Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 12 Jan 2013 19:51:37 +0000
From: fevere alleee <qweeak@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: Cracking md5 salted password

**
Hello,

I tried following command  without any success ( kept it running for 7 days
on quad core sys 4GB ram )
---
./john password_file
---

I'm sure password is less than 16 characters , but contains special
characters ( so dictionary method fails ? ) . Is there any way i can give
the salt information into JTR ? . Also how can i know if it is FreeBSD MD5
crypt or FreeBSD crypt ) ?

Thanks
Qweeak



On 01/11/2013 11:18 PM, Stephen John Smoogen wrote:

On 11 January 2013 00:00, fevere alleee <qweeak@...il.com>
<qweeak@...il.com> wrote:

 Hi,

I'm newbie in this field. I got a md5 hash + salt in the format
--
user-name:$1$salt$hash
----

I could get correct hash by "openssl passwd -1 -salt salt password" . Does
this mean salt is in plain text ? How can i feed all this info into JTR so
that i can get password for other users ( salt is 8 characters long ) ?

 That is an md5crypt hash (or FreeBSD MD5 crypt hash, or FreeBSD crypt
depending on the literature). The Salt is in plain text and if the
password is less than 16 characters, then john will be able to brute
force it with

john --format=md5 --wordlist=<my dictionary goes here> <file with
passwords goes here>

If the passwords are longer than 15 characters then it needs the

john --format=crypt

which is usually 1/10th to 1/20th the speed of the shorter passwords.

Normally I do the following:

1) Run john with the top worst passwords lists (no more than 1000)

john --session=A --pot=projectA.pot --wordlist=password.lst passwd_file

2) Run john with the single rules. This takes the data stored in the
password file and figures out combinations that are most likely used

john --session=A --pot=projectA.pot --single password_file

3) Go with larger dictionaries and slower rules

john --session=A --pot=projectA.pot --rules
--wordlist=/usr/share/dict/words passwd_file

Look for patterns in the found passwords and try to figure out how to
"exploit" them. If you are auditing your companies passwords and the
companies name is RockPool.com then a lot of people are going to use
rock, pool, rockpool.com pool.com etc as the basis of their passwords
[rockpool1 will probably the number one password after password, and
account name.]


 Thanks
qweeak

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.