Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 18 Jul 2015 01:05:35 +0200
From: rysic <rysic@...pl>
To: "john-users@...ts.openwall.com" <john-users@...ts.openwall.com>
Subject: Re: Re: Re:  Re: restore difficult zip password

OK! So, let me try to make small test:

I configured my john to gues max 4 length passwords:

[Incremental:Custom]
File = $JOHN/custom.chr
MinLen = 0
MaxLen = 4

# The theoretical CharCount is 211, we've got 196.
[Incremental:UTF8]
File = $JOHN/utf8.chr
MinLen = 0
MaxLen = 4
CharCount = 196

# This is CP1252, a super-set of ISO-8859-1.
# The theoretical CharCount is 219, we've got 203.
[Incremental:Latin1]
File = $JOHN/latin1.chr
MinLen = 0
MaxLen = 4
CharCount = 203

[Incremental:ASCII]
File = $JOHN/ascii.chr
MinLen = 0
MaxLen = 4
CharCount = 95

[Incremental:LM_ASCII]
File = $JOHN/lm_ascii.chr
MinLen = 0
MaxLen = 4
CharCount = 69

# This is CP858 (CP850 + Euro sign, superset of CP437).
# The theoretical CharCount is 209 minus lowercase, we've got 132.
[Incremental:LanMan]
File = $JOHN/lanman.chr
MinLen = 0
MaxLen = 4
CharCount = 132

# This is alnum (upper & lower case) as well as space.
[Incremental:Alnumspace]
File = $JOHN/alnumspace.chr
MinLen = 1
MaxLen = 4
CharCount = 63

[Incremental:Alnum]
File = $JOHN/alnum.chr
MinLen = 1
MaxLen = 4
CharCount = 62

[Incremental:Alpha]
File = $JOHN/alpha.chr
MinLen = 1
MaxLen = 4
CharCount = 52

[Incremental:LowerNum]
File = $JOHN/lowernum.chr
MinLen = 1
MaxLen = 4
CharCount = 36

[Incremental:UpperNum]
File = $JOHN/uppernum.chr
MinLen = 1
MaxLen = 4
CharCount = 36

[Incremental:LowerSpace]
File = $JOHN/lowerspace.chr
MinLen = 1
MaxLen = 4
CharCount = 27

[Incremental:Lower]
File = $JOHN/lower.chr
MinLen = 1
MaxLen = 4
CharCount = 26

[Incremental:Upper]
File = $JOHN/upper.chr
MinLen = 1
MaxLen = 4
CharCount = 26

[Incremental:Digits]
File = $JOHN/digits.chr
MinLen = 1
MaxLen = 4
CharCount = 10

Right?

And then I'm creating encrypted zip file (password is "asd") 

linux-kq4w:/home/kamil/john-1.8.0-jumbo-1/run # zip --encrypt test6.zip ../../Pobrane/john-1.8.0-jumbo-1.tar.gz 
Enter password: 
Verify password: 
  adding: ../../Pobrane/john-1.8.0-jumbo-1.tar.gz (deflated 45%)

generating hash file:
linux-kq4w:/home/kamil/john-1.8.0-jumbo-1/run # ./zip2john test6.zip > test6.h
ver 14  efh 5455  efh 7875  test6.zip->../../Pobrane/john-1.8.0-jumbo-1.tar.gz PKZIP Encr: 2b chk, TS_chk, cmplen=32762705, decmplen=59392000, crc=9FEB9743

