[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20100227162220.GA17594@openwall.com>
Date: Sat, 27 Feb 2010 19:22:20 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Trivial bug (or dangerous feature)
On Mon, Feb 22, 2010 at 03:36:30PM +0100, Magnum, P.I. wrote:
> I just got bitten by a bug, or feature, in JtR. Having lots of sessions
> that I start/stop during testing, I decided to start using session names
> equal to the filename to crack. That is,
>
> $ john --session=test.sam -single --pot=test.sam.pot test.sam
>
> What happened was it loaded the contents of test.sam into memory, then
> it created a recovery file NOT named test.sam.rec as I expected, but
> just test.sam - overwriting the hash file. It then cracked the hashes
> and deleted the file (well it was already destroyed anyway). It just
> made me chuckle this time but I think it could be a really bad thing for
> someone, some day :-)
I've addressed this in JtR 1.7.5. Except when built with DJGPP (for DOS),
it will now always append .rec and .log to the specified session name.
This behavior should be more intuitive. Unfortunately, it will fail on
filesystems that have a notion of filename extensions and support only
on extension per filename. This is why I had to make an exception for
DJGPP/DOS builds, but this exception won't cover all cases - e.g., one
may run a Linux build of JtR in a directory on a FAT filesystem (say, to
share it with Windows installed on the same computer). Then JtR 1.7.5
might misbehave (the .rec and .log files might turn out to be the same
file as far as the filesystem is concerned). I guess that's life.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
