Vulnerability Development mailing list archives
UserID and hashed password for Lotus Domino
From: Casper Gio <gpedone77 () yahoo it>
Date: Fri, 18 Oct 2002 17:11:04 +0200 (CEST)
hi, while doing security tests on a Lotus Domino sistem, I managed to get the UserID file for a user, and the hashed password of another user. I made it accessing thru the Internet, so I was a totally unpriviligied user. The way I made it, is simple: the company I'm doing this test for, left some of the domino databases open to the public. Among the others, there's the names.nsf database, wich contains info about the users. You just access this database with a url like: http://domino_server/names.nsf Well, one user had his UserID file publicly accessible, and another user had his password digest stored in the database. Is there any way to obtain the password from the UserID, or to crack and obtain the password from its hash? (I read it was released a tool named "sesame"... any clue? here for more info about it: http://online.securityfocus.com/news/66 ) I would be interested in demonstrate how to abtain a password or access to the system starting from the data I collected on the Internet. I would appreciate any help thanks. Casper ______________________________________________________________________ Mio Yahoo!: personalizza Yahoo! come piace a te http://it.yahoo.com/mail_it/foot/?http://it.my.yahoo.com/
Current thread:
- UserID and hashed password for Lotus Domino Casper Gio (Oct 18)
- Re: UserID and hashed password for Lotus Domino Nicolas Gregoire (Oct 18)
- Re[2]: UserID and hashed password for Lotus Domino Philip Storry (Oct 18)
- Re: UserID and hashed password for Lotus Domino Philip Storry (Oct 18)
- Re: UserID and hashed password for Lotus Domino gpedone77 (Oct 20)
- Message not available
- Re[2]: UserID and hashed password for Lotus Domino Philip Storry (Oct 21)
- Re: UserID and hashed password for Lotus Domino gpedone77 (Oct 23)
- Re: UserID and hashed password for Lotus Domino Nicolas Gregoire (Oct 18)
- Re: UserID and hashed password for Lotus Domino HalbaSus (Oct 20)
- Re: UserID and hashed password for Lotus Domino gpedone77 (Oct 20)
- Re[2]: UserID and hashed password for Lotus Domino Philip Storry (Oct 21)
- Re[2]: UserID and hashed password for Lotus Domino Philip Storry (Oct 21)
- Re: UserID and hashed password for Lotus Domino gpedone77 (Oct 20)