3

I'm trying test password strength in one of our e-commerce sites. I'm using john the ripper to brute-force a password file. The algorithm used by PHP is:

$hash = md5($salt . $pass)

No other transformation is performed nor in the $salt or in the pass, I've manually checked one example. I've found in the documentation that the sub-format that goes with the algorithm is dynamic_4. The problem is that passwd file format as written in documentation, doesn't seems to work, John is unable to load the hashes, this is the format that I've used:

// user:$dynamic_4$hash$salt
emi:$dynamic_4$83a3f08cfb2d9d0bac5d1a1619d8b7dd$Z3MkG2FZsaoV9EDCpmSRWvgANQAeXOeN7oadrAugu0rKEvfKqoNj6D9a

I've tried to change the salt for the hash but still nothing

I've tried the following parameters combination:

john --single passwd
john --format=dynamic_4 --single passwd
john --subformat=dynamic_4 --single passwd
john --format=md5 --single passwd
john --format=raw-md5 --single passwd
4

I've looked John the ripper source code and your syntax of using John The Ripper .

  • In john the ripper dynamic hash subformats salts lenght are limited .
src/dynamic_preloads.c: 

static DYNAMIC_Setup Setups[] =
{
    { "dynamic_0: md5($p) (raw-md5)",           _Funcs_0, _Preloads_0, _ConstDefault, MGF_NO_FLAG, MGF_KEYS_INPUT },
    { "dynamic_1: md5($p.$s) (joomla)",         _Funcs_1, _Preloads_1, _ConstDefault, MGF_SALTED, MGF_NO_FLAG, -32 },
    { "dynamic_2: md5(md5($p)) (e107)",         _Funcs_2, _Preloads_2, _ConstDefault, MGF_NO_FLAG, MGF_KEYS_INPUT|MGF_SET_INP2LEN32 },
    { "dynamic_3: md5(md5(md5($p)))",           _Funcs_3, _Preloads_3, _ConstDefault, MGF_NO_FLAG, MGF_KEYS_INPUT|MGF_SET_INP2LEN32 },
    { "dynamic_4: md5($s.$p) (OSC)",            _Funcs_4, _Preloads_4, _ConstDefault, MGF_SALTED, MGF_NO_FLAG, -24  },
    { "dynamic_5: md5($s.$p.$s)",               _Funcs_5, _Preloads_5, _ConstDefault, MGF_SALTED, MGF_NO_FLAG, -12, 31, 56  },
    { "dynamic_6: md5(md5($p).$s)",             _Funcs_6, _Preloads_6, _ConstDefault, MGF_SALTED, MGF_KEYS_BASE16_IN1, -23, 55, 80 },
    ...
    ...
    ...

for example dynamic_0 is 32 byte,dynamic_4 is 24 byte,dynamic_5 is 12 byte, and ... .

You must modify the source code and recompiling JTR for supporting more than defualt value for salts .


  • dynamic_4 field is not allow in passwd file .

Simple of cracking a salted hash :

sajjad@xxx:~/Downloads/john-1.7.9-jumbo-7/run$ cat pass.txt
admin:d5fedea70cf14c3191fc8e94fe4ca8b9$Y0g7Wx78AdpjIdZd

sajjad@xxx:~/Downloads/john-1.7.9-jumbo-7/run$ ./john -form=dynamic_1 -w=password.lst pass.txt
Loaded 1 password hash (dynamic_1: md5($p.$s)  (joomla)  [128x1 (MD5_Body)])
admin            (admin)
    ...
    ...
    ...

In order to show the cracked password, use the --show option

sajjad@xxx:~/Downloads/john-1.7.9-jumbo-7/run$ ./john --show pass.txt

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.