cracking MD5 with salt using JTR

Question

In a legal, learning context at school, we have to understand security in Linux in the /ect/shadow file and the anaconda-ks.cfg.

These two files contains often different kind of hash and the password of often hashed as:

$encryption$salt$hash.

In my exemple, I have something like $1$8CharsSalt$22CharsHash

I understand it's a MD5 hash using the the 8 chars salt and using a base 64 encoded hash.

I have two questions about these lines.

My first one: Is the salt in clear format (in /etc/shadow in Linux). I am pretty sure that the answer is yes, but I just want to confirm.

My second one: using a password cracker tool like John the Ripper, I paste the line above (the real hashes) and it detected It was FreeBSD MD5 [32/64]. I see what John is trying, but, is he using the 8 chars salt of the pasted line?

Answer 1

1. Yes, it's just a base64 encode of the salt.
2. Yes, all UNIX/UNIX-based systems have some standardisation of their user databases and functions. FreeBSD was the first variant to use MD5 and encode is in the UNIX scheme of $algo$salt$hash base64 encoding the salt and the hash parts. Linux uses it in an identical way if md5 is being used (unlikely on new Linux systems).