全網首一份！你最需要的PPTP MS-CHAP V2 挑戰響應程式設計模擬計算教程！程式碼基於RFC2759，附全部原始碼！

本文基於網路密碼課上的實驗

本來想水一水就過去，程式碼就網上找找，不行就GPT寫，但是！一份都找不到，找到的程式碼都是跑不了的，總會是就是亂七八糟。所以準備認真的寫一份。

程式碼編譯成功的前提是要預先裝好openssl庫！

本隨筆主要有三個內容：

1. 編寫程式，模擬計算NTResponse、AuthenticatorResponse,
2. 根據前期PPTP實驗中捕獲的資料包中CHAP協議的挑戰響應認證資料，在未知使用者口令情況下程式設計實現CHAP認證口令的破解

在單向資料條件下(僅能截獲使用者資料)實現CHAP認證口令的破解

首先放一個我自己抓的包，可以看到，這是chap協議挑戰響應的三次握手，

那麼我們繼續進行，程式設計模擬，就要先搞清楚每個欄位代表的什麼，文件中第一個包的描述，給的是Authenticator challenge

也就是我住的第一個包裡的value

這是第二個包，16位元組peer-challenge，8位的0,24位的NT-Response

value內的值，對應看

第三個包，內容是s=authticator-response

接下來我們開始程式設計實現，每一個欄位都是由對應的函式計算得出

一、編寫程式，模擬計算NTResponse、AuthenticatorResponse

1.查閱RFC2759文件，找到描述的計算NTResponse的函式

NT-Response的值是由GenerateNTResponse()計算得出，看到該函式有四個輸入，分別是AuthenticatorChallenge（16）、PeerChallenge（16）、UserName和Password，一個輸出Response（24）

此外，有三個函式對輸入進行處理：ChallengeHash：對兩個挑戰值hash，結果放到challenge中。NtPasswordHash：對password做hash，結果放到password中。ChallengeResponse：對challenge和passwordhash做運算，結果得到NT-Response。

2.根據文件描述編寫程式碼

GenerateNTResponse（）函式

void GenerateNTResponse(const HCRYPTPROV hProv, const BYTE* auth_challenge, const BYTE* peer_challenge, const char* user_name, const wchar_t* password, BYTE* response)
{
    BYTE challenge[8];
    BYTE password_hash[16];

    _ChallengeHash(hProv, peer_challenge, auth_challenge, user_name, challenge);
    _NtPasswordHash(hProv, password, password_hash);
    _ChallengeResponse(hProv, challenge, password_hash, response);
}

_ChallengeHash（）函式，對peer challenge、auth challenge、user name連線然後進行sha1雜湊，結果放到challenge中返回

void _ChallengeHash(const HCRYPTPROV hProv, const BYTE* peer_challenge, const BYTE* auth_challenge, const char* user_name, BYTE* challenge)
{
    HCRYPTHASH hHash = 0;
    if (!CryptCreateHash(hProv, CALG_SHA1, 0, 0, &hHash))
        throw "CryptCreateHash failed (SHA1)";
    if (!CryptHashData(hHash, peer_challenge, 16, 0))
        throw "CryptHashData failed (peer challenge)";
    if (!CryptHashData(hHash, auth_challenge, 16, 0))
        throw "CryptHashData failed (auth challenge)";
    if (!CryptHashData(hHash, (const BYTE*)user_name,
        (DWORD)strlen(user_name), 0))
        throw "CryptHashData failed (user name)";
    DWORD hash_len = SHA1LEN;
    BYTE hash_buffer[SHA1LEN];
    if (!CryptGetHashParam(hHash, HP_HASHVAL, hash_buffer,
        &hash_len, 0))
        throw "CryptGetHashParam failed (challenge hash)";
    memcpy(challenge, hash_buffer, 8);

}

_NtPasswordHash函式（）：將password做MD4雜湊，然後返回password_hash中

void _NtPasswordHash(const HCRYPTPROV hProv, const wchar_t* password, BYTE* password_hash)
{
    HCRYPTHASH hHash = 0;
    if (!CryptCreateHash(hProv, CALG_MD4, 0, 0, &hHash))
        throw "CryptCreateHash failed (MD4)";
    if (!CryptHashData(hHash, (const BYTE*)password, lstrlenW(password) << 1, 0))
        throw "CryptHashData failed (user password)";
    DWORD hash_len = MD4LEN;
    BYTE hash_buffer[MD4LEN];
    if (!CryptGetHashParam(hHash, HP_HASHVAL, hash_buffer, &hash_len, 0))
        throw "CryptGetHashParam failed (NT password hash)";
    memcpy(password_hash, hash_buffer, 16);
}

ChallengeResponse()函式：首先將16位passwordhash後面填充五個0變成21位，接著分成三個長度為7的金鑰，分別對challenge做三次DES加密，三次加密結果放到response中

void _ChallengeResponse(const HCRYPTPROV hProv, const BYTE* challenge, const BYTE* password_hash, BYTE* response)
{
    BYTE z_password_hash[21];
    memset(z_password_hash, 0, 21);
    memcpy(z_password_hash, password_hash, 16);

