[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20181015161913.GA2626@openwall.com>
Date: Mon, 15 Oct 2018 18:19:13 +0200
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Beat JTR to the punch! :)
Hi Eric,
I'm happy to hear you managed to recall that password. For others
reading this, it was previously discussed in these threads:
https://www.openwall.com/lists/john-users/2018/05/01/3
https://www.openwall.com/lists/john-users/2018/05/03/4
On Mon, Oct 15, 2018 at 08:21:07AM -0700, Eric Oyen wrote:
> It was 13 characters. In fact, this was the user account password on my Mac: H4mr4d!0NLZZ7
Well, this doesn't exactly match the pattern you recalled before, but
it's very close. The first mask I suggested in the May 3 posting was:
--mask='[Hh][aA4][mM]r[aA4][dD][iI!][oO0][nNzZ][7L][nNzZ][nNzZ][tT]'
It misses your password because it only tries "t" and "T" for the last
character, not "7". Adding "7" in there hits your password instantly:
$ ./john --mask='[Hh][aA4][mM]r[aA4][dD][iI!][oO0][nNzZ][7L][nNzZ][nNzZ][tT7]' --stdout | fgrep -n 'H4mr4d!0NLZZ7'
Press 'q' or Ctrl-C to abort, almost any other key for status
247493:H4mr4d!0NLZZ7
248832p 0:00:00:00 100.00% (2018-10-15 19:05) 3554Kp/s h4Mr4D!0ZLZZ7
And so does this two-step approach with the originally posted mask:
$ ./john --mask='[Hh][aA4][mM]r[aA4][dD][iI!][oO0][nNzZ][7L][nNzZ][nNzZ][tT]' --stdout > w
Press 'q' or Ctrl-C to abort, almost any other key for status
165888p 0:00:00:00 100.00% (2018-10-15 19:06) 2073Kp/s h4Mr4D!0ZLZZT
$ ./john -w=w --external=leet --stdout | fgrep -n 'H4mr4d!0NLZZ7'
Press 'q' or Ctrl-C to abort, almost any other key for status
919103:H4mr4d!0NLZZ7
919318:H4mr4d!0NLZZ7
919970:H4mr4d!0NLZZ7
920039:H4mr4d!0NLZZ7
922087:H4mr4d!0NLZZ7
922158:H4mr4d!0NLZZ7
922362:H4mr4d!0NLZZ7
922383:H4mr4d!0NLZZ7
924617:H4mr4d!0NLZZ7
924724:H4mr4d!0NLZZ7
925040:H4mr4d!0NLZZ7
925073:H4mr4d!0NLZZ7
926037:H4mr4d!0NLZZ7
926072:H4mr4d!0NLZZ7
926164:H4mr4d!0NLZZ7
926173:H4mr4d!0NLZZ7
1370112p 0:00:00:00 100.00% (2018-10-15 19:09) 1670Kp/s h@...D!0ZLZZT
This also hits your password promptly, albeit not instantly:
$ ./john -w=w --rules=oi --stdout | fgrep -n 'H4mr4d!0NLZZ7'
Press 'q' or Ctrl-C to abort, almost any other key for status
185129669:H4mr4d!0NLZZ7
185212613:H4mr4d!0NLZZ7
260223068p 0:00:00:19 0.04% (ETA: 08:24:07) 13420Kp/s haMrAdI0z7NNt
Session aborted
As you can see, some of these approaches produce duplicates. When
attacking a slow hash we'd try to avoid that e.g. by using JtR's
"unique" program, but for a fast hash this is fine.
> SO, this proves a couple of things:
> 1. I need a good password cracking machine to do this on (A Mac mini is nowhere near sufficient enough)
No, this doesn't prove that. If anything, it proves that it's very
important to focus the attacks, but not focus them too much.
> 2. I still have a good memory, even if it takes me 3 or more months to recover 1 item of data buried in the mass of near total recall that I have.
Sure.
> So, what do you guys think of the level of complexity of the given password?
As always, what level of complexity is appropriate varies by use case
and threat model, and whether/how password complexity affects cracking
depends on what information the attacker has.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
