Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 24 Jan 2013 19:57:06 +0530
From: Dhiru Kholia <dhiru.kholia@...il.com>
To: john-dev@...ts.openwall.com
Subject: Re: PDF format incompatibility (jumbo-7 vs. jumbo-8)

On Thu, Jan 24, 2013 at 4:45 PM, Frank Dittrich
<frank_dittrich@...mail.com> wrote:
> I prepared 2 test files, one from the jumbo-7 pdf test cases, one from
> the jumbo-8 test cases (both attached).
>
> Apparently, pdf format considered these hashes as valid, but missed to
> crack them using single mode.
>
> Jumbo-8 doesn't recognize the hashes which were stored in john.pot by
> jumbo-7.
> IMHO, jumbo-8 needs a prepare() function which converts the
> $pdf$Standard* hashes into the format expected by the jumbo-8 valid().
>
> Furthermore, the jumbo-8 valid() needs to be improved.
> I.e., without a prepare() which converts the jumbo-7 hashes, the jumbo-8
> version should have rejected them as invalid.
> (After s/:$pdf$Standard/:$pdf$St/, jumbo-8 still treats the hashes as
> valid, but it shouldn't.)

A simple (but probably unpopular) fix is to reject old-style hashes.

diff --git a/src/pdf_fmt_plug.c b/src/pdf_fmt_plug.c
index 0ac01df..010dcfd 100644
--- a/src/pdf_fmt_plug.c
+++ b/src/pdf_fmt_plug.c
@@ -88,11 +88,17 @@ static int valid(char *ciphertext, struct fmt_main *self)
        char *ctcopy = strdup(ciphertext);
        char *keeptr = ctcopy;
        char *p;
+       int res;
        if (strncmp(ciphertext,  "$pdf$", 5) != 0)
                goto err;
        ctcopy += 5;
        if ((p = strtok(ctcopy, "*")) == NULL)  /* V */
                goto err;
+       res = atoi(p);
+       if(strlen(p) > 1)
+               return 0;
+       if(res > 5 || res < 1)
+               goto err;
        if ((p = strtok(NULL, "*")) == NULL)    /* R */
                goto err;
        if ((p = strtok(NULL, "*")) == NULL)    /* length */


This can be extended further.

-- 
Dhiru

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