    _DesEncrypt(hProv, challenge, z_password_hash, response);
    _DesEncrypt(hProv, challenge, z_password_hash + 7, response + 8);
    _DesEncrypt(hProv, challenge, z_password_hash + 14, response + 16);
}

接下來我們來看DES加密函式，由於每次給的金鑰都是7位長度，所以加密前首先呼叫EXPAND（）函式對金鑰進行擴充套件，擴充套件到8位，這裡的加密模式是ECB（電子密碼本）加密，加密的結果放到result中

typedef struct {
    BLOBHEADER key_header;
    DWORD key_length;
    BYTE key_data[8];
} DESKey;

void EXPAND(BYTE* key);

void _DesEncrypt(const HCRYPTPROV hProv, const BYTE* data, const BYTE* key, BYTE* result)
{
    // Fill CryptoAPI-required key structure
    DESKey des_key;
    des_key.key_header.bType = PLAINTEXTKEYBLOB;
    des_key.key_header.bVersion = CUR_BLOB_VERSION;
    des_key.key_header.reserved = 0;
    des_key.key_header.aiKeyAlg = CALG_DES;
    des_key.key_length = 8;
    memcpy(des_key.key_data, key, 7);
    EXPAND(des_key.key_data);

    HCRYPTKEY hKey;
    // import key BLOB
    if (!CryptImportKey(hProv, (BYTE*)&des_key,
        sizeof(des_key), 0, 0, &hKey))
        throw "CryptImportKey failed";
    // set ECB mode required by RFC
    DWORD des_mode = CRYPT_MODE_ECB;
    if (!CryptSetKeyParam(hKey, KP_MODE, (BYTE*)&des_mode, 0))
        throw "CryptSetKeyParam failed (ECB mode)";
    // set initialization vector
    BYTE IV[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
    if (!CryptSetKeyParam(hKey, KP_IV, &IV[0], 0))
        throw "CryptSetKeyParam failed (init vector)";
    // encrypt
    DWORD data_len = 8;
    memcpy(result, data, 8);    // encrypt in-place
    if (!CryptEncrypt(hKey, 0, FALSE, 0, (BYTE*)&result[0], &data_len, 8))
        throw "CryptEncrypt failed (DES)";
}

下面來看一下金鑰擴充套件函式，該函式的具體流程如下：

1. 建立了一個名為new_key的位元組陣列，用於儲存擴充套件後的金鑰。
2. 接下來，使用一個迴圈來處理每個7位的資料包。迴圈從0到7迭代，共8次。
3. 在每次迭代中，根據當前的索引值i，獲取原始金鑰中的兩個相鄰的八位位元組。如果i大於0，則取索引為i-1的位元組作為左位元組；否則，取索引為0的位元組作為左位元組。右位元組的獲取方式類似，如果i小於7，則取索引為i的位元組作為右位元組；否則，取索引為6的位元組作為右位元組。
4. 接著，透過位運算將左位元組和右位元組中的位進行清除，只保留當前7位的資料。左位元組透過與運算子&和右移運算子>>實現，右位元組透過與運算子&和左移運算子<<實現。
5. 然後，將左位元組和右位元組進行位移操作，將它們移動到最終的位置。左位元組透過左移運算子<<實現，右位元組透過右移運算子>>實現。
6. 最後，將左位元組和右位元組進行按位或操作，得到最終的八位位元組，並將其儲存在new_key陣列中對應的位置。

   void EXPAND(BYTE* key)
   {
       BYTE left_octet, right_octet;
       BYTE new_key[8];
       // split original key into eight 7-bit packs:
       // 00000001 11111122 22222333 3333444 44455555 55666666 67777777
       for (int i = 0; i < 8; i++)
       {
           // fetch two adjacent octets of key containing current 7 bits
           left_octet = key[i > 0 ? i - 1 : 0];
           right_octet = key[i < 7 ? i : 6];
           // clear all bits except current 7 ones
           left_octet &= 0xFF >> (8 - i);
           right_octet &= 0xFF << (i + 1);
           // shift bits to their final position
           left_octet = left_octet << (8 - i);
           right_octet = right_octet >> i;
           // combine into resulting octet
           new_key[i] = left_octet | right_octet;
       }
       memcpy(key, new_key, 8);
   }

   至此，我們就算出來了NtResponse

   2.計算AunthenticatorResponse

   首先檢視文件，得知輸入有Password、NT-Response、PeerChallenge、AuthenticatorChallenge、UserName

   輸出AuthenticatorResponse。該函式處理流程如下：

   1. 該函式里面定義了長度16的PasswordHash和PasswordHashHash，長度為8的Challenge。首先，使用MD4演算法對密碼進行雜湊處理，得到PasswordHash。
   2. 然後，對PasswordHash進行再次雜湊處理，得到PasswordHashHash。
   3. 接著，使用SHA演算法對PasswordHashHash、NT-Response和Magic1進行雜湊處理，得到Digest。
   4. 使用ChallengeHash函式對PeerChallenge、AuthenticatorChallenge和UserName進行雜湊處理，得到Challenge。
   5. 再次使用SHA演算法對Digest、Challenge和Magic2進行雜湊處理，得到最終的Digest

