Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list] 
Date: Thu, 18 Jan 2007 23:44:33 -0300 (ART)
From: Danett song <danett18@...oo.com.br>
To: john-users@...ts.openwall.com
Cc: solar@...nwall.com
Subject: Re: OpenUnix 8 hash format is not the normal DES?

Hi Solar Designer,
  
  >Did you run the above command as root?  
  
  Sure. :)
  
  >If so, then either this build of Perl lacks shadow password support  (it's a Perl >compile-time option) or the getspnam(3) function  doesn't return the hashes. I >suspect that it's the former. Please  try the attached C program.
  
  Probability it's compiled with leak of shadow password support.
  
  I used the C version and it worked, but the most strange happaned, it  output hashs EXACTLY like in the /etc/shadow file, which in theory  couldn't store more than 7/8 byte longs password (as a DES key is 56/64  bits (don't remember exactly the size)).
  
  So now, nothing make sense, it appear to have other password file  (/etc/defaults/ia/master) however it have a own format, the shadow have  only DES format hashs, the program using getpwent() and getspnam()  return hash exactly as in shadow file (DES format), and the system in  some fashion is able to recoganize passwords with 8, 9, 10, 11  characters long via /bin/login, /bin/su, ... 
  
  I can't understand... :(
  
  Thank you for all help and support.
  
  Regards

Solar Designer <solar@...nwall.com> escreveu:  On Mon, Jan 15, 2007 at 02:26:07PM -0300, Danett song wrote:
> > perl -e 'print "$n:$p:$u:$g:$f:$d:$s\n" while ($n,$p,$u,$g,$q,$c,$f,$d,$s) = getpwent()'
>   
>   Unhapply it doesn't work as expected, it show all informations, expect the hashs...
>   
>   root:x:0:3:0000-Admin(0000):/:/sbin/sh

Did you run the above command as root?  If so, then either this build of
Perl lacks shadow password support (it's a Perl compile-time option) or
the getspnam(3) function doesn't return the hashes.  I suspect that it's
the former.  Please try the attached C program.

-- 
Alexander Peslyak 
GPG key ID: 5B341F15  fp: B3FB 63F4 D7A3 BCCC 6F6E  FC55 A2FC 027C 5B34 1F15
http://www.openwall.com - bringing security into open computing environments

Was I helpful?  Please give your feedback here: http://rate.affero.net/solar
#include 
#include 

#include 

int main(void)
{
 struct passwd *pw;
 struct spwd *spw;

 while ((pw = getpwent())) {
  spw = getspnam(pw->pw_name);
  if (spw)
   pw->pw_passwd = spw->sp_pwdp;
  printf("%s:%s:%u:%u:%s:%s:%s\n",
   pw->pw_name, pw->pw_passwd, pw->pw_uid, pw->pw_gid,
   pw->pw_gecos, pw->pw_dir, pw->pw_shell);
 }

 return 0;
}

-- 
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.


 __________________________________________________
Fale com seus amigos  de graça com o novo Yahoo! Messenger 
http://br.messenger.yahoo.com/

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.