[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130129024114.ZJO86.67893.imail@eastrmwml107>
Date: Mon, 28 Jan 2013 21:41:14 -0500
From: <jfoug@....net>
To: john-users@...ts.openwall.com
Cc: Solar Designer <solar@...nwall.com>
Subject: Re: can't get jtr to ID this
I have tested this, with the most current version of wpapsk. I did that version (CPU), giving it SIMD.
It cracks this just fine.
I have also been working on a wpapcap2john which properly converts straight from pcap files, into jtr input. It converts the .cap file into an identical JtR input as the file you provided. My code is not quite release ready, but it does avoid the SERIOUS bug(s) in aircrack-ng which will build invalid hashes in many situations (appears to grab non-matching parts of different 4way's). There are several bug reports about this for aircrack-ng. I simply wrote code myself. It was pretty obvious that aircrack was picking wrong parts, once I researched enough to figure out what was needed. Here are a couple of bug reports that sort of point to the bug I have seen: http://trac.aircrack-ng.org/ticket/721 http://trac.aircrack-ng.org/ticket/651 My code likely does not handle 'all' valid partial 4-ways. I handle properly matched msg1/msg2 and properly matched msg2/msg3
---- Solar Designer <solar@...nwall.com> wrote:
> On Mon, Jan 28, 2013 at 06:58:06PM -0500, tanoury wrote:
> > Here's the hccap (greasedjtr.hccap) converted to john format:
> > http://home.comcast.net/~A_Tanoury/greasedjtr.hccap
> >
> > Here's the password:
> > http://home.comcast.net/~A_Tanoury/password.txt
>
> 63 chars? Is this a stress-test for the tools? Thank you for it!
> Dhiru - please get these sample files onto our wiki. :-)
>
> > I'm using john-1.7.9-jumbo-7-Linux-x86-64 and it has worked fine. Here's
> > my command line that has worked fine with other WPA passwords:
> > ./john --wordlist=password.txt -fo=wpapsk greasedjtr.hccap
>
> It works for your password here, with all of: wpapsk, wpapsk-opencl, and
> wpapsk-cuda. I tested with bleeding-jumbo. Maybe there was some issue
> we've fixed since 1.7.9-jumbo-7.
>
> ... I've just tested unstable-jumbo as well. wpapsk and wpapsk-cuda
> resulted in:
>
> Loaded 1 password hash (WPA-PSK PBKDF2-HMAC-SHA-1 [32/64])
> *** buffer overflow detected ***: ./john terminated
> ======= Backtrace: =========
> /lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x37)[0x7f9e023a1007]
> [...]
>
> (similar in both cases). However, wpapsk-opencl cracked the password
> just fine.
>
> Maybe there's some bug we happened to fix between unstable-jumbo and
> bleeding-jumbo, or maybe it's just somehow hidden in the latter. Either
> way, we need to fix it in unstable-jumbo as well, because that's likely
> what we'll base the next -jumbo release on. (bleeding-jumbo is about
> preparations for an even later release.)
>
> magnum - can you take a look, please?
>
> tanoury - you could want to subscribe to the john-users mailing list
> rather than post via Gmane. All postings via Gmane are delayed for
> manual approval.
>
> Thanks again,
>
> Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