   

   下面是具體實現程式碼

　　

void GenerateAuthenticatorResponse(const HCRYPTPROV hProv, const wchar_t* password_unicode, const BYTE* NTResponse, const BYTE* PeerChalleng, const BYTE* AuthenticatorChallenge, const char* UserName)
{
    BYTE Magic1[39] = { 0x4D, 0x61, 0x67, 0x69, 0x63, 0x20, 0x73, 0x65, 0x72, 0x76,
    0x65, 0x72, 0x20, 0x74, 0x6F, 0x20, 0x63, 0x6C, 0x69, 0x65,
    0x6E, 0x74, 0x20, 0x73, 0x69, 0x67, 0x6E, 0x69, 0x6E, 0x67,
    0x20, 0x63, 0x6F, 0x6E, 0x73, 0x74, 0x61, 0x6E, 0x74 };
    BYTE Magic2[41] = { 0x50, 0x61, 0x64, 0x20, 0x74, 0x6F, 0x20, 0x6D, 0x61, 0x6B,
    0x65, 0x20, 0x69, 0x74, 0x20, 0x64, 0x6F, 0x20, 0x6D, 0x6F,
    0x72, 0x65, 0x20, 0x74, 0x68, 0x61, 0x6E, 0x20, 0x6F, 0x6E,
    0x65, 0x20, 0x69, 0x74, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6F,
    0x6E };
    BYTE Passwordhash[16];
    _NtPasswordHash(hProv, password_unicode, Passwordhash);
    BYTE PasswordHashhash[16];
    _NtPasswordHashHash(hProv, Passwordhash, PasswordHashhash);
    SHA_CTX Context;
    SHA1_Init(&Context);
    SHA1_Update(&Context, PasswordHashhash, 16);
    SHA1_Update(&Context, NTResponse, 24);
    SHA1_Update(&Context, Magic1, 39);
    unsigned char aa[SHA_DIGEST_LENGTH];
    SHA1_Final(aa, &Context);
    BYTE Challenge[8];
    _ChallengeHash(hProv, PeerChalleng, AuthenticatorChallenge, UserName, Challenge);
    SHA1_Init(&Context);
    SHA1_Update(&Context, aa, sizeof(aa));
    SHA1_Update(&Context, Challenge, 8);
    SHA1_Update(&Context, Magic2, 41);
    unsigned char bb[SHA_DIGEST_LENGTH];
    SHA1_Final(bb, &Context);
    cout << endl << "AuthenticatorResponse: s=";
    for (int i = 0; i < 20; i++)
    {
        printf("%02X", (unsigned char)bb[i]);
    }
}

3.執行程式，將結果和wireshark抓包內容進行比對

NT-Response：DA2191E86678231E62B5D628CBA859031B1E6082533B32B5

AuthenticatorResponse: s=2AA71CBBDD95F43ABA628329A0271A8DD1114310

全部程式碼如下：注意展開

#pragma comment(lib, "libssl.lib")
#pragma comment(lib, "libcrypto.lib")
#include <stdio.h>
#include <fstream>
#include <tchar.h>
#include <windows.h>
#include <WinCrypt.h>
#include <openssl/sha.h>
#include<string>
#include<iostream>
#include <openssl/des.h>
using namespace std;

void print_array(const BYTE* array, DWORD length);
void GenerateNTResponse(const HCRYPTPROV hProv, const BYTE* auth_challenge, const BYTE* peer_challenge, const char* user_name, const wchar_t* password, BYTE* response);
void GenerateAuthenticatorResponse(const HCRYPTPROV hProv, const wchar_t* password_unicode, const BYTE* NTResponse, const BYTE* PeerChalleng, const BYTE* AuthenticatorChallenge, const char* UserName);
void Challenge1(const HCRYPTPROV hProv, const BYTE* auth_challenge, const BYTE* peer_challenge, const char* user_name, BYTE* response);
void _NtPasswordHash(const HCRYPTPROV hProv, const wchar_t* password, BYTE* password_hash);
BYTE nt_response[24];
int main()
{
    const char* user_name = "WA_042";
    const wchar_t* password = L"123456";
    const BYTE auth_challenge[] = { 0x11,0xD8,0x2A,0x82,0x0F,
                                   0xBE,0xB0,0x30,0x73,0xB1,0xF7,
                                   0x03,0x73,0x22,0x26,0xBF };
    const BYTE peer_challenge[] = { 0xC1,0xD4,0x43,0x9D,0xBD,0x65,
                                   0xA2,0x74,0xB9,0x7A,0xF0,0x3F,
                                   0x98,0x00,0x6D,0x75 };
    HCRYPTPROV hProv = 0;

