john-users - Re: custom character set

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080126041628.GA28160@openwall.com>
Date: Sat, 26 Jan 2008 07:16:28 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: custom character set - with external mode

Adam -

I wrote:
> My suggestion was to use an entire new external mode that would generate
> only the passwords that match your criteria - on its own.

Here it is:

# Length 10, charset [tjesTJES] (8 characters)
[List.External:tjes10]
int running;		// Are we already running?
int last;		// Last character position, zero-based
int c0, c[0x100];	// Cyclic charset

void init()
{
	int length, cm, i;

	length = 10;

	c[c0 = 't'] = 'j';
	c['j'] = 'e';
	c['e'] = 's';
	c['s'] = 'T';
	c['T'] = 'J';
	c['J'] = 'E';
	c['E'] = 'S';
	c[cm = 'S'] = c0;

	running = 0;
	last = length - 1;
	i = 0; while (i < length) word[i++] = cm;
	word[i] = 0;
}

void generate()
{
	int i;

	i = last;
	while ((word[i] = c[word[i]]) == c0)
		if (!i--) {
			if (running++) word = 0;
			return;
		}
}

Some notes:

1. Being an external mode, this is not the fastest way to generate
candidate passwords, although its performance is acceptable.  Some
further optimizations are possible (e.g., cache the last character
outside of the word[] array).  Also, be careful when you edit it (such
as for a different charset) - errors in the way the cyclic charset is
defined may result in the "while" loop in generate() becoming endless.

2. In order to actually crack an NTLM hash with this, you need a build
of JtR with support for NTLM hashes.  You may do a custom build with the
latest jumbo patch (john-1.7.2-all-9.diff.gz), which means that you'll
need to install Cygwin on your Windows system, or you can download such
a build made by someone else (one is linked from the JtR homepage - it's
for an older version of the patch, though, so it's many times slower at
NTLM hashes).

3. On a modern system, with a recent jumbo patch, and with the proper
"make" target for your system, this should complete its work against an
NTLM hash (or against many such hashes) in just a few minutes.

-- 
Alexander Peslyak <solar at openwall.com>
GPG key ID: 5B341F15  fp: B3FB 63F4 D7A3 BCCC 6F6E  FC55 A2FC 027C 5B34 1F15
http://www.openwall.com - bringing security into open computing environments

Was I helpful?  Please give your feedback here: http://rate.affero.net/solar

-- 
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.