http://blog.gmane.org/gmane.comp.security.openwall.john.user hourly 1 1901-01-01T00:00+00:00 http://gmane.org/img/gmane-25t.png http://gmane.org http://comments.gmane.org/gmane.comp.security.openwall.john.user/1758 Hello all, We would like to find out the password encryption/mangling routine for a legacy Windows app for which we would like to port the users to Linux. The application is VopMail (a mail server, now abandonware). We want to migrate all user accounts/passwords to Linux Postfix/Courier. We're a small ISP and these are all our customers for which we also keep FTP passwords etc. We could use a proxy and sniff POP3/IMAP sessions. Alternatively, we could inform all users that they have a new password which is less customer-friendly I believe. Ideal solution would be to find out the encryption or mangling routine. Below I have included a sample of some records I created where VopMail has created the Password1 and Password2 fields. It seems quite weak to me and there are clear patterns in the Password1/Password2 fields. Similar plaintexts generate similar encrypted passwords. However, this is how far I got :-) I am not asking for the final solution, just some pointers into the right direction so John 2008-06-30T11:01:50 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1757 Hello everyone, finally, here's a patch for auditing SAP-passwords. There's one module for the old (BCODE or CODVN B) and one for the new (PASSCODE or CODVN G) SAP passwords which can be obtained from the table USR02 or USH02. This patch was tested on linux/x86 only and we're quite sure it won't work on any other architecture w/o modifications. Sorry for that ;-) But: feel free to adjust/port/modify the code! Hints about adjustments to be made are welcome :-) There's an issue with cases, too. Maybe Solar Designer can give a hint here... BTW: SD, if there was more documentation for the plugins, the quality would be far better... SAP password hashes are salted only with the username (the system-ID is NOT involved!). So a special preparation of the username-password-table is nesessary (see attached .pl-script). SAP allows special characters in usernames (e.g. * $ <spaces> etc.). Whitespaces at the end of the username will be stripped. Due to the fact that the salt (remember: the username) varies in legth, we sap friend 2008-06-25T23:48:50 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1750 I recently set up a user account on my Mac OS X 10.5.3 Leopard machine with a password of "apple" and the corresponding has in a file in /var/db/shadow/hash is: 00000000000000000000000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000000000000000000000000000000000 0000000001295B67659E95F32931CEDB3BA50289E2826AF3D5A1422F000000000000000000000000 00000000000000000000000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000 55 89 e5 2008-06-24T03:57:56 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1749 Bonjour, Je voudrais cracker ma clé wpa avec aicrack-ng 0.9 et john 1.7.2. J'utilise Backtrack 2, le fichier de capture est ok. J'utilise cette ligne de commande: john -incremental:alpha --stdout | aircrack-ng -a 2 -b XX:XX:XX:XX:XX:XX -w - /mnt/cle/temp/*.cap Mais il ne trouve pas ma clé car elle a 26 caractères comprenant des 0123456789ABCDEF J'aimerai donc faire une régle d'incrémentation avec min lenght= 26 max lenght= 26 avec en utilisant juste 0123456789ABCDEF comme caractères... Si quelqu'un peut m'aider... Merci --------------------- Hello, I want to crack my wpa key with aircrack-ng 0.9. I made my capture, i use john 1.7.2 in Backtrack 2 john -incremental:alpha --stdout | aircrack-ng -a 2 -b XX:XX:XX:XX:XX:XX -w - /mnt/cle/temp/*.cap My key have exactly 26 chars only with 0123456789ABCDEF I want to make a incremental...but i don't understand how to do... Please help me thank you... Sorry for my bad english, i'm french I saw the FAQ, Subject: Re: Incremental mode limited to 8 character words? Radikal No Copyright 2008-06-23T11:52:34 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1747 Hi, Mac OS X 10.5+ (Leopard) and Xcode 3.0+ support 64-bit applications not only on PowerPC, but also on Intel (x86) CPUs - and I've just added the support into JtR as well. If you want to try this out and/or help test and benchmark it, please download the latest revisions of Makefile and