[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 3 Mar 2013 22:47:54 +0100
From: magnum <john.magnum@...hmail.com>
To: john-users@...ts.openwall.com
Subject: Re: dmg2john used and password cracked, hdiutil fails to accept it
On 3 Mar, 2013, at 7:53 , Just Me <notsosimpleme@...il.com> wrote:
> On Sun, Mar 3, 2013 at 3:03 PM, Dhiru Kholia <dhiru.kholia@...il.com> wrote:
>> Can you please generate similar images and post them for development
>> and testing purposes?
>
> I believe this would require old Mac OS which I do not have anymore,
> however if this is going to help with this case I will try to find a
> way to generate those
>
>> Can you post the hash (output of dmg2john)? It does not contain your data.
>
> Posted hash in the first email on this thread. Here it goes again, as
> a raw dmg2john output
>
> /dmg2john test.dmg
> test.dmg (DMG v1) successfully parsed, iterations count 0
The "iterations count 0" was one problem and I am to blame. A fix is now committed to both git repos. It will still print that 0 from dmg2john, but the formats will assume an iterations count of 1000 when zero (or not present).
> test.dmg:$dmg$1*20*21abcdeba1df423358288fb08e0f0527837075a6*40*79320d32be372c1a3ef6bc3b8a69f01a525e7b10e97929382cb486219a41690a017342bd737e39ed*48*c7221023d7b8ab215635cbe85f02a4573a1724e51d6e305271ff77d73766831f4f582e370265d2d32170ca42a9d3ed40*0::::/test.dmg
>
> and cracked:
>
> ./john hash
> Loaded 1 password hash (Apple DMG PBKDF2-HMAC-SHA-1 3DES / AES [32/64])
> Passwd6 (test.dmg)
> guesses: 1 time: 0:00:00:00 DONE (Sun Mar 3 15:45:45 2013) c/s:
> 176426 trying: Passwd6
>
> looking at the results it looks like hash got extracted and cracked correctly...
Unfortunately there is another problem too: the test for v1 is faaar too promiscuos. It will apparently accept 1 hash out of 64K (or so) as a false positive. You can re-build with -DDMG_DEBUG to make it go on trying to find more possible passwords but at this false rate it's probably useless.
$ ../run/john test.in -fo:dmg-opencl
Device 1: GeForce GT 650M
Local worksize (LWS) 64, Global worksize (GWS) 9216
Loaded 1 password hash (Apple DMG PBKDF2-HMAC-SHA-1 3DES / AES [OpenCL])
colip3 (test.dmg)
suntu (test.dmg)
47286345 (test.dmg)
seathop (test.dmg)
crchie (test.dmg)
morthia (test.dmg)
adep89 (test.dmg)
bl2221 (test.dmg)
metrid (test.dmg)
tulthe (test.dmg)
misacl1 (test.dmg)
7c6 (test.dmg)
0389045 (test.dmg)
41464815 (test.dmg)
guesses: 14/979719 time: 0:00:01:11 0.00% (3) c/s: 13750 trying: mulendan - mudinta1
Session aborted
Dhiru, can't we use the v2 plaintext checks for v1 too, after keeping the current tests as early reject? We should try to fix this before releasing Jumbo-8.
magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
