Extracting Kerberos passwords through RC4-HMAC encryption type analysis

Abstract

In this paper, we propose a system and method for obtaining Kerberos passwords by capturing a single packet, encrypted using the RC4-HMAC encryption type. We present two methods that when combined together, can reduce the time needed to crack a password by 60.2% over brute force. The first method uses known text in the preauthentication phase to skip the verification section of the decryption process. The second method precomputes some of the steps of the RC4-HMAC decryption process. We also present a novel method of eliminating the amount of space needed to store passwords in memory by using a counter to map hashes to their password.