[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 11 Sep 2012 00:02:15 +0200
From: magnum <john.magnum@...hmail.com>
To: john-dev@...ts.openwall.com
Subject: Re: oldoffice
On 2012-09-04 16:02, Dhiru Kholia wrote:
> On Mon, Sep 3, 2012 at 5:06 PM, Rich Rumble <richrumble@...il.com> wrote:
>> On Mon, Sep 3, 2012 at 2:14 AM, Dhiru Kholia <dhiru.kholia@...il.com> wrote:
>>> If you find an Office <= 2003 file which is not currently supported,
>>> let me know.
>> I haven't tried yet, but all of these are supported?
>>
>> RC4 Microsoft Base Cryptographic Provider 1.0 (default)
>> RC4 Microsoft Base DSS and Diffle-Hellman Cryptographic Provider
>> RC4 Microsoft DH Schannel Cryptographic Provider
>> RC4 Microsoft Enhanced Cryptographic Provider 1.0
>> RC4 Microsoft Enhanced DSS and Diffle-Hellman Cryptographic Provider
>> RC4 Microsoft Enhanced RSA and AES Cryptographic Provider(Prototype)
>> RC4 Microsoft RSA Schannel Cryptographic Provider
>> RC4 Microsoft Strong Cryptographic Provider
>
> I haven't checked them all but many of them are supported. Following
> types have been tested so far,
>
> RC4 Microsoft Strong Cryptographic Provider
> RC4 Microsoft Base Cryptographic Provider 1.0 (default)
> RC4 Microsoft Base DSS and Diffle-Hellman Cryptographic Provider
I just tested all sample files from wiki:
$ ../run/john test2.in
Loaded 30 password hashes with 30 different salts (Office <= 2003 RC4
MD5 [32/64])
myhovercraftisfullofeels
(XP-RC4-40bit-base-1.0_myhovercraftisfullofeels_.xls)
myhovercraftisfullofeels
(XP-RC4-40bit-base-1.0_myhovercraftisfullofeels_.doc)
myhovercraftisfullofeels
(XP-RC4-128bit-strong-crypto_myhovercraftisfullofeels_.xls)
myhovercraftisfullofeels
(XP-RC4-128bit-Strong-Crypto_myhovercraftisfullofeels_.doc)
myhovercraftisfullofeels (2010-Office97-2000_myhovercraftisfullofeels_.dot)
myhovercraftisfullofeels (2010-Office97-2000_myhovercraftisfullofeels_.doc)
myhovercraftisfullofeels (2010-Default_myhovercraftisfullofeels_.xlt)
myhovercraftisfullofeels (2010-Default_myhovercraftisfullofeels_.xls)
myhovercraftisfullofeels (2007-Office97-2000_myhovercraftisfullofeels_.xlt)
myhovercraftisfullofeels (2007-Office97-2000_myhovercraftisfullofeels_.xls)
myhovercraftisfullofeels (2007-Office97-2000_myhovercraftisfullofeels_.xla)
myhovercraftisfullofeels
(Test-RC4-40bit-MS-Dh-SChannel_myhovercraftisfullofeels_.xls)
myhovercraftisfullofeels
(Test-RC4-40bit-MS-Base-DSS_myhovercraftisfullofeels_.xls)
myhovercraftisfullofeels
(Test-RC4-40bit-MS-Base-DSS_myhovercraftisfullofeels_.doc)
myhovercraftisfullofeels
(Test-RC4-128bit-MS-Strong-Crypto_myhovercraftisfullofeels_.doc)
myhovercraftisfullofeels
(2003-RC4-40bit-MS-Base-DH-SChan_myhovercraftisfullofeels_.doc)
myhovercraftisfullofeels
(2003-RC4-40bit-MS-Base-Crypto-1.0_myhovercraftisfullofeels_.doc)
myhovercraftisfullofeels
(2003-RC4-40bit-MS-Base-1.0_myhovercraftisfullofeels_.xls)
VelvetSweatshop (2003-Office97-2000_VelvetSweatshop_.xls)
123456789012345 (2003-Office97-2000_123456789012345_.xls)
123456789012345 (2003-Office97-2000_1234567890123456_.doc)
123456789012345 (2003-Office97-2000_123456789012345_.doc)
guesses: 22 time: 0:00:00:04 0.00% (3) c/s: 363247 trying: shanes
guesses: 22 time: 0:00:00:27 0.00% (3) c/s: 385930 trying: 49156934
guesses: 22 time: 0:00:00:28 0.00% (3) c/s: 386472 trying: mongusa1
Use the "--show" option to display all of the cracked passwords reliably
Session aborted
$ ../run/john test2.in -show=left
XP-Office97-2000_myhovercraftisfullofeels_.xls:$oldoffice$0*828a2bd297901e027259a1e551f3f94d*04743711b2edaf3bec6ea7114858942e*9b99499b165944977a2acd08021e9ae4
XP-Office97-2000_myhovercraftisfullofeels_.doc:$oldoffice$1*92a395296a1e7c9922f29e45f3efbaf7*dcee41ef537674576b8ebb31434c4034*441d1ae1c2416b384787ab90966b4e40
2007-Office97-2000_myhovercraftisfullofeels_.dot:$oldoffice$1*990dd44f1c177328961d2561fe9fea8c*c0d2be728c6a4f33d097de13cfb38773*12412adcaa052acb1cb53301a7a93c2b
2007-Office97-2000_myhovercraftisfullofeels_.doc:$oldoffice$1*984961bc72f6e7937c372bcac57a5da4*871d27a553fd4aa1c93dc4a3ddabfbf1*725898afef7256b232fdf423ec12adbb
2003-Office97-2000_myhovercraftisfullofeels_.doc:$oldoffice$1*2f6e1e4087a28311d8473098f79367d6*e77706d7d89713b0afa90124e41ad5ab*0ad105395460b7eb8282de51c1189695
Libre-97-2000_myhovercraftisfullofeels_.xlt:$oldoffice$0*af8533d0c3ff51332d043499a5086a78*ff32fec60e2a1dde034ecba6961b8e2d*5602b0f69c38b70f65919c743387b38b
Libre-97-2000_myhovercraftisfullofeels_.xls:$oldoffice$0*8bde8531d53f7564efaa897c12a6e060*0552b48e7197cfa5655c0ed5afd20e7d*35131e9ac3141072e5608a749685f459
Libre-97-2000_myhovercraftisfullofeels_.doc:$oldoffice$1*cb5ed06ae27c03989b680ff3075b3558*8ae7ab4c9d5e8ea6c6391939fe8eee33*a0ffa5b7acc2d3062ca4a3e24c05827b
...so we miss 8 out of 30. I have no idea which is of what type.
magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
