Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 05 Jun 2005 21:37:58 +0200
From: "Frank Dittrich" <>
Subject: Dupes recognition based on internal representation of ciphertext?

It looks like the dupes recognition in cracker.c (crk_process_guess)
is based on the internal representation of the ciphertext.

This has some unexpected consequences, if different external
representations of the same hash exist.

To reproduce the problem, add the rawMD5 patch to JtR, and if
valid only allows characters '0' - '9' and 'a' - 'f', replace
	(('a' <= ciphertext[i])&&(ciphertext[i] <= 'f')) ))
	(('a' <= ciphertext[i])&&(ciphertext[i] <= 'f')) ||
	(('A' <= ciphertext[i])&&(ciphertext[i] <= 'F')) ))
in rawMD5_fmt.c.
Then, it doesn't matter whether the MD5 hash is in upper or lower case.

Using this sample file with password hashes:

$ cat h

and this sample password file:

$ cat p

and starting john like this:

$ ./john --format=raw-md5 --wordlist=p h
Loaded 3 password hashes with no different salts (Raw MD5 [raw-md5])
abc              (3)
abc              (2)
abc              (1)
guesses: 3  time: 0:00:00:00 100%  c/s: 5.55  trying: abc

it looks like all passwords have been guessed.

However, only one hash gets saved in john.pot:

$ cat john.pot

$ ./john --show h

1 password cracked, 2 left

In order to add the other hashes, you'll have to run john repeatedly,
using all previously cracked passwords as the new password list:

$ cut --fields=2- --delimiter=":" john.pot | sort -u > p2
$ ./john --format=raw-md5 --wordlist=p2 h
Loaded 2 password hashes with no different salts (Raw MD5 [raw-md5])
abc              (2)
abc              (1)
guesses: 2  time: 0:00:00:00 100%  c/s: 7.69  trying: abc

$ ./john --format=raw-md5 --wordlist=p2 h
Loaded 1 password hash (Raw MD5 [raw-md5])
abc              (1)
guesses: 1  time: 0:00:00:00 100%  c/s: 4.00  trying: abc

Of course, for raw MD5 the problem can be avoided by just
translating all hashes to lower case.

But there might exist hash algorithms which use different external
representations for the same hash.
In this case, it's unfortunate that not all external representations
get saved in john.pot.

Best regards, and thanks in advance for clarification

Frank Dittrich

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.