[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ed8f84a9-9405-461c-82d5-ea6bb2e30aa2@jeffunit.com>
Date: Sun, 15 Sep 2024 18:23:40 -0700
From: jeff <jeff@...funit.com>
To: john-users@...ts.openwall.com
Subject: Re: rule for password with control characters
I used these rules to either insert or substitute a control character
into a wordlist when I was
cracking descrypt hashes.
Now I am cracking NTLM hashes, and there is no limit on the length of a
potential password.
I was wondering if there was a way to modify the insertion and
substitution rules to not be limited to 8 chars.
I am currently using the rules at the bottom of this email.
Any advice would be appreciated.
jeff
On 5/16/2023 04:50, Solar Designer wrote:
> On Mon, May 15, 2023 at 08:19:31PM -0700, jeff wrote:
>> I have a password that I can't crack. I know it is no more than 8
>> characters, and I have tried all printable characters.
>> I would like to include control characters.
>> I made a rule for this, but it isn't working.
>> Here is the rule:
>>
>> [List.Rules:ins_control_1]
>> # jtd truncate to 7, insert at pos x with control
>> '7i0[^$][\x7f\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f]
>>
>> I want to truncate my wordlist to 7 characters and insert a control
>> character.
>> I would like to include x7f and x01..x1f
> Your rule line above is wrong. You can try these instead:
>
> [List.Rules:ins_control_1]
> '7 i[0-7][\x7f\x01-\x1f]
>
> [List.Rules:rep_control_1]
> '8 o[0-7][\x7f\x01-\x1f]
>
> or better yet, optimized versions that produce fewer duplicates (skip
> trying to insert or overstrike way beyond input word length):
>
> [List.Rules:ins_control_1]
>> \r[00-6] '7 i\p[0-7][\x7f\x01-\x1f]
> [List.Rules:rep_control_1]
>> [0-7] '8 o\0[\x7f\x01-\x1f]
> Since you're cracking descrypt hashes, you may also want to include
> \x80, which gets processed by descrypt as NUL:
>
> [List.Rules:ins_control_1]
>> \r[00-6] '7 i\p[0-7][\x7f\x80\x01-\x1f]
> [List.Rules:rep_control_1]
>> [0-7] '8 o\0[\x7f\x80\x01-\x1f]
> You don't strictly need those truncations at '7 or '8 when running
> against descrypt - the resulting string will be truncated anyway.
>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
