[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CA+E3k90sxSfxpQH=9h8bqcwVA=ux-9DgAqJ5eLe1c4cOp_Z8WA@mail.gmail.com>
Date: Wed, 2 Jul 2014 07:02:02 -0800
From: Royce Williams <royce@...ho.org>
To: john-users@...ts.openwall.com
Subject: Re: ssh known_hosts support?
On Wed, Jul 2, 2014 at 1:05 AM, Dhiru Kholia <dhiru.kholia@...il.com> wrote:
> On Mon, 23 Jun 2014, Royce Williams wrote:
>
>> The 'HashKnownHosts' ssh config option enables hashing of IPs and
>> hostnames in the ~/.known_hosts file. ...
>>
>> What would be the best path to using john for this purpose?
>
> Hi,
>
> The latest "bleeding-jumbo" version (from the following repository) now
> supports cracking such hashes.
>
> https://github.com/magnumripper/JohnTheRipper
>
> $ cat hashes
> $known_hosts$|1|pgjIzNM77FYsBHLfKvvG9aWpKAA=|XbHqTCXG1JAV6fb2h2HT8MT7kGU=
> $known_hosts$|1|vAQX51f9EfXY33/j3upxFIlI1ds=|q+CzSLaa1EaSsAQzP/XRM/gaFQ4=
>
> $ ../run/john hashes --mask="192.30.252.?d?d?d"
> Loaded 2 password hashes with 2 different salts (known_hosts, ...)
> ....
> 192.30.252.128 (?)
> 192.30.252.130 (?)
>
> $ ../run/john --format=known_hosts --test # i7-4750HQ CPU
> Benchmarking: known_hosts, HashKnownHosts HMAC-SHA1 [SHA1 32/64]... DONE
> Raw: 1836K c/s real, 1836K c/s virtual
>
> Later on, we might be able to use an existing format (or the dynamic
> format) for cracking such hashes.
Dhiru -
Most excellent - works like a charm!
A couple of notes for future researchers doing similar work.
For IP address wordlists, it may be convenient to use nmap's 'list'
option to generate IP addresses from multiple or large CIDR blocks, as
in:
nmap -sL -Pn -n 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8 >ips.list
For hostnames, the list of potential strings is obviously very
site-specific. Harvesting strings from existing documents, hosts
files, DNS, shell history, server logs, etc. is low-hanging fruit.
Also note that fully-qualified hostnames (such as blah.example.net) as
well as bare hostnames (such as blah) are separately managed in the
known_hosts file, so any wordlist or incremental work should take both
variants into account.
Thanks again!
Royce
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
