[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20080702023015.GA28742@openwall.com>
Date: Wed, 2 Jul 2008 06:30:15 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Password encryption question
On Mon, Jun 30, 2008 at 01:01:50PM +0200, John wrote:
> We would like to find out the password encryption/mangling routine for a
> legacy Windows app for which we would like to port the users to Linux.
This is mostly off-topic for this mailing list. It has nothing to do
with John the Ripper, or even with its possible enhancements, because
this is password mangling rather than password hashing.
However, I've approved the posting this one time because it serves to
illustrate how some server programs actually store users' passwords in
an easily reversible form.
> # Account name, Plaintext, Password1, Password2
> a0000000001,as,aeg=,0wca0
> a0000000002,aaa,aWpq,0wca3vg==
> a0000000003,aaerially,b2pO4SFqD4+x,0wca3/mJtHm6Vig==
...
> a0000000033,abaissed,a3Fqou/oTsc=,0xMOmr0J1BUAn
These strings are a result of base64 encoding of some data, although in
Password2 ones there's an extra character prepended to the encodings.
I've tried decoding them, which produces N bytes for Password1 and N+1
bytes for Password2 (I've been omitting the leading "0" prior to the
decoding), where N matches the plaintext password length. In order to
figure out how to convert those decoded byte sequences back into the
plaintext passwords, I suggest that you use one or both of the following
approaches:
1. Use specially-crafted plaintext passwords to have the program reveal
its obfuscation method more obviously. For example, you could set
passwords of "aaaaaaaaaa", "bbbbbbbbbb", etc.
2. Reverse-engineer the program binary.
As you asked, this is not a final solution. :-)
Alexander
--
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
