commented Jul 13, 2017

ama21n commented Sep 21, 2017

Rogdham commented Oct 4, 2017

Rogdham commented Oct 4, 2017

ama21n commented Oct 5, 2017

ama21n commented Apr 17, 2018

Rogdham commented Apr 17, 2018 • edited Loading

ama21n commented Apr 17, 2018

fer19861986 commented Mar 17, 2022 • edited Loading

Rogdham commented Mar 18, 2022 • edited Loading

atezet commented Nov 23, 2022

Rogdham commented Nov 23, 2022

atezet commented Nov 23, 2022

Rogdham commented Nov 24, 2022

atgithub11 commented Jul 13, 2017 •

edited

Loading

Rogdham commented Apr 17, 2018 •

edited

Loading

fer19861986 commented Mar 17, 2022 •

edited

Loading

Rogdham commented Mar 18, 2022 •

edited

Loading