[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <BLU0-SMTP3433C814F5E82AAB3D7FEF8FD210@phx.gbl>
Date: Thu, 3 Jan 2013 11:15:18 +0100
From: Frank Dittrich <frank_dittrich@...mail.com>
To: john-users@...ts.openwall.com
Subject: Re: Multiple formats accepting the same raw hashes
On 01/02/2013 11:52 PM, Rich Rumble wrote:
>> On Jan 2, 2013, at 1:53 PM, "Frank Dittrich" <frank_dittrich@...mail.com> wrote:
>>> So, at the end of a long mail, finally a few questions:
>>>
>>> How important is it for you that john mentions which supported hash
>>> algorithms might be used to crack a given set of hashes, instead of
>>> silently using the first hash format which supported raw hashes of a
>>> particular fixed length?
> This is the behavior most people auditing windows LM passwords have
> encountered for as long as I can remember when no format was given or
> no hash type specified in the hash file. I think this should still be
> the default behavior. LM now detects as 5 or 6 possible hashes types
> currently.
> Warning: detected hash type "lm", but the string is also recognized as "lotus5"
> Use the "--format=lotus5" option to force loading these as that type instead
> Warning: detected hash type "lm", but the string is also recognized as "mscash"
> Use the "--format=mscash" option to force loading these as that type instead
> Warning: detected hash type "lm", but the string is also recognized as "mscash2"
> Use the "--format=mscash2" option to force loading these as that type instead
> Warning: detected hash type "lm", but the string is also recognized as "raw-md4"
> Use the "--format=raw-md4" option to force loading these as that type instead
> Warning: detected hash type "lm", but the string is also recognized as "raw-md5"
> Use the "--format=raw-md5" option to force loading these as that type instead
> Warning: detected hash type "lm", but the string is also recognized as
> "raw-md5u"
> Use the "--format=raw-md5u" option to force loading these as that type instead
If you prefix these hashes with "$LM$" (without the quotes), they might
even get detected as SAP CODVN B (treating "$LM" as the SAP user name).
Fortunately, LM will most likely always be the first format (among those
accepting LM hashes as valid) which gets loaded, because it is one of
the few formats supported by the core version.
> I doubt it's an issue currently for most users, but perhaps one that
> can have a warning when resuming that no format was specified
> previously or that it is defaulting to format_x when resuming. And or
> have such a warning and have the REC files from now on write in the
> defaulted to format in the rec file. Use the defaulted format when
> resuming along with the warning that the format could be one of these
> others as well. That's my .02.
Even if you omit the --format= option, john will write the format which
gets used into the .rec file.
Since the rec file will contain a --format= line, it will look as if the
user did specify a --format= option on the command line.
So, when resuming an interrupted session, john will definitely continue
this session using the same format, but upon resuming a session, john
cannot warn the user that (s)he forgot to specify a format when starting
the session.
Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
