3

I have uploaded a screenshot of what exactly is going on, here: https://i.stack.imgur.com/lejbd.png

I can see that single-crack mode includes a rule that looks at the username, and "slices" it to identify the password. I concluded this based on the fact that I have ACC_ff77 and ACC_fInAlfAntAsy77 setup with the same password (the password being fInAlfAntAsy77), and single-crack mode does not solve ACC_ff77, but it DOES solve ACC_fInAlfAntAsy77.

I doublechecked this with ACC_123passw0rd123, which the screenshot shows being solved instantly. I also changed the username to not include the password, and it too was not solved in single-crack mode.

That's all well and good, but this brings me to my question: Why is ACC_^.^S#kvV not being solved? The password is ^.^S#kvV so the same ruleset in single-crack mode that is solving the other two usernames should solve this one. I looked through the rulesets, but I admit I did not understand them all. I could not figure out which rule specifically was the one identifying the passwords.

To prove my due diligence, I added my own rule to the single crack mode: x[0-9]l

This rule successfully identifies the password from ACC_^.^S#kvV, as well as the other two accounts. However, I am still very curious why whatever rule is identifying the other two accounts is failing on ACC_^.^S#kvV

Improve this question

2 Answers 2

Reset to default
1

Good question

the default rule : will split the "username" on the following characters for guessing purposes. I put "username" in quotes because it seems to be treating everything before the ":" as possible GECOS fields that could be delimited by any of the characters.

".", "_", "-", "|", " ","#",";","^",","

(and probably others)

so ACC_^.^S#kvV will be split into the guesses ("ACC","S","kvV") and never try ^.^S#kvV

As proof try APC_Skater.skater778818:skater778818 and the : will solve it.

your rule x[0-9]l is a variation of xNM (extract substring from position N for up to M characters) and in this case go from position x to the end of the string (l). So this rule does no splitting, but just tries successive substrings.

Improve this answer
2
  • This makes perfect sense. Before I accept though, could you point me to where you found how its splitting the username? Ive read through the openwall docs and john.conf but didn't see this mentioned.
    – CorruptedBox
    Dec 24, 2014 at 23:02
  • I found it through trial and error. I got curious because the results you got didn't make sense. I was sure that one of the more complicated looking rules must be responsible but I removed all of them except the : rule and it still did the splitting. And then this sentence finally made sense: "It will use the login names, "GECOS" / "Full Name" fields, and users' home directory names as candidate passwords" (openwall.com/john/doc/MODES.shtml)
    – mcgyver5
    Dec 25, 2014 at 4:49
0

It might be the . and # confusing whatever regex John is using to parse the usernames. The first two only have letters and numbers, while the third one has other symbols.

You should report this to the John project, their mailing list is john-users-subscribe at lists.openwall.com

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .