john-users - Re: reading "signons.txt" from friefox

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Thu, 9 Oct 2008 11:49:43 -0600
From: RB <aoz.syn@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: reading "signons.txt" from friefox

> Another description maybe in
>
>        http://www.haypocalc.com/wiki/Lamer
>
> But that seems to be only the entry for decoding, not the solution.

Their description is somewhat off - you have uudecode the string to a
byte stream before 'openssl asn1parse' will recognize it, and on my
systems the asn1parse ends with an error (object too long).  Not sure
why, but manually parsing part of the structure certainly seems to
confirm that it is ASN.1-encoded data.  You end up with two 8-byte
octet strings (user) or an 8- and a 16-byte one (password).

The short answer is thus: no, there is no way to use JtR to directly
decrypt/attack these.  If you or anyone care to work out how the pair
of octet strings are used (likely salt & hash), there may be a way to
manipulate them into a form current JtR can understand, but that again
is beyond my time and interest.

-- 
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.