Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 9 Dec 2011 10:23:24 -0600
From: "jfoug" <jfoug@....net>
To: <john-dev@...ts.openwall.com>
Subject: RE: cracking RADIUS shared secrets with john the ripper

>From: jfoug [mailto:jfoug@....net]
>
>Once I get this version debugged, and fully tested, I will get it
>uploaded
>to the wiki.

Bug found.  Was doing a strcmp, vs a memcmp.  I needed the length, because I
am packing the internal salt data, with not interspersed nulls, along with
the internal salt data is not a string any more, it can contain NULL bytes,
if a HEX$...00... is seen.

Here is the 'test' app I am using to generate test data:

#include <stdio.h>
void main() {
   int i;
   char *hdr=":$dynamic_1$0000000000000000000000000";
   for (i = 0; i < 500000; ++i) {
//      printf ("%s%07d$%d\n", hdr,i,i);
      printf ("%s%07d$%d\n", hdr,i,i&255);
   }
}


This code can make test data with 256 different salts, or with 500k unique
different salts.    One other good test is to make a 256 salt, and modify
the first 10 or so salts, so that they are not:  0, 1, 2, 3 ... but HEX$30,
HEX$31, HEX$32, ...     Once those are modified, the older john will find
more than 256 salts.  My new code still only finds 256 salts.  

Hopefully, I will have this fully tested and released today.

Jim.

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