[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 04 Jan 2015 19:21:38 +0100
From: Frank Dittrich <frank.dittrich@...lbox.org>
To: john-users@...ts.openwall.com
Subject: john-1.8.0: --format=crypt trouble with invalid DES hashes
Solar,
I discovered a problem (both in core and in jumbo) with --format=crypt.
((detached from 1.8.0))run $ cat fail_crypt.pw
1:+9F93o1OxwgK1
2:$6$LKO/Ute40T3FNF95$6S/6T2YuOIHY0N3XpLKABJ3soYcXD9mB7uVbtEZDj/LNscVhZoZ9DEH.sBciDrMsHOWOoASbNLTypH/5X26gN0
3:CCNf8Sbh3HDfQ
((detached from 1.8.0))run $ ./john --format=crypt
--wordlist=password.lst fail_crypt.pw
Warning: hash encoding string length 13, type id #1
appears to be unsupported on this system; will not load such hashes.
Loaded 1 password hash (crypt, generic crypt(3) [?/64])
Self test failed (valid)
((detached from 1.8.0))run $ grep -v ':\$' fail_crypt.pw > fail_crypt-2.pw
((detached from 1.8.0))run $ ./john --format=crypt
--wordlist=password.lst fail_crypt-2.pw
Warning: hash encoding string length 13, type id #1
appears to be unsupported on this system; will not load such hashes.
No password hashes loaded (see FAQ)
((detached from 1.8.0))run $ tac fail_crypt-2.pw > fail_crypt-3.pw
((detached from 1.8.0))run $ ./john --format=crypt
--wordlist=password.lst fail_crypt-3.pw
Loaded 2 password hashes with 2 different salts (crypt, generic crypt(3)
[?/64])
Press 'q' or Ctrl-C to abort, almost any other key for status
Warning: crypt() returned NULL
0g 0:00:00:00 100% 0g/s 70920p/s 141840c/s 141840C/s !@.....sss
Session completed
The bug can be triggered if the libc's crypt() or crypt_r() considers
+9F93o1OxwgK1 to be a valid descrypt hash or not.
If libc's crypt() identifies some of the hashes of length 13 as invalid,
you can't reuse the result of previously tested hashes of length 13 to
accept or reject the current hash of length 13 (c3_fmt.c, lines 111-117).
I've created a bug repot for bleeding-jumbo here:
https://github.com/magnumripper/JohnTheRipper/issues/967
Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
