[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 9 Dec 2011 10:23:24 -0600
From: "jfoug" <jfoug@....net>
To: <john-dev@...ts.openwall.com>
Subject: RE: cracking RADIUS shared secrets with john the ripper
>From: jfoug [mailto:jfoug@....net]
>
>Once I get this version debugged, and fully tested, I will get it
>uploaded
>to the wiki.
Bug found. Was doing a strcmp, vs a memcmp. I needed the length, because I
am packing the internal salt data, with not interspersed nulls, along with
the internal salt data is not a string any more, it can contain NULL bytes,
if a HEX$...00... is seen.
Here is the 'test' app I am using to generate test data:
#include <stdio.h>
void main() {
int i;
char *hdr=":$dynamic_1$0000000000000000000000000";
for (i = 0; i < 500000; ++i) {
// printf ("%s%07d$%d\n", hdr,i,i);
printf ("%s%07d$%d\n", hdr,i,i&255);
}
}
This code can make test data with 256 different salts, or with 500k unique
different salts. One other good test is to make a 256 salt, and modify
the first 10 or so salts, so that they are not: 0, 1, 2, 3 ... but HEX$30,
HEX$31, HEX$32, ... Once those are modified, the older john will find
more than 256 salts. My new code still only finds 256 salts.
Hopefully, I will have this fully tested and released today.
Jim.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
