john-users - A couple broken formats from jumbo-2

Openwall wordlists collection for password cracking (20+ languages)
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 6 Nov 2009 09:56:41 -0600
From: "JFoug" <jfoug@....net>
To: <john-users@...ts.openwall.com>
Subject: A couple broken formats from jumbo-2

The MMX/SSE builds of mssql and mssql05 are broken.

I found this, when I changed the testing code in format.c from

  format->methods.set_salt(salt);
  format->methods.set_key(current->plaintext, index);

to the 'proper' order of:

  format->methods.set_key(current->plaintext, index);
  format->methods.set_salt(salt);


The thing 'broken' within mssql_fmt and mssql05_fmt are that in the MMX 
builds, the set_key() function is loading the key into the input buffer, and 
then loading the salt.

However, during normal running, john sets all the keys, and then repeatedly, 
calls set_salt/crypt_all ... set_salt/crypt_all  .... until all salts have 
been handled.    Thus, as written, the mssql[05] formats in MMX will only 
find a random password here and there, due to not properly setting the 
salts.

I have seen this in example:

Loaded 13 password hashes with 13 different salts (MS-SQL [ms-sql])
FOO              ()
BAR              ()
CANARD           ()
LAPIN            ()
guesses: 4  time: 0:00:00:00 100.00% (ETA: 11/06/09 09:38:46)  c/s: 46000 
trying:

Loaded 13 password hashes with 13 different salts (MS-SQL [ms-sql SSE2])
BAR              ()

I took the 4 test formats, and built a file with more of them (but corrupted 
the other lines with 'wrong' numbers).  I also spread out the 'real' data 
throughout the file, and ran it.  The password file only contained the 4 
passwords.

The correct way the format HAS to be, is that set_key() sets the key (it can 
load it into the intput buffer in MMX format).  However, at crypt_all, the 
salt has to be loaded.  It IS loaded for the non-SSE code, but not for SSE.

I have not made this change yet. I will not make this part of 
the -after-jumbo patch set I am working on. It certainly is it's own stand 
alone, and probably should be part of a jumbo-3.    I can easily get the 
code 'right', and submit a stand alone patch for this, but it is not on my 
priority.


Jim.