    CryptAcquireContext(&hProv, NULL, MS_DEF_PROV, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT);
    //wcout << password;
    printf("User name: %s\n", user_name);
    wprintf(L"User password: %s\n", password);
    printf("Authenticator challenge: ");
    print_array(auth_challenge, 16);
    printf("\n");
    printf("Peer challenge: "); print_array(peer_challenge, 16);
    printf("\n");
    GenerateNTResponse(hProv, auth_challenge, peer_challenge, user_name, password, nt_response);
    printf("NT Response: "); print_array(nt_response, 24);
    GenerateAuthenticatorResponse(hProv, password, nt_response, peer_challenge, auth_challenge, user_name);
    cout << endl;
    Challenge1(hProv, auth_challenge, peer_challenge, user_name, nt_response);
    cout << endl << "挑戰一結束";
    return 0;
}

void Challenge1(const HCRYPTPROV hProv, const BYTE* auth_challenge, const BYTE* peer_challenge, const char* user_name, BYTE* response)
{
    std::ifstream file("passlib.txt");
    if (!file) {
        std::cerr << "無法開啟檔案" << std::endl;
    }

    string line;
    while (std::getline(file, line)) {
        BYTE Nt_response[24];
        wchar_t* wc = new wchar_t[line.size()];
        swprintf(wc, 100, L"%S", line.c_str());
        // wcout << wc << endl;
        GenerateNTResponse(hProv, auth_challenge, peer_challenge, user_name, wc, Nt_response);
        //cout << Nt_response << endl;
        for (int i = 0; i < 24; i++)
        {

            if (Nt_response[i] != nt_response[i])
            {
                cout << "破解失敗" << endl;
                break;
            }
            else
            {
                cout << "破解成功！密碼為：";
                wcout << wc << endl;
                break;
            }
            // 處理讀取到的資料
        }
    }

    file.close();


}
void _DesDecrypt(unsigned char* NTResponse, unsigned char* key, unsigned char* decrypted_result);

const CHAR hex_digits[] = "0123456789ABCDEF";

void print_array(const BYTE* array, DWORD length)
{
    printf("0x");
    for (DWORD i = 0; i < length; i++)
        printf("%c%c", hex_digits[array[i] >> 4],
            hex_digits[array[i] & 0xf]);
}


void _ChallengeHash(const HCRYPTPROV hProv, const BYTE* peer_challenge, const BYTE* auth_challenge, const char* user_name, BYTE* challenge);
void _NtPasswordHash(const HCRYPTPROV hProv, const wchar_t* password, BYTE* password_hash);
void _ChallengeResponse(const HCRYPTPROV hProv, const BYTE* challenge, const BYTE* password_hash, BYTE* response);
void _NtPasswordHashHash(const HCRYPTPROV hProv, BYTE* password, BYTE* password_hash);
void GenerateNTResponse(const HCRYPTPROV hProv, const BYTE* auth_challenge, const BYTE* peer_challenge, const char* user_name, const wchar_t* password, BYTE* response)
{
    BYTE challenge[8];
    BYTE password_hash[16];

    _ChallengeHash(hProv, peer_challenge, auth_challenge, user_name, challenge);
    _NtPasswordHash(hProv, password, password_hash);
    _ChallengeResponse(hProv, challenge, password_hash, response);
}
void GenerateAuthenticatorResponse(const HCRYPTPROV hProv, const wchar_t* password_unicode, const BYTE* NTResponse, const BYTE* PeerChalleng, const BYTE* AuthenticatorChallenge, const char* UserName)
{
    BYTE Magic1[39] = { 0x4D, 0x61, 0x67, 0x69, 0x63, 0x20, 0x73, 0x65, 0x72, 0x76,
    0x65, 0x72, 0x20, 0x74, 0x6F, 0x20, 0x63, 0x6C, 0x69, 0x65,
    0x6E, 0x74, 0x20, 0x73, 0x69, 0x67, 0x6E, 0x69, 0x6E, 0x67,
    0x20, 0x63, 0x6F, 0x6E, 0x73, 0x74, 0x61, 0x6E, 0x74 };
    BYTE Magic2[41] = { 0x50, 0x61, 0x64, 0x20, 0x74, 0x6F, 0x20, 0x6D, 0x61, 0x6B,
    0x65, 0x20, 0x69, 0x74, 0x20, 0x64, 0x6F, 0x20, 0x6D, 0x6F,
    0x72, 0x65, 0x20, 0x74, 0x68, 0x61, 0x6E, 0x20, 0x6F, 0x6E,
    0x65, 0x20, 0x69, 0x74, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6F,
    0x6E };
    BYTE Passwordhash[16];
    _NtPasswordHash(hProv, password_unicode, Passwordhash);
    BYTE PasswordHashhash[16];
    _NtPasswordHashHash(hProv, Passwordhash, PasswordHashhash);
    SHA_CTX Context;
    SHA1_Init(&Context);
    SHA1_Update(&Context, PasswordHashhash, 16);
    SHA1_Update(&Context, NTResponse, 24);
    SHA1_Update(&Context, Magic1, 39);
    unsigned char aa[SHA_DIGEST_LENGTH];
    SHA1_Final(aa, &Context);
    BYTE Challenge[8];
    _ChallengeHash(hProv, PeerChalleng, AuthenticatorChallenge, UserName, Challenge);
    SHA1_Init(&Context);
    SHA1_Update(&Context, aa, sizeof(aa));
    SHA1_Update(&Context, Challenge, 8);
    SHA1_Update(&Context, Magic2, 41);
    unsigned char bb[SHA_DIGEST_LENGTH];
    SHA1_Final(bb, &Context);
    cout << endl << "AuthenticatorResponse: s=";
    for (int i = 0; i < 20; i++)
    {
        printf("%02X", (unsigned char)bb[i]);
    }
}
#define SHA1LEN 20

