Luke Leighton dab1a12278 you know what? this sort of thing makes me laugh. hmm, what functions ... have we got. and what data do we have. hmm.. i wonder what the NTLMv2 user session key can be... hmmm... weell.... there's some hidden data here, generated from the user password that doesn't go over-the-wire, so that's _got_ to be involved. and... that bit of data took a lot of computation to produce, so it's probably _also_ involved... and md4 no, md5? no, how about hmac_md5 yes let's try that one (the other's didn't work) oh goodie, it worked! i love it when this sort of thing happens. took all of fifteen minutes to guess it. tried concatenating client and server challenges. tried concatenating _random_ bits of client and server challenges. tried md5 of the above. tried hmac_md5 of the above. eventually, it boils down to this: kr = MD4(NT#,username,domainname) hmacntchal=hmac_md5(kr, nt server challenge) sess_key = hmac_md5(kr, hmacntchal); (This used to be commit ab174759cd)		1999-11-21 19:24:01 +00:00
..
cmd_atsvc.c	Fixed typo which was preventing the omission of seconds in the 'at' command.	1999-11-01 12:11:05 +00:00
cmd_brs.c	added \PIPE\browser plus experimental brsinfo command. you wouldn't	1999-11-19 00:12:16 +00:00
cmd_eventlog.c	event log update	1999-08-18 20:11:29 +00:00
cmd_lsarpc.c	adding experimental set user password command to rpcclient, it returns	1999-11-04 00:09:15 +00:00
cmd_netlogon.c	adding extra parameter back in to trust account functions (trust account name).	1999-10-26 16:46:45 +00:00
cmd_reg.c	updating reg_value_info() parsing code to take BUFFER2 instead of just	1999-11-18 17:57:21 +00:00
cmd_samr.c	you know what? this sort of thing makes me laugh. hmm, what functions	1999-11-21 19:24:01 +00:00
cmd_spoolss.c	debugging rpcclient spoolenum and spooljobs commands. oh, did i forget	1999-11-09 19:35:30 +00:00
cmd_srvsvc.c	const feeding frenzy	1999-11-08 20:58:06 +00:00
cmd_svcctl.c	const feeding frenzy	1999-11-08 20:58:06 +00:00
cmd_wkssvc.c	removed nt_pipe_fnum from struct cli_state. need to be able to call	1998-12-07 20:23:41 +00:00
display.c	debugging rpcclient spoolenum and spooljobs commands. oh, did i forget	1999-11-09 19:35:30 +00:00
rpcclient.c	added \PIPE\browser plus experimental brsinfo command. you wouldn't	1999-11-19 00:12:16 +00:00