Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I come here asking a simple (yet confusing) question. I have extracted the folowing from cain & able:

PRIVATE.ELMBROOKSCHOOLS.ORG\17grossa        9C4B9F279F6B7091E65FC4055B1C7AC1AC984D9FD0BFCB27FC6572EF85B28877CC249C4777F99C1E863B4544143DB6139BD13D17

In cain is is labeled as "Kerb5 PreAuth Hashes"

What is this? What am I looking at here?

Somehow, the password is contained (or obtainable) from this hash because I can manually guess a password (I Know what it is) and it will show as successful.

This makes no sense to me because in every explanation of Kerberos I have seen the password hash is not transferred over the network at any point.

Followup Question: If I want to import this into john the ripper what catagory does this fall into from here: http://pentestmonkey.net/cheat-sheet/john-the-ripper-hash-formats

Kerberos v5 TGT -OR- MS Kerberos 5 AS-REQ Pre-Auth

share|improve this question

1 Answer 1

up vote 0 down vote accepted

the hash is the timestamp associated with your login, encrypted with the hash of your userpassword. its used to prevent replay attacks. since the hash is based on your password, the success message indicates that if your password is hashed, it will decrypt the hash you captured as a valid datetime within a given time range (I believe the default is 300 seconds). This document covers it under "Example AS Administration" and the following section covers TGT. http://technet.microsoft.com/en-us/library/bb742516.aspx

share|improve this answer
So the password can be obtained from the hash. just find which password decrypts it into a timestamp and then use that password to log in. Right? but I stil dont understand how to get it into JtR –  timv Mar 4 '13 at 1:20
If i understand correctly you're saying that this is a MS Kerberos 5 AS-REQ Pre-Auth packet. on the linked site of JtR hash formats, the AS-REQ has two hashes, separated by a $ –  timv Mar 4 '13 at 1:55
@timv I'm not sure you have this correct. Any number of the right length is a valid timestamp; you'd need to know the time of capture to check the password. More importantly, the thing you got isn't a hash; it's been encrypted (a 2-way function). What makes you think JtR can crack them? –  cpast Mar 4 '13 at 4:43
Well, It has to be some kind of hash beacuse all i needed was to instert a $ after the 32 charecter and JTR decodes to a password! THX guys! –  timv Mar 5 '13 at 0:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.