Home / server / Questions / 644046
In Process
Phil
Asked: 2014-11-14 02:27:45 +0800 CST

£ sign in password fails Windows NPS Radius authentication against Sonicwall SRA

  • 772

We have a Sonicwall SRA server configured to authenticate users using RADIUS to a Windows NPS Server running on Windows Server 2012 R2.

It all works fine EXCEPT when passwords contain the "£" character.

According to the RADIUS spec on page 24 the password field

contains UTF-8 encoded 10646 characters and String contains 8-bit binary data

I found a website that defines the pound sign as

0xC2 0xA3 (c2a3)

I hacked together a fairly ugly perl script to implement the RADIUS password encryption for short passwords (<= 16 octets) using simple MD5 hashing and XORing (I'm no perl expert so I know its not pretty!)

#! /usr/bin/perl -w
use 5.010;
use Digest::MD5 qw(md5 md5_hex md5_base64);
use MIME::Base64;
use Carp qw/croak/;
use List::Util qw/max/;

$secret = "verysecret";
$authenticator = '5354ff6a10cec708f2da74a8b268b98d';
$pwd = "££££££££";
$pwdhex = $pwd;

# Convert password to a Hex string
$pwdhex =~ s/(.)/sprintf("%02x",ord($1))/eg;

print "Password in HEX = " .$pwdhex . "\n";
print "Password in ASCII " .$pwd . "\n";

# Convert RA from Hex string into bytes
$authenticator =~ s/([a-fA-F0-9][a-fA-F0-9])/chr(hex($1))/eg;

# Concatenante the secret and authenticator then MD5 them
$md5input = $secret . $authenticator;
$md5 = md5($md5input);
$md5hex = $md5;
$md5hex =~ s/(.)/sprintf("%02x",ord($1))/eg;
print "Secret + RA (MD5)             " . $md5hex . "\n";

state $encryptedpassword = $md5 ^ $pwd;

$encryptedpassword =~ s/(.)/sprintf("%02x",ord($1))/eg;

print "Computed Encrypted Password = " . $encryptedpassword . "\n";

Using a network trace of the RADIUS traffic I was able to show that the password was being correctly encrypted using c2a3 for each pound sign.

I was going to raise a ticket with Microsoft next as it looks like a problem in their Radius server implementation in NPS but thought I'd post this rather interesting puzzle here first in case anyone had seen anything similar.

radius

0 Answers