Date: Mon, 27 Jul 2009 06:01:04 -0500 From: "JimF" <jfoug@....net> To: <john-users@...ts.openwall.com> Subject: Generation method I used for prepend and append 'rules' Here are the steps I used to build a nice prepend / append ruleset for usage in John. This information is being provided as is. It was thrown together, to satisfy a personal test (successful) of my own. It was coded quickly, and not done in a very clean manner. I make no apologies for it. use it or modify it to your own needs. Or simply use the rules I have provided, prebuilt. NOTE this method can crack some pretty long, and pretty complex passwords. First a little information. The data used, was a set of cracked passwords. There were NOT a simple john.pot, but a list of all the passwords used. If there were multiple words of the same, I wanted to have each multiple copy. To do this, I took the cracked list, and used john -show and piped that to a file. Then used cut So Step 1. Crack a lot of passwords, or get a good cracked db Step 2. Run john -show -format=??? hashes_lst > crk Step 3. Get 'just' the passwords: cut -d: -f2 crk > pass_all Ok, now we have a list of the cracked passwords. What we now want to do, is to 'find' things that are added to normal dictionary words (the database I worked from was mostly English, so I used English words). Obtain the proper language dictionaries from openwall.net For this example, I used all of the dictionaries from the English directories. Step 4. Get the dictionary words. I concatenated all the word files from 'English' section from the openwall lists. Step 5. Sort this dictionary list. The sorted file is named english-sorted.all Step 6. Run the program pre_post_cnt and redirect output. NOTE as in original source, the file names pass_all and english-sorted.all ARE required names. pre_post_cnt > data the pre_post_cnt.cpp is provided. It is a simple hacked out program, not well done, but it works (for me ;) The output will be 3 fields The fields are: count 'string' (Type) Type will be (Pre) or (Post). As the program runs (it may take a couple minutes), it will inform you to stderr what it is doing (which password is being worked on). When all are done, it will output and exit. NOTE this file will only output (as written), if there are 11 instances or more of a prepend/append sequence. This can be adjusted by editing the source. Step 7. Grep out (Pre) grep (Pre) data > pre_data Step 8. grep out (Post) grep (Post) data > post_data Note, I use wc to make sure that all of the lines were accounted for, they should be, but it never hurts to check. Step 9. Now, sort both per and post data sort -n -r pre_data > prepend-lst sort -n -r post_data > append-lst The default pre_post_cnt.cpp only outputs if > 10 'hits', but if you have coded to see ALL of them, you most likely will want to remove all of the singleton and probably even more from your prepend-lst and append-lst files. Ok, we are almost home. Step 10, build prepend.lst and append.lst files. These files contain ONLY the string data. To get them do: cut -d\` -f2 prepend-lst > prepend.lst cut -d\` -f2 append-lst > append.lst NOTE the back quote under the ~ char If this char is used, modify the pre_post_cnt.cpp to use a different letter. NOTE2, there will usually be more append rules (not sure why, but this is what I saw). That being so, I will often make sure more prepends get added, by requiring fewer to 'keep' them in pre_post_cnt.cpp step 11. Build the rules. Run the program JohnWordMerge.c (sorry about the naming, but that is it :) JohnWordMerge > rules Step 12. Edit john.conf (or john.ini) and add these rules as a new [Rules.Wordlist] section. If using the newer version of john, that .Wordlist can be any value, and then the rules=wordlist can tell john which section to use. Enhancements: Some up-casing, lower-casing (all upper was pretty good), Case, w-space removal, w-space removeal lower/upper, upcase after preprocessing (best in my test), etc all can crack more passwords. Not nearly as many as the 'base', but by the time you get to using rules like this, much of the wordlist based cracking has been done and only the 'hard' crap is left. Also, devising a method of doing pre AND append on the same word would certainly crack some words. I have not tried doing this, but it is not beyond the grasp of techniques shown here. Good luck, and happy cracking, Jim. The pre-built set of rules I have originally put together for this can be found on the wiki page. It was too large to send to the email list. http://openwall.info/wiki/john/usage-examples View attachment "pre_post_cnt.cpp" of type "text/plain" (4577 bytes) View attachment "JohnWordMerge.c" of type "text/plain" (3512 bytes) -- To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.