4

A part of my /etc/login.defs file looks like this:

ENCRYPT_METHOD SHA512

# Define the number of SHA rounds.
# If not specified, the libc will choose the default number of rounds (5000).
# The values must be inside the 1000-999999999 range.
# If only one of the MIN or MAX values is set, then this value will be used.
# If MIN > MAX, the highest value will be used.
#
# SHA_CRYPT_MIN_ROUNDS 5000

SHA_CRYPT_MAX_ROUNDS 6000

From what I understand of this, is that the password will go through 6000 rounds of hash.

Now, when I used a tool like hashcat how do I tell it that the hash has gone through 'x' number of rounds.

I am able to use hashcat like so: hashcat -m 1800 -a 0 -o found.txt hash.txt rockyou.txt and it is still able to find it. Is it able to figure out the number of rounds by itself?

Edit: I just found out that the Linux box wasn't actually using 6000 rounds of hash, although I thought I had configured it to use 6000 rounds. Instead it was just 5000.

With some Python code, I was able to replicate the "SHA512" password encryption in Linux:

from passlib.hash import sha512_crypt
sha512_crypt.encrypt("testing123",rounds=6000,salt="6EGwX1iP")

The resulting hash is $6$rounds=6000$6EGwX1iP$oMerxGPimb/4ZXcI0Vbt87sNfw07eh7VPzcQwHOls8t3hLYGLQR0KjncrpyAjLTfPC3Fj7jhFoZKeuPRfTbJa/

This string of course has the number of rounds which can be passed to hashcat.

3

Edit: I saw that you found your answer, but I'll add it here for completeness sake. (And I already had this written down).


Hashcat doesn't guess the # of rounds, and the amount of rounds specified in your /etc/login.defs isn't properly applied.

I took an example from my Linux box:

$6$elIIOT8d$lXVE7ZxTaBnvyi3kgrVGOpq.I/tQU9CN.G2FgpcjyxovibRB1TjDbk7NFkOwo7ySt.w8BwnacxQ0876/hz6l//

This is the same as:

$6$rounds=5000&elIIOT8d$lXVE7ZxTaBnvyi3kgrVGOpq.I/tQU9CN.G2FgpcjyxovibRB1TjDbk7NFkOwo7ySt.w8BwnacxQ0876/hz6l//

If the amount of rounds was properly set, you would see a different number instead of 5000 in the hash.

Linux

On my box running Kali Linux I was able to specify the number of rounds by going to the /etc/pam.d/common-password and finding the line (line 25 in my case):

password [success=1 default=ignore] pam_unix.so obscure sha512

I appended "rounds=1234" to it:

password [success=1 default=ignore] pam_unix.so obscure sha512 rounds=1234

saved and created a user:

$> adduser test3

And ended up with this in my /etc/shadow-file:

$>tail --lines=1 /etc/shadow

test3:$6$rounds=1234$SzWcxuIH$YX1QDmE1PG7grJ/4rJ8LkwggmEffoo9vUCuPAhL3x2sBQZJ8n2a2OeHpFEKaWDH2o.NGYwbLFZNabfOQlQuZ21:16627:0:99999:7:::

Hashcat

You can manually specify how many iterations Hashcat should do by appending rounds=[# of iterations] after the signature, e.g:

$6$rounds=5000&elIIOT8d$lXVE7ZxTaBnvyi3kgrVGOpq.I/tQU9CN.G2FgpcjyxovibRB1TjDbk7NFkOwo7ySt.w8BwnacxQ0876/hz6l//

This will, however, be automatically applied if the amount of rounds != 5000, in /etc/shadow

  • Could you give me some pointers to how to correctly apply the number of rounds in '/etc/login.defs' – user1720897 Jul 11 '15 at 16:34
  • 1
    @user1720897 I've added a part on how to do it in Kali Linux now. – Mrtn Jul 11 '15 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.