Date: Tue, 6 Apr 2010 03:16:48 +0400 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Re: GECOS-based single-mode (or possibly wordlist) rule help needed On Mon, Apr 05, 2010 at 12:39:56PM -0400, ddd@...eup.net wrote: > What is the syntax for a rule that would extract a user's initials from their GECOS field and append a string to it? The rules don't "extract" anything from anywhere other than the input "word" (or in some rare cases two input "words") that they're invoked to operate on. When running in "single crack" mode, JtR itself takes the login name, the home directory name, extracts "words" from the GECOS field, and it uses all of these as input to "single crack" mode rules. It also tests any two of these "words" concatenated (in either order), as well as picking the first character (possibly an initial) of one word and appending the other word to that (also in either order). This logic is hard-coded in single.c. For example, with this being the only password file line: john:rEK1ecacw.7.c:0:0:John Smith:/home/john:/bin/sh and this being the only rule (a no-op): [List.Rules:Single] : JtR will test the following candidate passwords in "single crack" mode: john johnJohn jJohn johnSmit jSmith John Johnjohn Jjohn JohnSmit JSmith Smith Smithjoh Sjohn SmithJoh SJohn (the truncation to 8 characters is due to this specific hash type). I obtained the list above by inserting puts(key); into cracker.c: crk_process_salt() right after the strnzcpy(key, ...) line. Now let's try the following rule instead: [List.Rules:Single] '2 Az"foo" This produces: jofoo jJfoo jSfoo Jofoo Jjfoo JSfoo Smfoo Sjfoo SJfoo which looks like what you wanted and more. To avoid some of the extra (undesired?) candidate passwords where "foo" was appended to other than two initials, we can use a "word pair" rule: [List.Rules:Single] 1 <2 + '2 Az"foo" This insists that the first of two "words" be of less than two characters long (effectively meaning exactly one character long). The output from this rule is shorter: jJfoo jSfoo Jjfoo JSfoo Sjfoo SJfoo BTW, the lowercase "j" comes from the login name (or the home directory name). To avoid trying mixed-case initials, we can use: 1 <2 + '2 [lu] Az"foo" This produces: jjfoo jsfoo sjfoo JJfoo JSfoo SJfoo To try the initials in lowercase only, we can use: 1 <2 + '2 l Az"foo" which produces: jjfoo jsfoo sjfoo There are no duplicates here due to duplicate-checking code in single.c. However, that code tries to strike a balance between its overhead (extra memory consumed and CPU time spent) and effectiveness (the ratio of duplicate candidate passwords detected and avoided vs. those that are left undetected and passed into cracker.c). So, while it worked well in this example, it might not work so well in other cases. Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.