x86-64.S (as of this writing) from here: http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/john/john/src/ These work as drop-in replacements for the files in JtR 1.7.2. The new make target is "macosx-x86-64". On my MacBook (Core 2 Duo 2.0 GHz), this achieves the expected speedup for DES-based crypt(3) hashes (+11%) and for MD5-based crypt(3) hashes (+47%), does not significantly affect performance of LM and Kerberos AFS hashes, but slows Blowfish-based crypt(3) hashes down (-17%). All of this was in comparison to the older 32-bit "macosx-x86-sse2" target. While at it, I've also converted the code in x86-64.S to use instruction pointer relative addressing - this was required for Mac OS X, but I applied the chan Solar Designer 2008-06-21T16:00:42 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1744 Hi, RB has contributed this wiki page on existing efforts to introduce parallel processing and distributed processing into JtR: http://openwall.info/wiki/john/parallelization and I've just added links to the above page from: http://openwall.info/wiki/john http://openwall.info/wiki/john/patches RB - Thank You! A possible improvement could be to mention trivial/manual approaches as well - as many of you know, I've been advocating those for simple cases (say, for up to 4 CPUs/cores) until we have official parallelization support in JtR. Maybe there should be a "parallelization" DokuWiki namespace (in addition to the wiki page), such that relevant patches would be uploaded to under that namespace and such that we could have a sub-page on the manual approaches. Please keep these contributions coming. Thanks again, Alexander Solar Designer 2008-06-20T20:33:30 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1743 diff -urpN john-1.7.2-orig/src/john.c john-1.7.2/src/john.c --- john-1.7.2-orig/src/john.c2006-05-08 14:48:48.000000000 +0000 +++ john-1.7.2/src/john.c2008-06-19 12:01:26.000000000 +0000 < at >< at > -36,7 +36,7 < at >< at > extern int CPU_detect(void); #endif -extern struct fmt_main fmt_DES, fmt_BSDI, fmt_MD5, fmt_BF; +extern struct fmt_main fmt_DES, fmt_BSDI, fmt_MD5, fmt_BF, fmt_NS; extern struct fmt_main fmt_AFS, fmt_LM; extern int unshadow(int argc, char **argv); < at >< at > -64,6 +64,7 < at >< at > static void john_register_all(void) john_register_one(&fmt_BF); john_register_one(&fmt_AFS); john_register_one(&fmt_LM); +john_register_one(&fmt_NS); if (!fmt_list) { fprintf(stderr, "Unknown ciphertext format name requested\n"); diff -urpN john-1.7.2-orig/src/Makefile john-1.7.2/src/Makefile --- john-1.7.2-orig/src/Makefile2006-05-15 16:38:00.000000000 +0000 +++ john-1.7.2/src/Makefile2008-06-20 10:31:12.000000000 +0000 < at >< at > -17,7 +17,7 < at >< at > NULL = /dev/null CPPFLAGS = -E CFLAGS = -c -Wall -O2 -fomit-frame-pointer ASFLAG Samuel Moñux 2008-06-20T10:59:34 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1740 Hi, on my way to get John working with BOINC i have to do some tests. So i need some passwords. actually i get them by using pwgen an mkpasswd this way: pwgen -A -0 $PWLENGTH 1 | mkpasswd -H MD5 -s >> mypassword The problem with mkpasswd is, i can only generate md5 and des. But i want to have more algorithms to test on. Can somebody show me a tool who does this with more algorithms and still works with john? I have tested mcrypt, but didnt get it work with john. best regards Markus Friedel Markus Friedel 2008-06-18T13:27:00 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1739 I have been running a bunch of UNIX DES hashes and have one cracked: [rful011< at >bojan-desktop .jtr]$ john --show unix.pass root::14007::56:::: I don't think the password is null (there is a hash for it) or is there a distinction between no password and a null one (which makes sense)? No I can't just test it since the box is behind a firewall which I don't have (immediate) access through. It was cracked at the start of the incremental run so it is clearly something short ? Russell Russell Fulton 2008-06-17T21:00:01 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1735 I need some clarification about this. The CONFIG file says: <quote> This file is searched for in private John's "home directory" and, if not found in the private directory and John is installed system-wide, also in John's system-wide shared data files directory. </quote> but I find