[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 25 Sep 2012 00:45:20 +0200
From: magnum <john.magnum@...hmail.com>
To: john-dev@...ts.openwall.com
Subject: Re: GECOS + single mode problem in JtR
On 24 Sep, 2012, at 22:46 , David Jones <jonesd@...umbus.rr.com> wrote:
> On Sep 24, 2012, at 1:42 PM, magnum wrote:
>
>> On 24 Sep, 2012, at 16:17 , Dhiru Kholia <dhiru.kholia@...il.com> wrote:
>>
>>> vmsdump file (attached) has the actual passwords in the GECOS field.
>>> However, john still fails to crack the hashes. Any ideas why?
>>>
>>> After manually extracting the passwords from the GECOS field and using
>>> them as input dictionary, john successfully cracks all the hashes.
>>>
>>> Is single cracking mode broken?
>>
>> From a quick look I believe it properly cracks all ASCII plaintexts. The input file is in ISO-8859 format. How are 8-bit characters handled by this format? This may or may not be just an incorrectly made test file.
>>
>
> The format doesn't do any special treatment of 8-bit characters in passwords. Loader.c would seem to be parsing the GECOS field into words using using separator characters that are in the password (e.g. '*').
Yes, that's it. So everything is in order, it's just not fully crackable using Single mode because of the words used. If you'd put the words in the username field instead, they would get cracked - as that field is also used as-is. We could consider doing the same from GECOS.
With a few specially crafted rules, some more would be cracked from GECOS. For the '*' case, this rule cracks another 225 of the words:
-p 1 $* 2
magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
