john-users - Broken long/double DES hash split

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Sat, 14 Feb 2009 21:06:06 -0600
From: "Joshua J. Drake" <jtr-users@...p.org>
To: john-users@...ts.openwall.com
Subject: Broken long/double DES hash split

Alex,

I'm not sure if this is really broken or not, but it wasn't working
for the password file I have that uses these types of hashes.

Basically, the way I understand the format is:

XX YYYYYYYYYYY YYYYYYYYYYY
^  ^           ^
|  |           + second 8 chars result
|  + first 8 chars result
+ salt for both parts

I corrected the DES_fmt.c split() function as seen in the attached
patch.  Do you have files that work with the current method?

-- 
Joshua J. Drake

--- john-1.7.3.1/src/DES_fmt.c	2002-04-10 09:13:25.000000000 -0500
+++ john-1.7.3.1/src/DES_fmt.c.multi-fix	2009-02-14 20:50:00.000000000 -0600
@@ -106,7 +106,7 @@
 	static char out[14];

 	if (index) {
-		memcpy(out, &ciphertext[2], 2);
+		memcpy(out, ciphertext, 2);
 		memcpy(&out[2], &ciphertext[13], 11);
 	} else
 		memcpy(out, ciphertext, 13);

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]