Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 4 Apr 2015 13:05:12 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Problem with john.conf

On Tue, Mar 24, 2015 at 04:09:48PM +0800, Kai Zhao wrote:
> I have a problem with john.conf. There are two cases, both add '?' before
> "List.Rules"

For those puzzled by this, Kai is working on fuzzing JtR to find
possible bugs.  This is being discussed mostly on john-dev.

> config_1
> 
> # Default Loopback mode rules.
> [?List.Rules:Loopback]
> .include [List.Rules:NT]
> .include [List.Rules:Split]
> # For Single Mode against fast hashes
> [List.Rules:Single-Extra]
> 
> config_2
> 
> # Default Loopback mode rules.
> [?List.Rules:Loopback]
> # For Single Mode against fast hashes
> [List.Rules:Single-Extra]
> 
> Currently, john just ignored the two sections which starts with
> "?List.Rules".
> Should john report error message when the section likes "?List.Rules" ?
> I would appreciate it if you could give me some advice.

Here's what doc/CONFIG says:

---
The configuration file consists of several sections.  Each section
starts with a line containing its name, in brackets ("[...]").  Sections
consist either of "variable = value" assignments (each on its own line)
or of some other content specific to the particular section's type
(names of such sections start with "List.").  Section and variable names
are not case sensitive.  Comment lines start with a hash character ("#")
or a semicolon (";") and are ignored.  Also ignored are any empty lines.
---

So when you rename a "List." section to have its name start with
something other than "List.", the section gets parsed as many
"Name = value" pairs.  I've just tried, and indeed when I rename
[List.Rules:Single] to [?List.Rules:Single], I get a syntax error a few
lines below (in both the core tree and jumbo), because the rules are not
of the "Name = value" syntax.

I've also just tried renaming [List.Rules:Loopback] to
[?List.Rules:Loopback], and there's no error from this (when starting
john in an unrelated mode).  I do find this behavior a bit weird, and I
guess it has to do with how the .include feature is implemented in jumbo
(this feature isn't present in the core tree).

I suggest that you bring this topic back to john-dev, to JimF's
attention (he implemented .include in jumbo).

Although you do not directly discuss the source code, so this topic
could be appropriate for the -users list, I think the scenario is too
obscure to be of interest to -users.

Thanks,

Alexander

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.