john-users - Re: cracking md5 passwords not working

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 10 Jul 2008 09:11:27 -0400
From: Bill Gurley <gurley@....chem.utk.edu>
To: john-users@...ts.openwall.com
Subject: Re: cracking md5 passwords not working

ram wrote:
> On Thu, 2008-07-10 at 07:47 +0200, Simon Marechal wrote:
>> ram wrote:
>>> On Wed, 2008-07-09 at 16:07 +0200, Simon Marechal wrote:
>>>> ram a écrit :
>>>>> I have got john 1.7.2 installed with the raw-MD5 patch (Linux  64 bit )
>>>>>
>>>>> My passwords are created using Digest::MD5::md5_base64() perl function 
>>>>> (http://search.cpan.org/~gaas/Digest-MD5-2.36/MD5.pm )
>>>>>
>>>>>
>>>>> But whenever I run john I get a error 
>>>>> No password hashes loaded
>>>>>
>>>>>
>>>>> The document says the passwords must match  "openssl md5" passwords ,
>>>>> that doesnt work too 
>>>> Based on you function name, I guess they are base64 encoded. You need 
>>>> hex encoded passwords. They should look like that:
>>>> e7c714f84f25c28eb3f9e4f6ef82d52d
>>>>
>>>>
>>> Ok can I use john for md5_base64() passwords in any way ? 
>> Yes, by converting the base64 encoding into hex encoding. Or you can 
>> write your own plugin
>>
> 
> Sorry maybe off topic here , how do I convert base64 to hex. I am
> searching for some perl module .. cant get 


I managed to do this a while back in a not-very-elegant way.  First you 
should make sure that you have a pretty "clean" file that does not have 
any empty entries, and has two columns of usernames and base64 strings.

Then strip out the usernames, so that you have a second file with JUST 
the base64 strings.  Then I made a script that works on the file that 
just has the base64 strings, converting them to hashes.  The relevant 
command is something like this:

perl -MMIME::Base64 -ne 'print decode_base64($_) <string>

Then you have to make a script that puts the uid's back with the hashes 
in the same order.  (this is why you don't want any that have blank 
passwords in the list.)

Sorry, but I don't have my scripts cleaned up and in a format that I'm 
comfortable posting here, but I'll try to do that soon and post it. 
Once you have the file with ssha hashes instead of base64, then you can 
use jtr on it.


-Bill-

---------------------------------
  Bill Gurley, Technical Director
  Department of Chemistry
  Univ. of Tennessee, Knoxville
  865-974-3145


-- 
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.