Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 14 Sep 2012 23:22:53 +0200
From: magnum <>
To: "" <>
Subject: Re: Office2john


Is there any chance a very loaded GECOS field can "overwrite" the login field or otherwise screw Single mode from getting a candidate from that field? We have reasons to believe that is the case. I'm planning to try to parse the code but I thought I'd give you a heads up in case you immediately know the answer. I tried to spot any limitation on GECOS stuff other than LINE_BUFFER_SIZE but did not find any.

Problem is this:
1. We've had office2john make userid:hash until now, which is really filename:hash. The hash in question was cracked by single mode, using the filename (username).
2a. We added lots of meta data from office files into GECOS field for use by Single mode. Userid field (filename) is still just like it was.
2b. Hash no longer gets cracked.

Specifically, this gets cracked by Single (password is qwerty1234):


This one does not get cracked:

2k_Office97-2000_qwerty1234_RC4.doc:$oldoffice$1*c9425e494d607e71dfed478802457f96*cd8c925ea49777be7b7ade744805b321*f4fd7bdc4b18be5c0701a5d195c8a12a:::1252 104 25 testing123 15376 592544 1252 Lorem ipsum dolor sit amet, consectetur adipiscing elit testing123 testing123 1 120 12987491460 12987491580 1 2196 12521 Microsoft Word 9.0 1::/Volumes/jtr16/Office/2k_Office97-2000_qwerty1234_RC4.doc


On 14 Sep, 2012, at 20:39 , magnum <> wrote:

> On 14 Sep, 2012, at 15:52 , Dhiru Kholia <> wrote:
>> On Fri, Sep 14, 2012 at 1:03 AM, magnum <> wrote:
>>> On 13 Sep, 2012, at 18:18 , Dhiru Kholia <> wrote:
>>>> Strangely after this change "2k_Office97-2000_qwerty1234_RC4.doc" file
>>>> stopped getting cracked. Any ideas why?
>>> I believe I do not have that file in my collection of samples... It's not from the wiki, right? With this version, as well as older versions, I get - and crack - 30 oldoffice and 15 office.
>> File attached. Why doesn't the single mode crack this file (when GECOS
>> field are filled)? If I remove the GECOS field then it is cracked.
>> Strange.
> That is a very good question, happens to me too. We might have found a bug in Single mode. I will look into this. Maybe the lot of keywords make the filename (the most important keyword) overflow or get dropped.
> magnum

Powered by blists - more mailing lists

Your e-mail address:

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.