Date: Sun, 05 Jun 2005 21:37:58 +0200 From: "Frank Dittrich" <frank_dittrich@...mail.com> To: john-users@...ts.openwall.com Subject: Dupes recognition based on internal representation of ciphertext? It looks like the dupes recognition in cracker.c (crk_process_guess) is based on the internal representation of the ciphertext. This has some unexpected consequences, if different external representations of the same hash exist. To reproduce the problem, add the rawMD5 patch to JtR, and if valid only allows characters '0' - '9' and 'a' - 'f', replace (('a' <= ciphertext[i])&&(ciphertext[i] <= 'f')) )) with (('a' <= ciphertext[i])&&(ciphertext[i] <= 'f')) || (('A' <= ciphertext[i])&&(ciphertext[i] <= 'F')) )) in rawMD5_fmt.c. Then, it doesn't matter whether the MD5 hash is in upper or lower case. Using this sample file with password hashes: $ cat h 1:900150983cd24fb0d6963f7d28e17f72 2:900150983CD24FB0D6963F7D28E17F72 3:900150983cD24fB0d6963F7d28E17f72 and this sample password file: $ cat p abc and starting john like this: $ ./john --format=raw-md5 --wordlist=p h Loaded 3 password hashes with no different salts (Raw MD5 [raw-md5]) abc (3) abc (2) abc (1) guesses: 3 time: 0:00:00:00 100% c/s: 5.55 trying: abc it looks like all passwords have been guessed. However, only one hash gets saved in john.pot: $ cat john.pot 900150983cD24fB0d6963F7d28E17f72:abc $ ./john --show h 3:abc 1 password cracked, 2 left In order to add the other hashes, you'll have to run john repeatedly, using all previously cracked passwords as the new password list: $ cut --fields=2- --delimiter=":" john.pot | sort -u > p2 $ ./john --format=raw-md5 --wordlist=p2 h Loaded 2 password hashes with no different salts (Raw MD5 [raw-md5]) abc (2) abc (1) guesses: 2 time: 0:00:00:00 100% c/s: 7.69 trying: abc $ ./john --format=raw-md5 --wordlist=p2 h Loaded 1 password hash (Raw MD5 [raw-md5]) abc (1) guesses: 1 time: 0:00:00:00 100% c/s: 4.00 trying: abc Of course, for raw MD5 the problem can be avoided by just translating all hashes to lower case. But there might exist hash algorithms which use different external representations for the same hash. In this case, it's unfortunate that not all external representations get saved in john.pot. Best regards, and thanks in advance for clarification Frank Dittrich
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.