nt-part2_6
Analysis of the Security of Windows NT
1 March 1999
6
Appendix
A
Cryptographic Calculations......................................................................78
A.1
Calculation of Session Keys ...................................................................................78
A.2
Calculation of Credentials for Secure Channel Establishment ..............................78
A.3
Calculation of Credentials Used after Secure Channel Setup ................................78
A.4
Calculations of RC4 Encrypted Passwords ............................................................79
A.5
Calculation of Challenge Response........................................................................79
A.6
Calculation of SMB Signing ..................................................................................79
A.7
Challenge-Handshake Authentication Protocol (CHAP) .......................................79
B
The Domain Logon Process ......................................................................80
C
SMB Data Structures ................................................................................84
D
Utility Programs.........................................................................................86
D.1
Security Analysis Programs ...................................................................................86
D.1.1
L0phtcrack ...............................................................................................86
D.1.2
Crack for NT............................................................................................86
D.1.3
C2CONFIG..............................................................................................86
D.1.4
DumpACL ...............................................................................................86
D.1.5
Kane Security Analyst (KSA) .................................................................87
D.1.6
Internet Scanner for NT (IS)....................................................................87
D.2
Information Retrieval Programs .............................................................................87
D.2.1
Windows NT Password Dump Utility (PWDump) .................................87
D.2.2
SAMDump...............................................................................................88
D.2.3
Access to functions and variables in NTOSKRNL (NTExport) .............88
D.2.4
NT Registry Monitor (NTRegmon).........................................................88
D.2.5
NT File System Monitor (NTFilemon) ...................................................89
D.2.6
NT Process Monitor (NTPmon) ..............................................................89
D.2.7
Object Manager Name Space Viewer (WinObj) .....................................89
D.2.8
Microsoft Network Monitor ....................................................................89
D.3
Maintenance Programs ...........................................................................................90
D.3.1
NTFSDOS ...............................................................................................90
D.3.2
NTFS Tools .............................................................................................90
D.3.3
ERD Commander.....................................................................................90
D.3.4
NTRecover...............................................................................................91
D.3.5
Ghost........................................................................................................91
D.4
Keyboard Filtering (ctrl2cap) .................................................................................91
E
URLs ...........................................................................................................93
F
Newsgroups ................................................................................................94
G
Terminology ...............................................................................................95