asleap

asleap demonstrates a serious deficiency in proprietary Cisco LEAP networks, allowing recovery of passwords from captured authentication exchanges. The tool works with LEAP and PPTP protocols by processing challenge-response pairs against precomputed hash dictionaries generated by the companion genkeys utility.

Primary use cases include wireless security testing against legacy Cisco LEAP deployments and recovering credentials from captured network traffic. It requires a libpcap capture file containing LEAP authentication exchanges or direct challenge/response values. The tool supports both file-based dictionary attacks and real-time capture processing.

The workflow typically involves generating a hash lookup database with genkeys from a wordlist, then using asleap to match captured authentication data against this database. This offline cracking approach efficiently recovers NT hashes and plaintext passwords from LEAP exchanges.

asleap recovers LEAP passwords by matching captured challenge-response pairs against a precomputed lookup table of NT hashes generated from wordlists by genkeys. LEAP authentication uses a challenge-response mechanism where the client computes NTLM hash responses to server challenges. asleap parses libpcap captures to extract username, challenge, and 24-byte response values, then performs binary searches on the indexed hashfile using the last two hash bytes as a filter. Successful matches reveal the corresponding NT hash and original plaintext password. The -s flag skips post-authentication verification checks.