this confusing. I have found that john will find config files in the current directory. I have tried setting the environment variable JOHN but this does not seem to have any effect. I have also looked in the INSTALL instructions but failed to find any reference to "home". Enlightenment welcome. On a side issue I am about to get my grubby mitts on an "IronKey Enterprise" encrypted flash drive and intend to install john on the secured portion of the drive and keep the password files and pot etc. on the normal file section. That way I should have all the sensitive stuff in one very secure place. https://www.ironkey.com/ If anyone is interested in how this goes drop me a note Russell Russell Fulton 2008-06-16T00:32:55 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1728 Hello! I had some time, so i took a look at the john's raw-md5 module and made some improvements. I sent it to my friends to test it, and makes some reports. It was everywhere faster than the old one. I hope so, it hasnt any bugs, i didnt found anyone of it, so please try it. (the patch is only for the pure 1.7.2, if you use anything else in that, you might have to patch the patch :) ) URL: http://www.rycon.hu/tools/john-1.7.2_rawMD5_fast.patch My results: --test: new module: Benchmarking: Raw MD5 [raw-md5]... DONE Raw: 4408K c/s real, 4408K c/s virtual old module: Benchmarking: Raw MD5 [raw-md5]... DONE Raw: 3771K c/s real, 3801K c/s virtual 1hash: the same as the test. 1000hash: new module: guesses: 382 time: 0:00:00:34 79% (1) c/s: 98645K trying: ... old module: guesses: 382 time: 0:00:01:09 83% (1) c/s: 52946K trying: ... at 200.000hash the c/s is ~half of this result. Balázs Bucsay http://rycon.hu/ Bucsay Balázs 2008-06-12T17:41:27 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1718 Has anyone ever used JTR for FileVault? I've not had any luck finding any info on it. Matt Durden 2008-06-02T18:42:27 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1713 Hello Are there any attempts to use GPU computing for John the Ripper? There are some examples, which get 70 millions per second of raw MD5 calculations on Geforce 8800 GS (cuda md5 project) and 34 millions per second of raw SHA1 (without downloading and uploading data to graphic card) I'm doing some experiments, but only get 25 million/sec for raw MD5 and 7 million/sec for raw SHA1. There was some problems with bench.c and incremental cracker. Benchmark can't get a full speed, which measured by real hash cracking after a some time. How does john calculate a speed of hash generation? I've noticed some inertness - speed is slowly growing with time. How fast is incremental cracker? What a maximum rate of password generation can it get? For CUDA I use a big sets of password (from tens of hundreds to several millions) to transfer to GPU for processing. I think, that bottleneck for now is incremental cracker or my _set_key() function. Transferring data to GPU also can be a bottleneck. Thanks you for JtR Alex V. Breger 2008-06-01T20:32:45 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1700 Hi, i am searching for a way to change johns default directory location. The current location is "$HOME/.john/" . Because i run john without an installation it should be possible for me to can change this location to the current folder from which i start john. Thank you in advance best regards Markus Friedel Markus Friedel 2008-05-27T20:33:52 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1699 Hi, Simple question. I have a password file, and I want to run JtR on it. My needs are simple. I want to search through: A-Z a-z 0-9 !< at >#$%^&*()-=_+[]\;',./{}|:"<>? basically all the printed characters. The password lengths are up to 15 chars. What's the most efficient (cpu/running time) way to do this? bofh 2008-05-27T13:54:28 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1697 Dear john-users, I am in a bit of a fix. I have partially forgotten the password to a server of mine. I know, that the password has the form of xxxyyyxxx, where I know the x-es for sure, but have forgotten the ys, I know, though, that the ys are all numbers. I have fiddled out how to configure john pre-compile to accept '9' as maxcount, but from there on, I am lost. How would I formulate a request to john to incrementally crack the password of the specific form, which