Project

General

Profile

Bug #1558

NTLM authentication fails because MD4 is not available

Added by Luke Murphey about 8 years ago. Updated over 7 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Start date:
11/09/2016
Due date:
% Done:

100%


History

#1 Updated by Luke Murphey about 8 years ago

import hashlib
m = hashlib.new('md4')

#2 Updated by Luke Murphey about 8 years ago

Splunk only supports: ('md5', 'sha1', 'sha224', 'sha256', 'sha384', 'sha512')

import hashlib
hashlib.algorithms

#4 Updated by Luke Murphey about 8 years ago

Odd, this is the call that fails but that should work on my host:

digest = hashlib.new('md4', passwd.encode('utf-16le')).digest()

This works on my host:

bin/splunk cmd python -c "import hashlib;print hashlib.new('md4', 'test').hexdigest()" 

That prints: db346d691d7acc4dc2625db19f9e3f52

#5 Updated by Luke Murphey about 8 years ago

This didn't work for me on Windows 10 Pro with Splunk 6.5 (Python 2.7.11).

#6 Updated by Luke Murphey about 8 years ago

The unit tests fail on Windows but pass on *nix.

#7 Updated by Luke Murphey almost 8 years ago

  • Assignee set to Luke Murphey
  • Target version set to 2.0.1

#9 Updated by Luke Murphey almost 8 years ago

They are retirning the same value but the custom implementation returns a hex array string.

#10 Updated by Luke Murphey almost 8 years ago

  • Status changed from New to Closed
  • % Done changed from 0 to 100

#11 Updated by Luke Murphey almost 8 years ago

import hashlib
from md4 import MD4

def hash_md4(data):
    md4 = MD4()
    md4.update(data)
    return md4

def hash_md4_orig(data):
    return hashlib.new('md4', data)

d = "tree" 
new = hash_md4(d).digest()
expected = '\xb6\x84+C\xe7L$\xbbM\x14\xd2N\xd5\x10d\xcb'

if new == expected:
    print "hash matches" 
else:
    print "hash does not match" 

orig = hash_md4_orig(d).digest()

if orig == expected:
    print "orig hash matches" 
else:
    print "orig hash does not match" 

#12 Updated by Luke Murphey almost 8 years ago

  • Status changed from Closed to In Progress

This works on my mac but I get a different hash on Windows.

#13 Updated by Luke Murphey almost 8 years ago

  • Status changed from In Progress to Closed

Also available in: Atom PDF