[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 14 Sep 2012 23:22:53 +0200
From: magnum <john.magnum@...hmail.com>
To: "john-dev@...ts.openwall.com" <john-dev@...ts.openwall.com>
Subject: Re: Office2john
Solar,
Is there any chance a very loaded GECOS field can "overwrite" the login field or otherwise screw Single mode from getting a candidate from that field? We have reasons to believe that is the case. I'm planning to try to parse the code but I thought I'd give you a heads up in case you immediately know the answer. I tried to spot any limitation on GECOS stuff other than LINE_BUFFER_SIZE but did not find any.
Problem is this:
1. We've had office2john make userid:hash until now, which is really filename:hash. The hash in question was cracked by single mode, using the filename (username).
2a. We added lots of meta data from office files into GECOS field for use by Single mode. Userid field (filename) is still just like it was.
2b. Hash no longer gets cracked.
Specifically, this gets cracked by Single (password is qwerty1234):
2k_Office97-2000_qwerty1234_RC4.doc:$oldoffice$1*c9425e494d607e71dfed478802457f96*cd8c925ea49777be7b7ade744805b321*f4fd7bdc4b18be5c0701a5d195c8a12a
This one does not get cracked:
2k_Office97-2000_qwerty1234_RC4.doc:$oldoffice$1*c9425e494d607e71dfed478802457f96*cd8c925ea49777be7b7ade744805b321*f4fd7bdc4b18be5c0701a5d195c8a12a:::1252 104 25 testing123 15376 592544 1252 Lorem ipsum dolor sit amet, consectetur adipiscing elit testing123 Normal.dot testing123 1 120 12987491460 12987491580 1 2196 12521 Microsoft Word 9.0 1::/Volumes/jtr16/Office/2k_Office97-2000_qwerty1234_RC4.doc
magnum
On 14 Sep, 2012, at 20:39 , magnum <john.magnum@...hmail.com> wrote:
> On 14 Sep, 2012, at 15:52 , Dhiru Kholia <dhiru.kholia@...il.com> wrote:
>
>> On Fri, Sep 14, 2012 at 1:03 AM, magnum <john.magnum@...hmail.com> wrote:
>>> On 13 Sep, 2012, at 18:18 , Dhiru Kholia <dhiru.kholia@...il.com> wrote:
>>>> Strangely after this change "2k_Office97-2000_qwerty1234_RC4.doc" file
>>>> stopped getting cracked. Any ideas why?
>>>
>>> I believe I do not have that file in my collection of samples... It's not from the wiki, right? With this version, as well as older versions, I get - and crack - 30 oldoffice and 15 office.
>>
>> File attached. Why doesn't the single mode crack this file (when GECOS
>> field are filled)? If I remove the GECOS field then it is cracked.
>> Strange.
>
> That is a very good question, happens to me too. We might have found a bug in Single mode. I will look into this. Maybe the lot of keywords make the filename (the most important keyword) overflow or get dropped.
>
> magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
