john cannot load hashes with \r in salt, rejected in loader.c
Open
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 13.6k
- Forks
- 2.6k
- PR merge metrics
- No merged PRs in 30d
Description
$ python -c 'import crypt; print crypt.crypt("123456", "$1$\r")' > t2.pw
$ hd t2.pw
00000000 24 31 24 0d 24 34 75 41 51 76 6a 46 41 63 30 53 |$1$.$4uAQvjFAc0S|
00000010 4e 59 35 62 4a 57 57 5a 61 76 2f 0a |NY5bJWWZav/.|
$ john --show=types-json t2.pw
[{"lineNo":1,"ciphertext":"$1$","consistencyMark":3}]
$ python -c 'import crypt; print crypt.crypt("123456", "$1$abcdefg\r")' > t2.pw
$ hd t2.pw
00000000 24 31 24 61 62 63 64 65 66 67 0d 24 69 59 65 51 |$1$abcdefg.$iYeQ|
00000010 4a 71 52 6c 32 4b 49 37 54 78 51 35 39 74 32 54 |JqRl2KI7TxQ59t2T|
00000020 73 2f 0a |s/.|
$ john --show=types-json t2.pw
[{"lineNo":1,"ciphertext":"$1$abcdefg","rowFormats":[]}]
\r is replaced with \0, so john truncates hash at the first appearance of \r. It affects all hash formats that have salt as is and allow binary chars. I don't know if such hashes exist in the wild.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in loader.c and reproduce the issue with the two Python crypt commands and john --show=types-json shown in the report. Trace how carriage returns are handled while loading hashes; done means the full ciphertext is retained instead of being truncated at \r, with the reported formats still loading correctly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 50/100