0

It's said that a Windows Machine Account Password is usually composed of 120 characters in UTF-16-LE format. But when looking at the value stored in the Windows Registry under HKLM\SECURITY\Policy\Secrets\$MACHINE.ACC\CurrVal one finds a somewhat random length blob of binary data which is way more than the 240 bytes expected and also doesn't seem to be UTF-16 anymore. I saw lengths of 332, 356, 358 and 382 bytes.

What explains this difference? What is going on? How is the value stored in CurrVal actually put together?

Some background: I try to use a company Wifi which wants me to present this value for authentication. I wrote a small script to extract the value from Samba's /var/lib/samba/private/secrets.tdb (which looks very similar to the one in the Windows Registry) and plug it into a NetworkManager WPA2-Enterprise 802.1x PEAP profile which works fine for me for some years. Currently I try to switch to SSSD which only gives me cleartext 120 bytes UTF-8 (by running adcli update --show-details --show-password) for the Machine Password and I want to figure out how to transform those 120 characters to the Windows-/Samba-like format I can use to authenticate.

3
  • Welcome to the community. What distro are you using?.. Mar 23, 2023 at 20:10
  • I did the Samba workflow of secrets.db machine password to NetworkManager in Arch Linux and now I try to do something similar in Ubuntu 22.04 but with SSSD and not Samba/Winbind. My Registry knowledge is based on Windows 10.
    – thomas
    Mar 24, 2023 at 0:11
  • I've already grepped my way from generate_random_machine_password to secrets_store_machine_pw_sync in the Samba source code but I struggle to understand the important details in secrets_store_domain_info.
    – thomas
    Mar 24, 2023 at 0:31

1 Answer 1

0

A pretty common method is to hash the password (possibly after having added some salt to prevent brute force attacks), which seems to be somewhat supported by the identifiers of the linked source code. Note, that a hashed password contains fully binary byte strings, so any attempt to interpret this as unicode may fail.

1
  • I already thought about that and I think there is a salt like HOST/example.org in use. But wouldn't that imply the size should be constant? Like every MD4 hash is 128 bit. So why would the length vary? It also looks like size differs for the same machine when the password is rotated which happens regularly.
    – thomas
    Apr 15, 2023 at 2:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .