[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <C023E3BD-9532-4AFE-AD7C-E0A3FABF4080@llnl.gov>
Date: Fri, 23 Sep 2011 07:35:35 -0700
From: "Link, Peter R." <link1@...l.gov>
To: "john-users@...ts.openwall.com" <john-users@...ts.openwall.com>
Subject: Re: Mac OS X 10.7 Lion password hashes (salted SHA-512)
Alexander,
I used your Perl script this morning on my original test user plist and it worked fine. I then changed the password of the user to something simple to make sure john could fine it. When running the script again, it came up with the error message, "Could not find a Mac OS X 10.7 Lion salted SHA-512 hash." I only changed the password to <tomorrow> from <Ydo!Ucar3>. I ran this on two different computers and it does the same thing. I'm attaching both plists for your review.
robert1new.plist is the one that doesn't work.
On Sep 22, 2011, at 8:33 PM, Solar Designer wrote:
Rich, Jean-Michel, all -
Here's a trivial Perl script I just hacked together to process Lion's
plist files (such as /var/db/dslocal/nodes/Default/users/username.plist)
and print the hashes in a format directly usable by John 1.7.8-jumbo-7.
Usage:
./lion2john.pl < username.plist > username.hash
or for many files:
for f in *.plist; do ./lion2john.pl < $f; done > hashes
---
#!/usr/bin/perl
read(STDIN, $_, 1000000) || die;
($hash) = /bplist00\xd1\x01\x02\x5dSALTED-SHA512\x4f\x10\x44(.{68})/;
if (!$hash) {
print "Could not find a Mac OS X 10.7 Lion salted SHA-512 hash\n";
exit 1;
}
print unpack('H*', $hash), "\n";
---
Please test this on more plist files and report back.
Thanks,
Alexander
Peter Link
Cyber Security Analyst
Cyber Security Program
Lawrence Livermore National Laboratory
PO Box 808, L-315
Livermore, CA 94550
link1@...l.gov<mailto:link1@...l.gov>
The contents of this message are mine personally and do not reflect the views or position of the U.S. Department of Energy, Federal Government, National Nuclear Security Administration, Lawrence Livermore National Security, or Lawrence Livermore National Laboratory.
Content of type "text/html" skipped
Download attachment "robert1.plist" of type "application/octet-stream" (25830 bytes)
Download attachment "robert1new.plist" of type "application/octet-stream" (25830 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
