drizztbsd/ettercap — Issue #21: Properly dump NTLMv2 Challenge/responses
Author: bonsaiviking
Created: 2011-11-15 16:51:16+00:00
State: open

Found this on John-the-Ripper users mailing list: http://www.openwall.com/lists/john-users/2011/11/14/1

In short, ettercap dumps NTLMv2 challenge-response authentication using NTLMv1 format, which is missing the username and domain. Also, there should be 2 challenges: one for server and one for client.

Old format (still valid for NTLMv1):
USERNAME:::LM RESPONSE:NTLM RESPONSE:CHALLENGE

New format (NTLMv2):
USERNAME::DOMAIN:SERVER CHALLENGE:NTLMv2 RESPONSE:CLIENT CHALLENGE