Ethereal-dev: [Ethereal-dev] NTLMSSP has problems in the challenge decode

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev
From: Richard Sharpe <rsharpe@xxxxxxxxxx>
Date: Sun, 1 Sep 2002 11:44:06 +0930 (CST)
Hi,

I was looking at the NTLMSSP dissector and running it over some data now 
that SPNEGO is working OK, and I noticed two things:

1. We know that the NTLMSSP blob is NDR encoded, so rather than breaking 
it out by hand, it would be a lot more useful if the support in 
packet-dcerpc.c et al was used.

2. The challenge field has a top level ref pointer to a string. That is 
what those unknown1 and unknown2 uint32s are. The first one contains the 
actual and max len for the string and the second is a buffer ref.

I migt get some time next week to rework it if someone else doesn't first.

Regards
-----
Richard Sharpe, rsharpe@xxxxxxxxxx, rsharpe@xxxxxxxxx, 
sharpe@xxxxxxxxxxxx