7

I'm trying to get shell access to a router and have managed to retrieve its /etc/shadow file:

root:$1$$N76hdwGfg11g0KdKbtyh21:0:0:root:/root:/bin/bash

I've tried to use john to crack it but couldn't:

$ ./john --show passwd
0 password hashes cracked, 1 left

I've also made a test account and managed to crack it on ubuntu/debian:

$ ./john --show passwd_test 
testtesttest:test:16626:0:99999:7:::

1 password hash cracked, 0 left

where testtesttest is the user and test the password. What format is the password hash in?

Edit:

Found it here. It would be nice to know its format though.

Improve this question
2
  • 1
    Which version of john are you using? Version 1.8.0 on Ubuntu 14.04 says this Loaded 1 password hash (md5crypt [MD5 32/32]). But it takes more than a couple of minutes to brute force it. The password you found is hashed using the empty string as salt. That makes the hash weaker, but you can only take advantage of that if you have multiple hashes to break or if you can find a rainbow table for that particular format.
    – kasperd
    Jul 11, 2015 at 12:54
  • 1
    Related: freerainbowtables.com/phpBB3/…
    – kasperd
    Jul 11, 2015 at 12:57

2 Answers 2

Reset to default
16

The most common format for hashes on Unix-like systems has the form $ALG$SALT$OUTPUT where ALG is a small number identifying the algorithm, SALT is a salt for the hash and OUTPUT is the output of the hash function. SALT and OUTPUT are encoded in base64.

Algorithm 1 is “MD5 crypt”, a construct based on iterating the MD5 hash function. This algorithm was not (and still isn't, as far as I know) defined by a formal standard. It was introduced by Poul-Henning Kamp in FreeBSD in 1994.

Normal APIs add a salt. The original implementation forced a 48-bit salt. The iteration count is fixed to 2477, which the author benchmarked for 34µs on a high-end PC of the time. Your hash has an empty salt, which is unusual and required the developer or administrator who configured it to bypass the usual tools and probably call a library function directly.

Current Linux systems usually use algorithms 5 and 6, which are based on iterating SHA-256 and SHA-512 respectively. These constructs are broadly based on the same principle as PBKDF2, but compute the iterated hash differently.

You can find a wealth of information about password hash algorithms in the documentation of the passlib library, and of course the library gives you Python implementations. This algorithm is passlib.hash.md5_crypt.

Improve this answer
1
  • Maybe they expected crypt("foo", "$1$") to auto-generate a salt. I do that often and keep getting disappointed.
    – user1686
    Jul 11, 2015 at 7:54
10

Assuming the router follows the glibc standard for password hashes, the second field ($1$$N76hdwGfg11g0KdKbtyh21) is the password, and is encoded as follows:

  • $1$: iterated MD5 hash
  • $: No salt
  • N76hdwGfg11g0KdKbtyh21: the hashed password, in base64 encoding. In hex encoding, it would be 37bea177019f835d60d0a74a6edca1db
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .