OpenSecurityResearch/hostapd-wpe — pull request #4 by Rogdham (2014-11-29 10:45:06+00:00)
Title: Fix challenge_hash when user starts with "domain\"

Some clients (e.g. with Windows) send `domain\username` as the user, but do the computations for the challenge/response with `username` only.

In freeradius, that was solved with the directive `with_ntdomain_hack = yes`.

Here, I did not see any directive that looks like it.

---

As a result, we obtain wrong NETNTLM output. For example, with domain `abc`, username `def` and password `qwerty`:
- Before the patch: `NETNTLM:
abc\def:$NETNTLM$b081024eca01be3f$ca96218159d29a8443506fc2b5e1a86e41eec71f7abe8119`;
- After the patch: `NETNTLM:
abc\def:$NETNTLM$b71e3c37cd629d7d$dac787f9f3f721bb7a985c2f92f262c1668653f140f443c4`.

There is no way to break the first one, the second one is found within seconds with John the Ripper.

---

I have a few questions though:
- Could it be possible that some clients do use the `domain\` part to compute the challenge-response? In other words, will this patch will not work with those clients?
- If so, would it make sense to let the choice to the user, as a configuration option in hostapd-wpe.conf?

---

Finally, the code diff in this PR is quite simple, but as we see a diff of a diff, it starts to looks confusing. But there is probably a rationale behind storing a patch on the git repo instead of a modified hostapd source.