[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 5 Oct 2010 06:15:42 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: SHA1 salted syntax ???
On Sat, Oct 02, 2010 at 09:46:17PM +0200, websiteaccess@...il.com wrote:
> How crack sha1 salted ???? I have latest JTR + jumbo patch
>
> IS JTR able at least to crack SHA1 salted ?
You kept asking this question over and over, so let's just say that your
approach has worked and the answer is yes. Please find the patch
attached, to be applied on top of 1.7.6-jumbo-7. I've also uploaded it
to the wiki:
http://openwall.info/wiki/john/patches
As currently implemented, this is not as generic as JimF's "generic MD5"
code (only the simplest two kinds of salted SHA-1 hashes are supported)
and it is not very fast (uses OpenSSL's SHA-1 code). Yet it would do
the trick for most requests for salted SHA-1 hash cracking that we've
seen posted in here so far.
For example, using the hash from:
http://www.openwall.com/lists/john-users/2010/07/12/2
we can create the following password file:
michael:$SHA1p$michael$fd413c2fff221bf1f93edb25604397d31c1de182
and the password gets cracked:
$ ./john pw
Loaded 1 password hash (Generic salted SHA-1 [32/32])
house (michael)
guesses: 1 time: 0:00:00:00 100.00% (2) (ETA: Tue Oct 5 05:53:48 2010) c/s: 60550 trying: house
$ ./john --show pw
michael:house
1 password hash cracked, 0 left
> username 1350407a4d1b5c097e6493b771958f5c74b80b55
>
> The salt is NOT username
> I know the plaintext -> 160904
Well, you're missing both the salt and the algorithm. "Salted SHA-1" is
not specific enough. In this patch, I've implemented two kinds of it -
maybe one of them is what you have with that hash, or maybe not.
> May be the salt is missing, I generated a file with username + hash +
> 3 charaters salt, from :
...
> What is the syntax for JTR ????
You can generate hash encodings (including salt) that will work with the
attached patch using the following tiny Perl script:
#!/usr/bin/perl
$hash = '1350407a4d1b5c097e6493b771958f5c74b80b55';
while (<>) {
chomp;
print "\$SHA1p\$$_\$$hash\n";
print "\$SHA1s\$$_\$$hash\n";
}
You may use it like:
./john -i --stdout | head -100000 | ./guessalt.pl > pw
echo 160904 | ./john --stdin pw
I've already tried the above - it works, but has no luck cracking your
specific password. You can try going beyond 100000 different salt
strings, or you can try a different approach at generating them (not
just "-i"). Of course, it is entirely possible that your hash type is
simply not one of those supported with this patch.
...Oh, here's a better idea: these two algorithms treat the salt and the
password almost the same (the salt and the password are concatenated),
so it "does not matter" which string you treat as the salt. You can put
the following two lines into a password file for JtR:
$SHA1p$160904$1350407a4d1b5c097e6493b771958f5c74b80b55
$SHA1s$160904$1350407a4d1b5c097e6493b771958f5c74b80b55
where your known plaintext is specified as if it were the salt. Then
you simply run "john" against this file, and it will try cracking the
salt for you. :-) I've just tried this - no luck so far. Either your
algorithm is different (not one of these two) or your salt string is
more complicated than what John has tried so far, or some other info
you've provided is wrong (e.g., your known password)...
Good luck!
Alexander
View attachment "john-1.7.6-jumbo-7-sha1_gen-1.diff" of type "text/plain" (6638 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
