[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4CE33FE0.1060203@16systems.com>
Date: Tue, 16 Nov 2010 21:37:20 -0500
From: Brad Tilley <brad@...ystems.com>
To: john-users@...ts.openwall.com
Subject: Re: Cracking a known password shape
On 11/16/2010 04:22 PM, Eric wrote:
> I use JtR often for basic cracking of NTLM, MD5, Cisco, PIX, etc and I
> have going through modifying the rulesets and I have a number of great
> dictionaries. I use the incremental modes for shorter passwords, as
> well.
>
> However, in this case, I have a password. I know a few characters in
> it. It begins with an 'L' (or 'l') and the second letter is a 'o' or
> '0'. The fifth letter is likely a '-' or '_'. The 8th character is
> probably 'n' or 'N' and I need to brute-force the remaining 4-5
> characters.
>
> I cannot figure out the best method to do this. I've spent half the
> day looking through archives and how-tos, but most focus on the very
> basics of JtR usage. I presume some sort of external function might
> suffice, but I'm not familiar with how those are executed. Before I
> set out trying to learn the whole external filter functionality, can
> anyone offer suggestions on how to attack a password that is partially
> known.
>
> I know I can brute-force a 5 character password in a reasonable amount
> of time, but how to specify known characters within that?
>
> Thanks!
You didn't mention the password length, so I'm assuming 8 characters.
If you know the exact length of the password in addition to what certain
characters are (or thereabout), then you can enumerate all the
possibilities by defining the sets like so and enumerating them:
const std::string one = "Ll";
const std::string two = "o0";
const std::string three = all;
const std::string four = all;
const std::string five = "-_";
const std::string six = all;
const std::string seven = all;
const std::string eight = "nN";
The variable 'all' is the entire printable ASCII character set (minus
whatever you know can't be used in the password... if anything).
You can code an "enumeration program" to produce all possibilities of
those sets writing every possibility to stdout. I placed an example with
a test password file here: http://16s.us/16crack/examples/
Next, use your enumeration program with JTR's --stdin feature:
./enumerate | john --stdin passwords.txt
I tested this on a Debian Linux 5 machine and my test case did indeed
find the password so I'm sure this works, but it may be less efficient
than Alexander's method.
Alexander, please correct me where I'm wrong.
Brad
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