void _ChallengeHash(const HCRYPTPROV hProv, const BYTE* peer_challenge, const BYTE* auth_challenge, const char* user_name, BYTE* challenge)
{
    HCRYPTHASH hHash = 0;
    if (!CryptCreateHash(hProv, CALG_SHA1, 0, 0, &hHash))
        throw "CryptCreateHash failed (SHA1)";
    if (!CryptHashData(hHash, peer_challenge, 16, 0))
        throw "CryptHashData failed (peer challenge)";
    if (!CryptHashData(hHash, auth_challenge, 16, 0))
        throw "CryptHashData failed (auth challenge)";
    if (!CryptHashData(hHash, (const BYTE*)user_name,
        (DWORD)strlen(user_name), 0))
        throw "CryptHashData failed (user name)";
    DWORD hash_len = SHA1LEN;
    BYTE hash_buffer[SHA1LEN];
    if (!CryptGetHashParam(hHash, HP_HASHVAL, hash_buffer,
        &hash_len, 0))
        throw "CryptGetHashParam failed (challenge hash)";
    memcpy(challenge, hash_buffer, 8);

}


#define MD4LEN 16

void _NtPasswordHash(const HCRYPTPROV hProv, const wchar_t* password, BYTE* password_hash)
{
    HCRYPTHASH hHash = 0;
    if (!CryptCreateHash(hProv, CALG_MD4, 0, 0, &hHash))
        throw "CryptCreateHash failed (MD4)";
    if (!CryptHashData(hHash, (const BYTE*)password, lstrlenW(password) << 1, 0))
        throw "CryptHashData failed (user password)";
    DWORD hash_len = MD4LEN;
    BYTE hash_buffer[MD4LEN];
    if (!CryptGetHashParam(hHash, HP_HASHVAL, hash_buffer, &hash_len, 0))
        throw "CryptGetHashParam failed (NT password hash)";
    memcpy(password_hash, hash_buffer, 16);
}
void _NtPasswordHashHash(const HCRYPTPROV hProv, BYTE* passwordhash, BYTE* password_hashhash)
{
    HCRYPTHASH hHashhash = 0;
    if (!CryptCreateHash(hProv, CALG_MD4, 0, 0, &hHashhash))
        throw "CryptCreateHash failed (MD4)";
    if (!CryptHashData(hHashhash, passwordhash, 16, 0))
        throw "CryptHashData failed (user password)";
    DWORD hash_len = MD4LEN;
    BYTE hash_buffer[MD4LEN];
    if (!CryptGetHashParam(hHashhash, HP_HASHVAL, hash_buffer, &hash_len, 0))
        throw "CryptGetHashParam failed (NT password hash)";

    memcpy(password_hashhash, hash_buffer, 16);
    //cout << endl; print_array(password_hashhash, 16);
}

void _DesEncrypt(const HCRYPTPROV hProv, const BYTE* data, const BYTE* key, BYTE* result);
void _ChallengeResponse(const HCRYPTPROV hProv, const BYTE* challenge, const BYTE* password_hash, BYTE* response)
{
    BYTE z_password_hash[21];
    memset(z_password_hash, 0, 21);
    memcpy(z_password_hash, password_hash, 16);

    _DesEncrypt(hProv, challenge, z_password_hash, response);
    _DesEncrypt(hProv, challenge, z_password_hash + 7, response + 8);
    _DesEncrypt(hProv, challenge, z_password_hash + 14, response + 16);
}
typedef struct {
    BLOBHEADER key_header;
    DWORD key_length;
    BYTE key_data[8];
} DESKey;

void EXPAND(BYTE* key);

void _DesEncrypt(const HCRYPTPROV hProv, const BYTE* data, const BYTE* key, BYTE* result)
{
    // Fill CryptoAPI-required key structure
    DESKey des_key;
    des_key.key_header.bType = PLAINTEXTKEYBLOB;
    des_key.key_header.bVersion = CUR_BLOB_VERSION;
    des_key.key_header.reserved = 0;
    des_key.key_header.aiKeyAlg = CALG_DES;
    des_key.key_length = 8;
    memcpy(des_key.key_data, key, 7);
    EXPAND(des_key.key_data);

