[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANWtx01LrVtTNRuGZCqTwKH3XG+LhWHMVguLXXnW0eYpu2BCYQ@mail.gmail.com>
Date: Mon, 26 Dec 2011 15:38:35 -0500
From: Rich Rumble <richrumble@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: more info about syntax
On Mon, Dec 26, 2011 at 2:08 PM, newangels newangels
<contact.newangels@...il.com> wrote:
> Hi,
>
> I second what W/A say, it will be really nice from your part & verry
> helpfull to help us to find the correct syntax of each "algo'", we
> dont talk for sure abour "raw-md5, Raw_sha1, Des etc...." but all the
> other one's who are not comment's.
>
> Each time with some exotic Hash it's an real "quest" lol
I've been there, and in some cases there are a few ways to load
the same hash type. There are explicit types and there are
"formated" types.
The format is typically
Username (colon) hash (colon) [unsalted typical]
Username (colon) salt + hash (colon) [salted]
Username (colon) salt (colon) hash (colon) [salted]
Example:
user-1:a3aecb685fd19d080881ff49b06373f2:md5::::::
user-1:$1$Kk3.La/.$PfwgUNX/fPvg/C6Yd9ME01:crypt::::::
user-1:1B1EA87A5FBDCDC1634892381079F54C13F3684B:sha1:::::
user-1:1eafa62b1ef1d05f:mysql323:::::
The explicit formats can be found mostly in the *fmt_plug.c
NT's for example...
$NT$7a21990fcd3d759941e45c490f143d5f
$NT$f9e37e83b83c47a93c2f09f66408631b
$NT$8846f7eaee8fb117ad06bdd830b7586c
$NT$2b2ac2d1c7c8fda6cea80b5fad7563aa
$NT$32ed87bdb5fdc5e9cba88547376818d4
Those will all crack with a username of "?" so it's best to add a name
if you want, user:hash (johnD:$NT$7a21990fcd3d759941e45c490f143d5f)
Pwdump file format is supported to LM and NTLM
user (colon) LM-Hash (colon) NTLM-Hash (colon)(colon)(colon)
The LM and or the Ntlm can be blank or have certain "fillers"
namely **********No Password******* but the colons are the delimiters
that are necessary in that format. The ending colons are needed for
any format I'm aware of, I thought however you can add the password at
the end if you knew it, or put in notes/comments in those portions. I think
Single-crack mode will look at those comments or notes and try doing
crafty things with them.
I don't know of a central example file, or a file that exemplifies how
a hash should be formatted, but I think it depends on the hash itself
and who ever wrote the patch, the standard delimiter is the colon, and
the most basic format is user:hash. Looking at the test routines in the
fmt_plug.c files and you'll find some examples used when running john
-test.
-rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
