[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <4BD8A423.5000005@bredband.net>
Date: Wed, 28 Apr 2010 23:09:55 +0200
From: "Magnum, P.I." <rawsmooth@...dband.net>
To: john-users@...ts.openwall.com
Subject: Re: Charset problem with special characters
On 04/28/2010 05:08 PM, Pablo Catalina Gómez wrote:
> I compile john-1.7.5 with the jumbo-patch-3, and I'm trying to crack LM
> or NTLM hashes with special characters like ñ or ç. Spanish uses these
> characters a lot.
> But when I try to use a dictionary or make-charset using a spanish
> dictionary, john doesn't look up the passwords with these characters.
NTLM use UTF-16 for its input plaintexts, but john can currently only
use 8-bit wordlists. The current code for NTLM makes the conversion by
just inserting a null byte between every input character. The good thing
about that is it's very fast. The downside is it will only work
correctly for ISO-8859-1 wordlists (iirc). And subsets like ASCII of course.
You simply can't work around this without modifying john.
Such modification can be done in different ways. One way could be to
optionally take UTF-16LE wordlist files. That would require rewriting of
lots of stuff that terminates strings with a null byte. Another way
could be to use real conversion from, say, UTF-8 to UTF-16LE. I made
some experiments with this. Without some tricks and optimizations it
will make up a HUGE performance hit. But it was easy to optimize it to
be almost as fast as before as long as there is only ISO-8859-1
characters (i.e. no 'escape sequence' or whatever they call it in UTF.
Code point?)
But I never succeeded in actually cracking anything. I suspect even the
hashing itself is so hardly optimized that it only supports
every-other-nulls but maybe I just did something wrong?
magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
