[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20130213144338.GA2135@openwall.com>
Date: Wed, 13 Feb 2013 18:43:38 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Cracking AIX {smd5} password hashes
On Wed, Feb 13, 2013 at 12:58:49PM +0200, Aki Immonen wrote:
> I'm trying to figure out how to crack AIX 6.1 and 7.1 password hashes. The hashes are stored at /etc/security/passwd and are formatted as follows:
>
> user:
> password = {smd5}s8/xSJ/v$uGam4GB8hOjTLQqvBfxJ2/
> lastupdate = 1360665171
>
> The password that resulted the above hash is 'password'.
Thank you for this sample!
> The AIX documentation says it is salted MD5 hash, but the format seems to be different that the normal $1$ hashes.
Right. We've just discussed this issue in {ssha512} context, and we do
not have a solution yet - we do not know the algorithm, and we were not
able to guess it so far. I suspect that {smd5} is similar, except for
the MD5 vs. SHA-512 difference.
> The salt and the hash both seem to be BASE64 encoded, and I've tried to re-generate the hash with this command without success:
>
> (echo "s8/xSJ/v"|base64 -D; echo -n "password")|openssl md5 -binary|base64
It's trickier than that, but like I said we don't know the exact
algorithm yet.
I've spent a few hours of CPU time searching potential algorithms based
on the {ssha512} samples, with no luck so far. It's probably most
straightforward to locate and reverse-engineer the binary, in a country
where that is legal regardless of what IBM's license may say.
Meanwhile, this probably won't work, but can you try building JtR on AIX
itself and then running it with "--format=crypt" against a file
containing just:
{smd5}s8/xSJ/v$uGam4GB8hOjTLQqvBfxJ2/
(text file with that one line in it)?
Thanks,
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
