Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 9 Dec 2011 10:23:24 -0600
From: "jfoug" <>
To: <>
Subject: RE: cracking RADIUS shared secrets with john the ripper

>From: jfoug []
>Once I get this version debugged, and fully tested, I will get it
>to the wiki.

Bug found.  Was doing a strcmp, vs a memcmp.  I needed the length, because I
am packing the internal salt data, with not interspersed nulls, along with
the internal salt data is not a string any more, it can contain NULL bytes,
if a HEX$...00... is seen.

Here is the 'test' app I am using to generate test data:

#include <stdio.h>
void main() {
   int i;
   char *hdr=":$dynamic_1$0000000000000000000000000";
   for (i = 0; i < 500000; ++i) {
//      printf ("%s%07d$%d\n", hdr,i,i);
      printf ("%s%07d$%d\n", hdr,i,i&255);

This code can make test data with 256 different salts, or with 500k unique
different salts.    One other good test is to make a 256 salt, and modify
the first 10 or so salts, so that they are not:  0, 1, 2, 3 ... but HEX$30,
HEX$31, HEX$32, ...     Once those are modified, the older john will find
more than 256 salts.  My new code still only finds 256 salts.  

Hopefully, I will have this fully tested and released today.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.