Home » File Formats » File_SMBPasswd » Bug #2327

[2004-09-14 15:30 UTC] heinz at htl-steyr dot ac dot at

Description:
------------
We think that the nthash and the lmhash elements returned by the getAccounts() function are reversed.

Code snippet see below:-

This returns the nthash in $LM ...

Could you please confirm whether this is so !

Thank you

Reproduce code:
---------------
Code snippet

$f = new File_SMBPasswd;
$f->addUser($USER,$UID,$cleartextpasswd,"");
$a = $f->getAccounts();
$LM = $a[$USER]["lmhash"];
$NT = $a[$USER]["nthash"];

Expected result:
----------------
expect the nthash in $NT and
lmhash in $LM

Actual result:
--------------
reversed

[2004-09-14 15:47 UTC] heinz at htl-steyr dot ac dot at

We think we have found the problem area:-

in line 183 -- function addAccountEncrypted()
parameter order is
addAccountEncrypted($user, $userid, $lmhash = '', $nthash = '', $comment = '', $flags = '[U ]')

and in line 221 function addAccount() the function addAccountEncrypted is called like this:-

return $this->addAccountEncrypted(
$user,
$userid,
strtoupper(bin2hex($this->cryptEngine->ntPasswordHash($pass))),
strtoupper(bin2hex($this->cryptEngine->lmPasswordHash($pass))),
$comment,
$flags);

and this shows that nthash and lmhash are in fact reversed.

Similarly for the function modAccountEncrypted in line 276 and modAccount() in line 218

Roger.Morgan roger.morgan@htl-steyr.ac.at
Heinz Schweiger heinz@htl-steyr.ac.at