Passwordsstoredusingreversibleencryption:howitworks(part1)

IncaseyoumissedmyHAR2009talk:inthesecondpartItalkedaboutaWindowsfeaturecalled
Storepasswordsusingreversibleencryption.Whenthisisenabled(peruserorfortheentire
domain),Windowsstoresthepasswordencrypted,butinsuchawaythatitcanreversethe
encryptionandrecovertheplaintextpassword.Thisfeatureexistsbecausesomeauthentication
protocolsrequiretheplaintextpasswordtofunctioncorrectly,thetwomostcommonexamplesare
HTTPDigestAuthenticationandCHAP.
ThisfeatureisnotenabledbydefaultbutIveseenitacoupleoftimesincustomernetworks.AsI
couldntfindanydescriptionofhowthismechanismworksoranytooltorecoverthesepasswords,I
decidedtoinvestigate.
Whenyouchangeyourpasswordonadomainthathasreversibleencryptionenabled,apassword
filtercalledRASSFM.DLLisusedtostorethepasswordusingreversibleencryption.Thekeythatis
usedtodothisisG$MSRADIUSCHAPKEY,whichisstoredasaglobalLSAsecret.Thiskeyis
decryptedusingastatickey(hardcodedintheDLL).Theresultofthisoperationiscombinedwitha
16byterandomvalue(generatedeverytimesomeonechangestheirpassword)andthatkeyis
usedtoencryptaUnicodeversionofthepasswordusingtheRC4algorithm.
IfoundoutthesepasswordsarestoredinActiveDirectoryinaperuserstructurecalled
userParameters.IfyouuseatoolsuchasADExploreryoucanlookatthisstructureinanADthat
hasenabledthisfeature.Whenyoulookatthisstructure,itlookslikeabinaryblob,withsome
humanreadablepartsinthere.Whenyouenablereversibleencryptionyouwillnoticetworeadable
strings:G$RADIUSCHAPandG$RADIUSCHAPKEY.TheuserParameterscanalsobeusedtostore
settingsunrelatedtoreversibleencryption,suchasperuserTerminalServersettings.
FollowingtheG$RADIUSCHAPpartistheasciihexencodedencryptedpassword.Thepartfollowing
theG$RADIUSCHAPKEYnameisthe16byterandomvalue.
Sotodecryptthispasswordweusethefollowingsteps:
TaketheG$MSRADIUSCHAPKEYGlobalLSAsecret
Decryptitusingthestatickey
ParsetheuserParametersstructureandextracttheG$RADIUSCHAPandG$RADIUSCHAPKEY
values
CombinethevalueofG$RADIUSCHAPKEY(the16byterandom)withthedecryptedLSAsecretto
createanRC4key
DecryptthevalueofG$RADIUSCHAPusingthatRC4key
TheresultisaplaintextUnicodepassword.Mytool'Revdump'automatesthisprocedure.
Inparttwoofthisarticle,Iwilllookatthesecurityofthismechanism.
PostedbyNielsTeusinkat7:36PM
Labels:reversibleencryption,security,vulnerability

3comments:
JayBensonsaid...
Agoodpost,lookingforwardtoparttwo.Thisisactuallyverytimely,I'vebeenaskedtofind
outifthereissomewaytodetectthisisinusepriortodiablingit.
Youmentiontwoprotocolsthatwecouldmonitorfor,areyouawareofanyothers,orpoint
metosomeresearchinthatspace?

Thanks!
October5,2009at5:24PM

Bonadiosaid...
HiNiels
IdownloadedancompiledRevdump0.2,
whenIrunitonmyWindows2008server32bitsitalwayssays:
D:\revdump>revdump
RevDump0.2byNielsTeusink
LsaRetrievePrivateDatareturned2
ERR:CannotgetLSAsecret,maybethisisnotadomaincontrollerorreversible
encryptionisdisabled?
Ihaveenabledreversiblepasswardforjustoneuserandchangedhispassword.
AmImissinganything
Thanks
December16,2009at7:10PM

NielsTeusinksaid...
@Jay
Youcouldprobablywriteascripttoseewhichaccountshavethe'Storepasswordusing
reversibleencryption'flagon.
@Bonadio
YesItrieditonWindows2008aswellrecently.Itdoesn'tseemtowork,itseemsMicrosoft
haschangedsomethings.
January6,2010at8:16PM

PostaComment