-3

Can I decrypt this hash?

Domain Cached Credentials: MD4(MD4(($pass)).(strtolower($username)))

closed as unclear what you're asking by schroeder, Mark, Xander, Eric G, Rоry McCune Jul 10 '15 at 19:04

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • uh - it looks like an MD4 hash ... What is your question? What type is it, or how to "decrypt" the hash? – schroeder Jul 9 '15 at 2:52
  • 1
    Please note that no one can "decrypt" a hash. They are meant to be one-way only. – schroeder Jul 9 '15 at 2:53
  • Let me guess, you found that in hash-identifier? – schroeder Jul 9 '15 at 2:54
  • first i want to thank you to answer :) ,yes .. i found it in hash-identifier , and i don' t know if i can use the Hashcat to guess the hash please if you now a method which can guess this hash or if you know any information about this hash tell me please :) – Radwan Cherfy Jul 9 '15 at 13:46
  • Everything you need to know about that hash is in the code. I'm not sure what else you need to know. – schroeder Jul 9 '15 at 14:50
1

Hashes are not compression schemes. The password you are looking for is not stored in the hash, though it is theoretically possible that somebody has a dictionary that maps it to its original content.

Given knowledge of the scheme,

MD4(MD4(($pass)).(strtolower($username)))

You can guess it. MD4 is decently fast to calculate, so if you have $username, all that's left is $pass.

You can either build such a thing yourself, or use something like John the Ripper, which I assume can be configured to attack this scheme.

 

As to what type of hash it is, you've mostly answered the question by naming how it is composed. MD4 is a rather old yet fast digest algorithm. This scheme uses that algorithm twice; first, it hashes the password and concatenates the hash with the lowercase form of the username, then it hashes that resulting string.

 

Sample implementation in perl:

#!/usr/bin/perl

use Digest::MD4 "md4_hex";

my $username = shift;
my $pass = shift;

print md4_hex( md4_hex($pass) . lc($username) ) . "\n";

Some outputs:

$ perl sample.pl user password
200677efff76ec27e716b319b611e217
$ perl sample.pl AzureDiamond hunter2
8ff17c78faf27083670a7423a90a964c

Sample (dumb) brute force password cracker:

#!/usr/bin/perl

use Digest::MD4 "md4_hex";

my $username = shift;
my $pw_hash = shift;
my $i = 0;

sub hash_check {
  shift;
  if (md4_hex( md4_hex($_) . lc($username) ) eq $pw_hash) {
    print "\r$i\nPassword found: '$_'\n";
    exit;
  }
}

LINE: while() {
  chomp;

  my @variants = ($_);
  my $v = $_;
  $v =~ s/\W//g; # strip non-word chars
  push(@variants, $v) if ($_ ne $v);
  $v = lc($_); # all lowercase
  push(@variants, $v) if ($_ ne $v);
  $v =~ s/\W//g; # all lowercase AND strip non-word chars
  push(@variants, $v) if ($_ ne $v);
  $v = uc(substr($_,0,1)).substr($_,1); # uppercase 1st char
  push(@variants, $v) if ($_ ne $v);
  $v =~ s/\W//g; # uppercase 1st char AND strip non-word chars
  push(@variants, $v) if ($_ ne $v);

  for my $pw (@variants) {
    # try followed by nothing or 1-2 digits
    for my $j ("", 0..99, qw/00 01 02 03 04 05 06 07 08 09/) {
      $i++;
      print "\r$i" if $i % 111 == 0; # only print every 111 (this is FAST)
      $_ = $pw . $j;
      last LINE if hash_check($_);
    }
  }
}
print "\r$i\n";

Some outputs:

$ echo password |perl sample.pl user 200677efff76ec27e716b319b611e217
1
Password found: 'password'
$ perl /tmp/sample.pl user a3c705c458e12e2f9982ae2682b437f8 american-english
26955905
Password found: 'password07'
$ perl sample.pl admin 4ef6c6a21c0172c8cd322dd8f78ba6c1 american-english-huge
126764776
$ 

My laptop (which ran this at 650k pw/sec) didn't find your password given these simple iterations (dictionary word with some guesses about case, 0-2 digits following it). /usr/share/dict/american-english-huge has 341,472 words and comes from the Debian package wamerican-huge version 7.1-1.

  • this is the hash 4ef6c6a21c0172c8cd322dd8f78ba6c1 and this is the $username ; that is mean the follow : MD4(MD4(($pass)).(strtolower(admin))) the problem in password can i use John The Riper to find it – Radwan Cherfy Jul 10 '15 at 2:47
  • I keep meaning to try John the Ripper, but I haven't yet. You can manually try this with a simple script (added above), but you'll have to invent all of the possible password schemes manually (it wasn't an obvious one). – Adam Katz Jul 10 '15 at 22:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.