John the ripper - ecryptfs - sample not cracked: 0 password hashes cracked

Question

I tried to use john the ripper on the sample : ecryptfs_sample_metadata.tar (password is 'openwall')

Which I downloaded from here: https://openwall.info/wiki/john/sample-non-hashes

If i try

sudo john ecryptfs_sample_metadata.tar --progress-every=10 --mask='openwal?l'

The result is:

Warning: detected hash type "mysql", but the string is also recognized as "oracle"
Use the "--format=oracle" option to force loading these as that type instead
Warning: detected hash type "mysql", but the string is also recognized as "pix-md5"
Use the "--format=pix-md5" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (mysql, MySQL pre-4.1 [32/64])
Warning: no OpenMP support for this hash type, consider --fork=4
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:00  0g/s 185.7p/s 185.7c/s 185.7C/s openwala..openwalq
Session completed

If I try show I have the result:

0 password hashes cracked, 1 left

I try to ad

--format=oracle 

or

--format=pix-md5 

with the same result.

Does anyone have an idea why the password is not cracked?

Answer 1

The tar file needs to be extracted first. It contains an .ecryptfs directory as it would typically be found in an encrypted home folder. The relevant file here is the wrapped-passphrase file. It contains the "real" 32-character password that ecryptfs used for the encryption, and is itself encrypted with the user password.

To use john on this file, you first need to create a passwd-like file from it that john can understand. For this use the command ecryptfs2john wrapped-passphrase > passwd. The ecryptfs2john command is contained in the John the Ripper jumbo package. The command creates a passwd file that looks like this:

wrapped-passphrase:$ecryptfs$0$92dc3db8feaf1676

Now you can use john on the passwd file:

$ john passwd --progress-every=10 --mask='openwal?l'`
Using default input encoding: UTF-8
Loaded 1 password hash (eCryptfs [SHA512 128/128 AVX 2x])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
openwall         (wrapped-passphrase)
1g 0:00:00:00  4.347g/s 113.0p/s 113.0c/s 113.0C/s openwala..openwalq
Use the "--show" option to display all of the cracked passwords reliably
Session completed

As you can see, john recognized the hash as an ecryptfs hash. In some previous attempts, it was not doing that but was rather showing something about different hash types being detected. Unfortunately, I cannot reproduce this now, so I don't know what exactly was causing it. I had the impression that I was either using a version of john that didn't include ecryptfs support, or that it only worked when I was running john from the directory where the wrapped-passphrase file existed, but with both scenarios I cannot reproduce the problem anymore.