    HCRYPTKEY hKey;
    // import key BLOB
    if (!CryptImportKey(hProv, (BYTE*)&des_key,
        sizeof(des_key), 0, 0, &hKey))
        throw "CryptImportKey failed";
    // set ECB mode required by RFC
    DWORD des_mode = CRYPT_MODE_ECB;
    if (!CryptSetKeyParam(hKey, KP_MODE, (BYTE*)&des_mode, 0))
        throw "CryptSetKeyParam failed (ECB mode)";
    // set initialization vector
    BYTE IV[8] = { 0, 0, 0, 0, 0, 0, 0, 0 };
    if (!CryptSetKeyParam(hKey, KP_IV, &IV[0], 0))
        throw "CryptSetKeyParam failed (init vector)";
    // encrypt
    DWORD data_len = 8;
    memcpy(result, data, 8);    // encrypt in-place
    if (!CryptEncrypt(hKey, 0, FALSE, 0, (BYTE*)&result[0], &data_len, 8))
        throw "CryptEncrypt failed (DES)";
}

void EXPAND(BYTE* key)
{
    BYTE left_octet, right_octet;
    BYTE new_key[8];
    // split original key into eight 7-bit packs:
    // 00000001 11111122 22222333 3333444 44455555 55666666 67777777
    for (int i = 0; i < 8; i++)
    {
        // fetch two adjacent octets of key containing current 7 bits
        left_octet = key[i > 0 ? i - 1 : 0];
        right_octet = key[i < 7 ? i : 6];
        // clear all bits except current 7 ones
        left_octet &= 0xFF >> (8 - i);
        right_octet &= 0xFF << (i + 1);
        // shift bits to their final position
        left_octet = left_octet << (8 - i);
        right_octet = right_octet >> i;
        // combine into resulting octet
        new_key[i] = left_octet | right_octet;
    }
    memcpy(key, new_key, 8);
}

二、根據前期PPTP實驗中捕獲的資料包中CHAP協議的挑戰響應認證資料，在未知使用者口令情況下程式設計實現CHAP認證口令的破解

思路：編寫一個challenge1（）函式，建立一個自己的字典，使用字典進行爆破，每次讀入字典中的一個密碼文字，然後呼叫GenerateNTResponse（）函式計算NT-Response，與正確的進行比對，如果成功，則輸出密碼

1.編寫challenge1（）函式

void Challenge1(const HCRYPTPROV hProv, const BYTE* auth_challenge, const BYTE* peer_challenge, const char* user_name, BYTE* response)
{
    std::ifstream file("passlib.txt");
    if (!file) {
        std::cerr << "無法開啟檔案" << std::endl;
    }

    string line;
    while (std::getline(file, line)) {
        BYTE Nt_response[24];
        wchar_t* wc = new wchar_t[line.size()];
        swprintf(wc, 100, L"%S", line.c_str());
        // wcout << wc << endl;
        GenerateNTResponse(hProv, auth_challenge, peer_challenge, user_name, wc, Nt_response);
        //cout << Nt_response << endl;
        for (int i = 0; i < 24; i++)
        {

            if (Nt_response[i] != nt_response[i])
            {
                cout << "破解失敗" << endl;
                break;
            }
            else
            {
                cout << "破解成功！密碼為：";
                wcout << wc << endl;
                break;
            }
            // 處理讀取到的資料
        }
    }

    file.close();


}

執行字典爆破

三、在單向資料條件下(僅能截獲使用者資料)實現CHAP認證口令的破解

思路：單向資料條件下，意味著只能獲取使用者資料NT-Response、PeerChallenge、UserName。那麼根據NtResponse的計算原理，採用逆向破解的思路。首先：由於NtResponse是由passwordhash分成三部分作金鑰對challenge加密的密文連線得到，那麼先將NtResponse拆分成三部分，對應每部分passwordhash對challenge做DES加密的結果。

因此，破解思路是，每次讀入字典裡的金鑰做hash作為金鑰，然後將NtResponse三個部分分別作為DES函式的輸入，記錄DES函式的輸出，比較三個輸出是否相同，如果相同，則破解成功。

注意，我能執行成功是因為我的目錄裡面有passlib.txt字典檔案，大家可以建立自己的字典檔案

1.編寫程式碼

原始碼如下，注意，已經摺疊，點選展開

#define _CRT_SECURE_NO_WARNINGS C4996
#include <iostream>
#include <stdio.h>
#include <openssl/ssl.h>
#include <stdlib.h>
#include <string.h>
#include <openssl/sha.h>
#include <openssl/md4.h>
#include <openssl/des.h>

int  readfile(char* pass[]) {
    FILE* file = fopen("./passlib.txt", "r");
    if (file == NULL) {
        perror("Error opening file");
        return 0;
    }

    char buffer[100];
    int count = 0;

    while (fgets(buffer, sizeof(buffer), file) != NULL) {
        buffer[strcspn(buffer, "\n")] = 0;
        pass[count] = _strdup(buffer);
        count++;
    }

    fclose(file);


