Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 5 Nov 2012 20:56:52 -0800 (PST)
From: wfdawson <wfdawson@...lsouth.net>
To: "john-users@...ts.openwall.com" <john-users@...ts.openwall.com>
Subject: Re: Need help with hashes from isocode plaintext

Before I get too excited about being done with this question:


> $ echo -n geländerxx | iconv -t utf-8 | md5sum 
> 2bfba679d5817bd26fef35e70a07f00a
> 
> OK, so it's not UTF-8. My second guess would be cp1252 or iso-8859-1 (they are the same for this letter):
> 
> $ echo -n geländerxx | iconv -t iso-8859-1 | md5sum 
> 005f3942106f3bc5a392dcde686d87f0
> 
> There you have it. Note the '-n' option to echo. Without it you will get a totally different MD5 because you will include a linefeed in the hashed string.

That helped - most of the hashes from that dump were cracked with that approach.  But, it turns out that didn't work for every hash/plaintext from that collection.

073f41b35f29de5ac019276c204ba16d:frühkölsch
1855b398f0e7733df11185183822b424:ซาลาเปา
1d9d908be226f034ed2cf29f956b1277:гармониÑ
2613f4d166ce5198ac1c8cc792afd584:123456йцукенг
2f2d2f5b0cf72f9d4e21a2c9f15ea92b:ÄŸÄŸÄŸÄŸÄŸÄŸÄŸÄŸ
42d4022d1111ff87c7594f2208ba32de:алекÑандра

I blindly tried every output type supported by iconv on my system (1173); nothing matched the hashes given.  Another approach for these hashes?

And, another weirdness:

h:
2202:10425bb1692fdbc45c6959cc668921d5

$ john --show --format=raw-md5 h
0 password hashes cracked, 1 left

$ grep 10425bb1692fdbc45c6959cc668921d5 ~/.john/john.pot
10425bb1692fdbc45c6959cc668921d5:emileebby

Nothing unusual about the plaintext there.  Strange result...

Powered by blists - more mailing lists

Your e-mail address:

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.