3

I have a salted MD5 hash and I also know the password. How can I recover the salt using tools like John The Ripper (I have JTR jumbo installed)?

  • 1
    Do you have any knowledge about how the salt was generated, e.g. if it is limited to a certain space or if it could be any value between 0 and 2^128? – Anders Jul 12 '16 at 12:45
  • @Anders no, actually, but I'm pretty sure it can be cracked – nikrom3000 Jul 12 '16 at 12:48
  • 2
    Not 100% sure on this, but if you need to brute force this you have 2^128 salts to try. That is impossible, even if you have a super computer and a couple of millenia of time. – Anders Jul 12 '16 at 13:07
  • 5
    This depends on the salt. If you do a md5(pw + salt) and you know the pw, then it is basically a bruteforce for the salt. Usually this is the other way round, and the salt is known and someone wants to bruteforce the pw - but this makes no difference. Feasibility only depends on how much entropy the "secret" has. If the Salt is 4 digits, then this is very easy. If is 2000 alphanumerical and special characters, then it is pretty much impossible. Reality will probably lie somewhere inbetween. – Flo Jul 12 '16 at 13:52
5

With known plaintext, and assuming salting that uses simple string concatenation, some password-cracking suites like hashcat or MDXfind will let you bruteforce the salt. This will only be practical for simple salts (short enough to bruteforce, or if the character set of the salt is known well enough to keep the keyspace small).

For hashcat, the (perhaps non-intuitive) trick is to pretend that the salt is the password, and the password is the salt. This works when the salting is performed as a simple concatenation.

In this example, the known plaintext password is "password" and the unknown salt is "GR7". We'll be using hashcat's algorithm mode 20 (md5($salt.$pass)).

Here's the salted hash:

$ echo -n 'passwordGR7' | md5sum
a598e9df477f07dadee6b6bee9ac1daa  -

... and here's the target hash and "salt" (in the expected hash:salt format), but the "salt" is actually our known plaintext password:

$ cat hash.list
a598e9df477f07dadee6b6bee9ac1daa:password

We then use a '?a?a?a' mask (all three-character printable strings) as potential "passwords" (really the salt):

$ hashcat --quiet -m 20 -a 3 hash.list ?a?a?a
a598e9df477f07dadee6b6bee9ac1daa:password:GR7

To handle salts of different lengths or formats, simply adjust the mask or attack type. If the length of the salt isn't known, use --increment to try all lengths up to the length of the supplied mask.

If the salt is prepended instead of appended, hashcat mode 10 (md5($pass.salt)) can be used instead (again, remembering that the "pass" in this context is actually the salt, using the same method as above).

I haven't explicitly done this with John the Ripper, but since John supports md5($p.$s) and md5($s.$p) using dynamic formats, I believe that the same technique can be used with John. But these dynamic formats are only on CPU at this writing, so if you have GPUs available, I'd recommend taking a look at hashcat instead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.