[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <BAY107-F127D875E9687F38BDCB515FDF80@phx.gbl>
Date: Sun, 05 Jun 2005 21:37:58 +0200
From: "Frank Dittrich" <frank_dittrich@...mail.com>
To: john-users@...ts.openwall.com
Subject: Dupes recognition based on internal representation of ciphertext?
It looks like the dupes recognition in cracker.c (crk_process_guess)
is based on the internal representation of the ciphertext.
This has some unexpected consequences, if different external
representations of the same hash exist.
To reproduce the problem, add the rawMD5 patch to JtR, and if
valid only allows characters '0' - '9' and 'a' - 'f', replace
(('a' <= ciphertext[i])&&(ciphertext[i] <= 'f')) ))
with
(('a' <= ciphertext[i])&&(ciphertext[i] <= 'f')) ||
(('A' <= ciphertext[i])&&(ciphertext[i] <= 'F')) ))
in rawMD5_fmt.c.
Then, it doesn't matter whether the MD5 hash is in upper or lower case.
Using this sample file with password hashes:
$ cat h
1:900150983cd24fb0d6963f7d28e17f72
2:900150983CD24FB0D6963F7D28E17F72
3:900150983cD24fB0d6963F7d28E17f72
and this sample password file:
$ cat p
abc
and starting john like this:
$ ./john --format=raw-md5 --wordlist=p h
Loaded 3 password hashes with no different salts (Raw MD5 [raw-md5])
abc (3)
abc (2)
abc (1)
guesses: 3 time: 0:00:00:00 100% c/s: 5.55 trying: abc
it looks like all passwords have been guessed.
However, only one hash gets saved in john.pot:
$ cat john.pot
900150983cD24fB0d6963F7d28E17f72:abc
$ ./john --show h
3:abc
1 password cracked, 2 left
In order to add the other hashes, you'll have to run john repeatedly,
using all previously cracked passwords as the new password list:
$ cut --fields=2- --delimiter=":" john.pot | sort -u > p2
$ ./john --format=raw-md5 --wordlist=p2 h
Loaded 2 password hashes with no different salts (Raw MD5 [raw-md5])
abc (2)
abc (1)
guesses: 2 time: 0:00:00:00 100% c/s: 7.69 trying: abc
$ ./john --format=raw-md5 --wordlist=p2 h
Loaded 1 password hash (Raw MD5 [raw-md5])
abc (1)
guesses: 1 time: 0:00:00:00 100% c/s: 4.00 trying: abc
Of course, for raw MD5 the problem can be avoided by just
translating all hashes to lower case.
But there might exist hash algorithms which use different external
representations for the same hash.
In this case, it's unfortunate that not all external representations
get saved in john.pot.
Best regards, and thanks in advance for clarification
Frank Dittrich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