And try to crack it:
linux-kq4w:/home/kamil/john-1.8.0-jumbo-1/run # ./john test6.h
Loaded 1 password hash (PKZIP [32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:08 DONE 3/3 (2015-07-18 00:46) 0g/s 9175Kp/s 9175Kc/s 9175KC/s |C%|..||||
Session completed
linux-kq4w:/home/kamil/john-1.8.0-jumbo-1/run # ./john --show
Password files required, but none specified
linux-kq4w:/home/kamil/john-1.8.0-jumbo-1/run # ./john --show test6.h
0 password hashes cracked, 1 left
linux-kq4w:/home/kamil/john-1.8.0-jumbo-1/run # ./john -stdout test6.h
Invalid options combination or duplicate option: "-stdout"
linux-kq4w:/home/kamil/john-1.8.0-jumbo-1/run # ./john -inc=utf8 test6.h
Loaded 1 password hash (PKZIP [32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:19 9.56% (ETA: 00:53:02) 0g/s 7093Kp/s 7093Kc/s 7093KC/s .9�t..;T�b
0g 0:00:00:49 30.88% (ETA: 00:52:22) 0g/s 9161Kp/s 9161Kc/s 9161KC/s {��2..ظ�3
0g 0:00:01:41 67.88% (ETA: 00:52:11) 0g/s 9969Kp/s 9969Kc/s 9969KC/s B+/�..B�~�
0g 0:00:02:03 84.56% (ETA: 00:52:09) 0g/s 10116Kp/s 10116Kc/s 10116KC/s �QG�..����
0g 0:00:02:18 95.66% (ETA: 00:52:08) 0g/s 10209Kp/s 10209Kc/s 10209KC/s .H:�...���
0g 0:00:02:25 DONE (2015-07-18 00:52) 0g/s 10200Kp/s 10200Kc/s 10200KC/s 애�..����
Session completed
linux-kq4w:/home/kamil/john-1.8.0-jumbo-1/run # ./john --show test6.h
0 password hashes cracked, 1 left
linux-kq4w:/home/kamil/john-1.8.0-jumbo-1/run # ./john -inc=ASCII test6.h
Loaded 1 password hash (PKZIP [32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:01 13.77% (ETA: 00:52:37) 0g/s 5697Kp/s 5697Kc/s 5697KC/s Vo6z..Vl35
0g 0:00:00:04 51.61% (ETA: 00:52:37) 0g/s 8513Kp/s 8513Kc/s 8513KC/s )Pv..\A`
0g 0:00:00:06 77.60% (ETA: 00:52:37) 0g/s 9138Kp/s 9138Kc/s 9138KC/s `EtR..`fE.
0g 0:00:00:08 DONE (2015-07-18 00:52) 0g/s 9218Kp/s 9218Kc/s 9218KC/s |C%|..||||
Session completed
linux-kq4w:/home/kamil/john-1.8.0-jumbo-1/run # 


"asd" password have to be included in ASCII and utf8 charlist, righ? Than why test is not working?

You wrote about -stdout. I saw that in documentation but it is not working:

linux-kq4w:/home/kamil/john-1.8.0-jumbo-1/run # ./john -stdout test6.h
Invalid options combination or duplicate option: "-stdout"


Kamil


W dniu 2015-07-18 00:36:51 użytkownik magnum <john.magnum@...hmail.com> napisał:
> On 2015-07-17 23:51, rysic wrote:
> > You are right, --node is well defined, but I can't find in
> > documentation how NFS share can benefit?
> 
> It's not documented a lot but for example, Jumbo has a feature called 
> "pot sync". If one process cracks a hash, the other processes will see 
> that and stop wasting time on it. In case of salts (especially unique 
> ones) this is a major benefit: When half the salts are cracked, speed 
> will be twice as fast.
> 
> > In configuration file there are few Incremental sections (if I
> > understand well by default john is using all of them), but is john
> > mixing this charlists? I mean if I have few charlists - LATIN,
> > UpperNum, custom then he is making one big list of chars and is using
> > it for brute force? And Min/MaxLen in this sections mean that maximum
> > x characters will be taken from charlist, but if I have this:
> >
> > [Incremental:ASCII]
> > File = $JOHN/ascii.chr
> > MinLen = 0
> > MaxLen = 13
> > CharCount = 95
> >
> > [Incremental:LM_ASCII]
> > File = $JOHN/lm_ascii.chr
> > MinLen = 0
> > MaxLen = 7
> > CharCount = 69
> >
> >
> > then it means tha john will try first combinatios of 0-13 characters
> > from ASCII and then he will try 0-7 combinations from LM_ASCII? If
> > yes, then if I have password combined of chars from two charlists
> > then john will not find it? Am I right?
> 
> No, only one section is used. For LM hashes and a few others, the 
> LM_ASCII section is used. For other formats, the ASCII one is used. This 
> can be tweaked in john.conf, including using the UTF8 section when 
> applicable.
> 
> You can force use of whatever section you want using eg. -inc=utf8 or 
> -inc=custom (if you built a custom.chr file). Try it out using -stdout 
> and watch the difference.
> 
> magnum
> 
> 



Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.