    return count;
}

void des_decrypt(unsigned char* key, unsigned char* NTResponse, unsigned char* decrypted_result) {
    DES_cblock des_key;
    memcpy(des_key, key, 8);
    DES_key_schedule key_schedule;
    DES_set_key_unchecked(&des_key, &key_schedule);
    DES_ecb_encrypt((DES_cblock*)NTResponse, (DES_cblock*)decrypted_result, &key_schedule, DES_DECRYPT);
}
void expand(unsigned char* t, unsigned char* k)
{
    k[0] = t[0] & 0xfe;
    k[1] = (t[0] << 7 | t[1] >> 1) & 0xfe;
    k[2] = (t[1] << 6 | t[2] >> 2) & 0xfe;
    k[3] = (t[2] << 5 | t[3] >> 3) & 0xfe;
    k[4] = (t[3] << 4 | t[4] >> 4) & 0xfe;
    k[5] = (t[4] << 3 | t[5] >> 5) & 0xfe;
    k[6] = (t[5] << 2 | t[6] >> 6) & 0xfe;
    k[7] = (t[6] << 1) & 0xfe;
}
int main()
{
    unsigned char peer_challenge[17] = { 0xC1,0xD4,0x43,0x9D,0xBD,0x65,0xA2,0x74,0xB9,0x7A,0xF0,0x3F,0x98,0x00,0x6D,0x75 ,'\0' };
    char username[7] = { 0x77,0x61,0x5f,0x30,0x34,0x32,'\0' };
    unsigned char challenge[8] = { 0x00 };
    unsigned char NTResponse[25] = { 0xDA ,0x21,0x91 ,0xE8 ,0x66 ,0x78 ,0x23 ,0x1E ,0x62 ,0xB5
        ,0xD6 ,0x28 ,0xCB ,0xA8 ,0x59 ,0x03 ,0x1B ,0x1E ,0x60 ,0x82 ,0x53 ,0x3B ,0x32 ,0xB5,'\0' };

    const char* pass[100];
    int loop = readfile((char**)pass);
    int has_found = 0;

    unsigned char response1[9] = { 0x00 };
    unsigned char response2[9] = { 0x00 };
    unsigned char response3[9] = { 0x00 };

    strncat((char*)response1, (char*)NTResponse, 8);
    response1[8] = '\0';
    strncat((char*)response2, (char*)NTResponse + 8, 8);
    response2[8] = '\0';
    strncat((char*)response3, (char*)NTResponse + 16, 8);
    response3[8] = '\0';
    printf("read the password in pass.txt:\n");
    for (int i = 0; i < loop; i++) {
        printf("%s\n", pass[i]);
    }

    for (int j = 0; j < loop; j++)
    {

        unsigned char password_hash[21] = { 0x00 };
        unsigned char password[10] = { 0x00 };
        strncpy((char*)password, pass[j], strlen(pass[j]));

        password[strlen(pass[j])] = '\0';

        int pass_len = strlen((char*)password);

        unsigned char* unicode_password;
        unicode_password = (unsigned char*)malloc(sizeof(unsigned char) * pass_len * 2);
        for (int i = 0; i < pass_len; i++) {
            unicode_password[i * 2] = password[i];
            unicode_password[i * 2 + 1] = 0;
        }

        MD4((unsigned char*)unicode_password, pass_len * sizeof(unsigned short), password_hash);

        char zero[5] = { 0x00,0x00,0x00,0x00,0x00 };

        strncat((char*)password_hash, zero, 5);

        unsigned char ks1[9] = { 0x00 };
        unsigned char ks2[9] = { 0x00 };
        unsigned char ks3[9] = { 0x00 };

        unsigned char pass1[8] = { 0x00 };
        unsigned char pass2[8] = { 0x00 };
        unsigned char pass3[8] = { 0x00 };

        for (int i = 0; i < 7; i++)
        {
            pass1[i] = password_hash[i];
        }
        for (int i = 0; i < 7; i++)
        {
            pass2[i] = password_hash[i + 7];
        }
        for (int i = 0; i < 7; i++)
        {
            pass3[i] = password_hash[i + 14];
        }

        expand(pass1, ks1);

        expand(pass2, ks2);

        expand(pass3, ks3);


        unsigned char result1[32] = { 0x00 };
        unsigned char result2[32] = { 0x00 };
        unsigned char result3[32] = { 0x00 };

        des_decrypt(ks1, response1, result1);
        des_decrypt(ks2, response2, result2);
        des_decrypt(ks3, response3, result3);

        if (strcmp((char*)result1, (char*)result2) == 0)
        {
            if (strcmp((char*)result1, (char*)result3) == 0)
            {
                printf("\n");
                printf("Find! The password is:%s", pass[j]);
                has_found = 1;
                break;
            }
        }

