I am trying to understand how an attacker is able to use the halflm challenge rainbow table to obtain the first 7 characters of a windows password that was used to authenticate a user using LM/NTLMv1. To help you understand my confusion, consider this illustrative example:
- Suppose a user(
U) intends to authenticate on a server
- An attacker(
A) uses a Mitm attack to pretend to be the
Uwill send a LM response to the fixed challenge(
C) string sent by the attacker.
Am I correct in my understanding that:
Acan create a rainbow table(
R) whose key is the first 8 characters of the challenge response and whose value is the first 7 characters of the Lanman hash(stored locally in the SAM file).
- obtaining the first 7 characters of the lanman hash is a matter of performing a lookup on
My Question: How does the attacker convert the first 7 characters of the lanman hash to the first 7 characters of the password? The reason I ask is because, to my understanding computing the lanman hash is done by splitting the password into 2 7 character blocks and then using each block to obtain 8 bytes of the lanman hash.
A roundabout way of asking my question is: Wouldnt the attacker need the first 8 bytes of the lanman hash to compute the first 7 characters of the password? If so then how does the attacker obtain the 8th character in the lanman hash(the first 7 are trivial if my understanding is right).