should not be too difficult, as the complexity is very reduced? Thank you very much for your help Polygraf Belkin 2008-05-20T19:05:45 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1693 Hi, I've attached a small patch to fix an issue within the NetLM and NetNTLM loader.c code. If someone can work this into the Jumbo patch the next time it gets rebuilt, that'd be great. Without it, I'm seeing john segfault on our 64-bit machine. For some reason, 32-bit works just fine either way. Thanks, Joe jmk 2008-05-09T15:51:51 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1691 Hi, We've just setup the Openwall Community Wiki at: http://openwall.info/wiki/ and there's a DokuWiki "namespace" for John the Ripper user community resources: http://openwall.info/wiki/john It may contain pages on and links to things such as tutorials for new users, advanced usage examples beyond those included in the official documentation, patches (as well as instructions on how to extract tarballs and apply patches, and how to make patches), and benchmarks. I have already created two informative wiki pages (on dealing with patches), and provided broken links for some pages to be created. If you have something relevant to share, please register for an account and edit away! Thanks, Alexander Solar Designer 2008-05-02T01:20:13 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1690 Hi List, I try to break some passwords with a special format. I know that most of the password consist of 3 or 4 parts. Every part is a word from a wordlist. Sometimes with capital letters at the begin. e.g. VeryRedpassword or redHouseWaterCar I know that the amount of possible word combinations is very huge. For this reason and the upper and lowercases on word borders the manual concatenation of the word list for instance with perl is NOT my favorite. I tried to use the john "single crack" rules for this purpose e.g. 1l2l But this option is not allowed for the wordlist mode. Also this option supports only concatenation of two words. (1l2l3l is not allowed) Does anyone has an idea who the problem can be handled? Regards, Uwe. Uwe Danz 2008-04-28T07:32:11 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1684 I've built john 1.7.2 /w patches from JoMo-Kun on two different amd64 boxes. Both are running Ubuntu 8.04, one is a core 2 duo, the second is a dual quad core (grin!!). I used the make target of linux-x86-64. Unfortunately when I try to run the following, I get a segmentation fault. john -format:netlm -config:/tmp/john.conf.9143 -external:HalfLM -incremental:LM -session:/tmp/john.session.9143 /tmp/john.passwd.9143 I have built a debug version and loaded it up into gdb and here is the backtrace output. (gdb) backtrace #0 0x00007fca3ecf8d9d in ?? () from /lib/libc.so.6 #1 0x00007fca3ecfcc1c in free () from /lib/libc.so.6 #2 0x00007fca3ece7dac in fclose () from /lib/libc.so.6 #3 0x000000000042b8de in read_file (db=0x6651c0, name=0x694488 "/tmp/john.passwd.9143", flags=2, process_line=0x42c800 <ldr_load_pw_line>) at loader.c:66 #4 0x000000000042b0b3 in main (argc=7, argv=<value optimized out>) at john.c:221 I have stepped through the code manually and it looks like everything is valid (fi Bismark 2008-04-25T15:48:44 http://comments.gmane.org/gmane.comp.security.openwall.john.user/1683 Hello, I noticed that john slows down a lot when working with unsalted large password files. It spends all its time at first in the functions that are called when a password is found: Each sample counts as 0.01 seconds. % cumulative self self total time seconds seconds calls s/call s/call name 53.99 35.69 35.69 1120 0.03 0.03 ldr_update_salt 26.55 53.24 17.55 1119 0.02 0.05 crk_process_guess 12.63 61.59 8.35 884044 0.00 0.00 ldr_load_pw_line 4.18 64.35 2.76 817642756 0.00 0.00 binary_hash3 This really isn't cool. I already increased the size of the values returned by binary_hash and stuff like that. However, it would be really useful to be able to speed up the ldr_update_salt function. Has anybody a suggestion on how to do this in a clean way? PS: I couldn't give it much thought, but i guess that replacing ldr_update_salt by a piece of code in crk_process_guess that removes t Simon Marechal 2008-04-25T12:22:14 Search the mailing list at Gmane query http://search.gmane.org/?group=$group=gmane.comp.security.openwall.john.user