    }
    for (int i = 0; i < loop; i++) {
        free((void*)pass[i]);
    }

    if (has_found == 0)
        printf("Cannot Find the password");
}

2.執行程式碼

至此，實驗結束

順便附上python原始碼，歡迎批評指正！

# coding = utf-8
import binascii
from builtins import bytes

from Crypto.Hash import SHA1,SHA,MD4
from Crypto.Cipher import DES,ARC4

def GenerateNTResponse(AuthenticatorChallenge,PeerChalleng,UserName,password_unicode):
    PasswordHash=Nt_password_hash(password_unicode)
    #print_hex(PasswordHash)
    Challenge=ChallengeHash(PeerChalleng,AuthenticatorChallenge,UserName)
    challenge_resposn=ChallengeResponse(PasswordHash,Challenge)
    return challenge_resposn

def ChallengeHash(PeerChalleng,AuthenticatorChallenge,UserName):
    Challenge=SHA1.new()
    Challenge.update(PeerChalleng)
    Challenge.update(AuthenticatorChallenge)
    Challenge.update(UserName)
    return Challenge.digest()[:8]
def Expand(rawkey):  #expand 7Bytes to 8 Bytes
    tmp_key = []
    for i in rawkey[:7]:
        tmp_key.append(i)
    key = []
    for i in range(8):
        key.append(b'\x00')
    # -------------------------
    key[0] = tmp_key[0]
    for i in range(1, 7):
        key[i] = ((tmp_key[i - 1] << (8 - i)) & 0xff) | (tmp_key[i] >> i)
    key[7] =  (tmp_key[6] << 1) & 0xff
    global b
    for i in range(len(key)):
        b = 1
        for j in range(1, 8):
            t = (key[i] >> j)
            b = (t ^ b) & 0x1 #
        key[i] = (key[i] & 0xfe) | b
    ans = b''
    for i in range(8):
        ans += bytes([key[i]])
    return ans
def ChallengeResponse(PasswordHash,Challenge):
    zero = b'\x00'
    while(len(PasswordHash) < 21): # important
        PasswordHash += zero #zero-padded to 21 octets
    res = DES.new(Expand(PasswordHash[0:7]), DES.MODE_ECB).encrypt(Challenge)
    res += DES.new(Expand(PasswordHash[7:14]), DES.MODE_ECB).encrypt(Challenge)
    res += DES.new(Expand(PasswordHash[14:21]), DES.MODE_ECB).encrypt(Challenge)
    return res

def Nt_password_hash(Password):
    PasswordHash=MD4.new(Password)
    return PasswordHash.digest()

def Nt_password_hashhash(Passwordhash):
    PasswordHashhash=MD4.new(Passwordhash)
    return PasswordHashhash.digest()

def GenerateAuthenticatorResponse(password_unicode,NTResponse,PeerChalleng,AuthenticatorChallenge,UserName):
    Magic1 =b'\x4D\x61\x67\x69\x63\x20\x73\x65\x72\x76\x65\x72\x20\x74\x6F\x20\x63\x6C\x69\x65\x6E\x74\x20\x73\x69\x67\x6E\x69\x6E\x67\x20\x63\x6F\x6E\x73\x74\x61\x6E\x74'
    Magic2 = bytes([0x50, 0x61, 0x64, 0x20, 0x74, 0x6F, 0x20, 0x6D, 0x61, 0x6B,0x65, 0x20, 0x69, 0x74, 0x20, 0x64, 0x6F, 0x20, 0x6D, 0x6F,0x72, 0x65, 0x20, 0x74, 0x68, 0x61, 0x6E, 0x20, 0x6F, 0x6E,0x65, 0x20, 0x69, 0x74, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6F,0x6E])
    Passwordhash=Nt_password_hash(password_unicode)
    PasswordHashhash=Nt_password_hashhash(Passwordhash)
    Context=SHA.new()
    Context.update(PasswordHashhash)
    Context.update(NTResponse)
    Context.update(Magic1)
    aa=Context.digest()
    Challenge=ChallengeHash(PeerChalleng,AuthenticatorChallenge,UserName)
    Context=SHA.new()
    Context.update(aa)
    Context.update(Challenge)
    Context.update(Magic2)
    aa=Context.digest()
    return b'S=' + binascii.hexlify(aa)[:40]
def print_hex(s):
    for i in s:
        print('\%#x' % i, end='')
    print('')


if __name__ == "__main__":

    UserName = 'WA_042'.encode("utf8")
    password = '123456'.encode("utf8")
    AuthenticatorChallenge = b'\x11\xD8\x2A\x82\x0F\xBE\xB0\x30\x73\xB1\xF7\x03\x73\x22\x26\xBF'
    PeerChalleng = b'\xC1\xD4\x43\x9D\xBD\x65\xA2\x74\xB9\x7A\xF0\x3F\x98\x00\x6D\x75'
    password_unicode = b''
    for ch in password:
        password_unicode += bytes([ch])
        password_unicode +=b'\x00'
    NTResponse=GenerateNTResponse(AuthenticatorChallenge, PeerChalleng, UserName, password_unicode)
    PasswordHashhash = Nt_password_hashhash(Nt_password_hash(password_unicode))
    AuthenticatorResponse=GenerateAuthenticatorResponse(password_unicode,NTResponse,PeerChalleng,AuthenticatorChallenge,UserName)
    print("使用者名稱：",UserName)
    print("密碼：",password)
    print("挑戰響應值：")
    print_hex(NTResponse)
    print("AuthenticatorResponse: ",AuthenticatorResponse)