Wireshark · Ethereal-dev: [Ethereal-dev] Patch: NTLMSSP verifier must come after stub decryption

[Devin Heitmueller <devin_heitmueller@xxxxxxxxx>]

Hello,

I started to do some work again on NTLMSSP decryption,
and found that none of my original reference captures
work anymore.  Only the stub of the first packet is
decrypted successfully.  The verifier for the first
packet, as well as the stub and verifier for all
subsequent packets fail decryption.

As it turns out, dissection of the verifier was moved
before dissection of the stub in the DCE/RPC
dissector.  This breaks decryption since the state of
the RC4 stream is dependent on the stub being
decrypted before the verifier.

Attached is a patch that restores the previous
behavior.  With the patch, the stub is decrypted, and
then the verifier.

Comments welcome (in particular from Tim Potter, who
made the change I'm proposing be rolled back).

Thanks,

Devin Heitmueller
Senior Software Engineer
Netilla Networks Inc.

Attachment: packet-dcerpc.c.diff.gz
Description: packet-dcerpc.c.diff.gz