john-users - Re: SHA256(XOR(salt+pass, key))

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 10 Sep 2019 09:58:07 -0400 (EDT)
From: jfoug openwall <jfoug.openwall@....net>
To: john-users@...ts.openwall.com
Subject: Re: SHA256(XOR(salt+pass, key))

On 9/10/2019 5:59 AM, Marcin Gębarowski wrote:> Credentials:
> admin:SecretP@...0rd
>
> Hash (providing both in Base64 and HEX form, the database contains 
> Base64 form):
> admin:JAdLh0jerQthm2tSrfFYje4/7AGvc8NIhDRNcUZldlk4HBzlWaSxwYH9v68E1O++9IWmH1oLNttA27UtKVbIIA== 
>
>
> or in hex form:
> admin:24074B8748DEAD0B619B6B52ADF1588DEE3FEC01AF73C34884344D7146657659381C1CE559A4B1C181FDBFAF04D4EFBEF485A61F5A0B36DB40DBB52D2956C820 
>
>
> ....

> Other credentials and their hashes (same XOR key used):
>
> admin:admin
> admin:LS2Y6dg3J6twutTSiKKNKRxwCjTYrUp0pvOxlw4/tahRg+6H0Cjx8uul+yJ3JBTPSow9d0zGz9D/38rlQLAOfw== 
>
> admin:2D2D98E9D83727AB70BAD4D288A28D291C700A34D8AD4A74A6F3B1970E3FB5A8:5183EE87D028F1F2EBA5FB22772414CF4A8C3D774CC6CFD0FFDFCAE540B00E7F 
>
>
> user:password
> user:cevg02yNV9rG7X+tpOtOquN49D5L3auDKaMfBU0mlDkv7W10xQuTBSSixXrupUnC7XEYMT9HnSn1BQ0Axmiw0A== 
>
> user:71EBE0D36C8D57DAC6ED7FADA4EB4EAAE378F43E4BDDAB8329A31F054D269439:2FED6D74C50B930524A2C57AEEA549C2ED7118313F479D29F5050D00C668B0D0 
>

Here is a pass_gen.pl for this.  I am not 100% sold on adding this to dynamic.   Also, salt
should have pepper xor'd to it at salt loading time. No reason to do 32 bytes of xor
every test.  Since there was no application listed, the output string in the pass_gen.pl
seem very contrived.


# sha256(xor($s$c1).xor($p,trunc($c1))),c1=$HEX$8148e6237b1412fad5ab21c35082363b7d5f7003ae31571e16b4d66ce7cce398
# format submitted on john-users email list
sub sha256_xorstatic {
    my $pepper = pack("H*", "8148e6237b1412fad5ab21c35082363b7d5f7003ae31571e16b4d66ce7cce398");
    my $salt = get_salt(32,32,\@chrHexLo);
    my $pass = $_[0];
    my $h = ($salt^$pepper).($pass^substr($pepper.$pepper.$pepper.$pepper,0,length($pass)));
    my $h = sha256_hex($h);
    return "\$sha256xor\$".unpack("H*",$salt)."\$$h";
}

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.