0

I'm doing a search on how windows 10 saves hashed passwords in the SAM file. From this article I suppose that Windows does this: If the password is 123456 and the user has RID 000003E9:

  • CALCULATION OF NTLM * -MD4 (123456) = 32ED87BDB5FDC5E9CBA88547376818D4 (this is the NTLM)

  • Calculation of NTLM hash OBFUSCATED *

  • calculation of K1 and K2 keys for DES I extract the user RID: 000003E9 k1: E9 03 00 00 E9 03 00 ---> I add the parity bit: E980C1010E490D01 k2: 00 E9 03 00 00 E9 03 ---> I add the parity bit: 017540610107A407 Now I use DES-ECB
  • DES calculation (The first half of NTLM [32ED87BDB5FDC5E9]) with key k1 = 83B6CE5A37D27090
  • DES calculation (The second half of NTLM [CBA88547376818D4]) with key k2 = D646976919439227

NTLM obfuscated = DES1 followed by DES2 = 83B6CE5A37D27090D646976919439227

  • NTLM for SAM files *
  • Building Syskey: HKLM\System\CurrentControlSet\Control\LSA{JS,Skew1,GBG,Data} JD = aecec8c5 Skew1 = d1124020 GBG = 7dc19c70 Data = af29004a Now I correlate all the data JD|Skew1|GBG|Data=ae ce c8 c5 d1 12 40 20 7d c1 9c 70 af 29 00 4a Using this SHIFT [8, 5, 4, 2, 11 9, 13 3, 0, 6, 1, 12 14 10 15 7] I produce the SystemKey: 7D12D1C870C129C5AE40CEAF009C4A20

-Extraction of F [0x78] and F [0x88] in KEY_LOCAL_MACHINE\SAM\SAM\Domains\Account F[0x78]= 9d d5 ad 2a 3b 50 c0 5e 13 93 63 e2 29 ce ff 72 F [0x88] should be 32 bytes long but need only serve the first 16 bytes, I insert them all. F[0x88]= 1b 83 55 e1 c9 cb f0 8e a6 8d 83 58 3a 4c c2 f9 (a5 44 50 bf 3f 4b 87 71 bd 0f a7 75 d4 7c 12 89)

  • Extraction of the IV from the SAM file: offset 0xB4 + 0xcc (16byte) in my case is 0x0158 + 0xcc = 0x224 They should be the first 16 bytes but I also publish the next ones. 0300020000000000c09323e07f7aae40(f8 d4 94 46 7b b0 6c 45 03 00 02 00 00 00 00 00 b5 41 64 e8 49 3a cf a4 d4 91 45 98 24 d1 07 7d)

Now I use AES-128 CBC 1- Syskey AES with IV = F [0x78] and KEY = F [0x88] e9 dd c7 32 4a 38 52 58 b7 29 35 eb 17 4c b4 32 d7 da e6 c6 78 53 24 ec 1b 69 d8 32 c1 01 da 46 This is the result, and I believe it should be truncated with the first 16 bytes

Now I use AES-128 CBC 2- AES of NTLM obfuscated with IV = found in the file SAM and KEY = result of the AES key 83B6CE5A37D27090D646976919439227 this result should be the same as in the SAM file.

The calculated result is: 83B6CE5A37D27090D646976919439227 but in the SAM file in HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000003E9 V [0xA8] + 0xcc therefore in my case it is 0x0120 + 0xcc = 0x1ec I find: (they should be only the first 16 bytes but I have also entered the following ones if they are needed for the answer). 03 00 02 00 10 00 00 00 1c 88 f0 7d 6f d1 2c 88 9e 50 e2 e6 02 59 e2 d9 d3 29 52 54 87 72 2f 8a ed 8b cd 7e a0 7c 76 15 78 17 d7 79 3f 30 c0 f4 66 34 78 af 0d e1 d3 1d

Please help me figure out what's wrong with the calculation. I would like to be able to understand the algorithm that windows 10 uses to save the NTLM password to be saved in the SAM.

migrated from crypto.stackexchange.com Jul 22 at 22:56

This question came from our site for software developers, mathematicians and others interested in cryptography.

  • Welcome to crypto.stackexchange - There is a reverse engineering stackexchange, and this looks like it would be a better fit there. Allow me to migrate this there for you. – Ella Rose Jul 22 at 22:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy