Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 28 Jun 2012 03:18:41 +0200
From: magnum <john.magnum@...hmail.com>
To: john-dev@...ts.openwall.com
Subject: Re: --regen-lost-salts (was: 'New' functionality added
 to JTR (finding salted passwords, without salts))

On 2012-04-20 01:13, Frank Dittrich wrote:
> On 04/20/2012 12:34 AM, jfoug wrote:
>> Well, the 2 formats I have been working on are:   PHPS/dynamic_6, which is
>> md5(md5($p).$s) with 3 byte salt, and osCommerce (dynamic_4), md5($s.$p)
>> with a 2 byte salt.  Both of these formats have salt values from a space
>> char, up to 0x7e (the '~' tilde char).  From some initial testing, I found a
>> lot of the PHPS (I have about 800k of them), and also there are a lot of
>> OSCommerce (I am just starting to collect them).
> 
> That's interesting. But under normal circumstances, you probably
> wouldn't throw away the salt. (Or are there systems which compute the
> hash with a rendom salt, but don't store the salt?

The one who dumped the hashes might have missed that database column
just out of cluelessness. Or for some reason you could not get the salts
during a pen-test.

> After cracking several passwords, did you detect any patterns, i.e.,
> non-random salts?
> Either a non-uniform distribution of salts, or a salt which (due to a
> broken implementation) based on the password?

I saw non-uniform distribution for sure. I never got to test this
curious feature until now, when testing that last BSS patch. It's pretty
cool and faster than I thought. I ran password.lst on the first 10
million lines in the KoreLogic md5 file, like this (btw -wo now defaults
to password.lst):

$ head -10000000 test/hashes/raw-md5.hashes.txt > regen-test.md5
$ ./john regen-test.md5 -fo:osc --regen-lost-salts=2 -wo -nolog
...
guesses: 14369  time: 0:00:00:21 DONE (2012-06-28 03:16:28)  c/s: 13573G
 trying: princesa - hallo

magnum

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