Dynamic silently refuses to load over-long salts, but would ideally warn
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 13.6k
- Forks
- 2.6k
- PR merge metrics
- No merged PRs in 30d
Description
I found a bug if I try to use a dynamic function with salt bigger than 32 character.
john -test -format:"dynamic=sha512($u.$p.$s)"
echo wordlist.txt >
password
echo > test.in
User1:145605ea09b770ffae598cdb1a1828dc6c66801c19716bbd59f64bfbb2a06e13ad72fb4896d6b180e1c297fd49680014fac80616f56e20d73f9350f150ff6a1f$NormalSalt
User2:c8620f4f0001dc11e61c134f541fd485cd875d77ab8c3f6112f1d821c2fea36018b32c6db96490cd321d4361b299d79f1cda27d7d2ad40e15d4437bca2e9acd2$SaltWithLimitOf32characterWorkss
Unbreakable:d8628ba8d3b35c21f5801216545bb232ff0280d04eb6b7b552217b1da117762507f457f5629216d0a6576efefb4df57de7a1acd8f28b6fc2f017a2d2aa991459$SaltWithMoreThan32characterWillNotWork
So, if I run the program:
john --format:"dynamic=sha512($u.$p.$s)" --wordlist=wordlist.txt test.in
Only found two:
password (User1)
password (User2)
To solve this, I can just change the order of the user and salt
john -test -format:"dynamic=sha512($s.$p.$u)"
echo > solved.in
NormalSalt:145605ea09b770ffae598cdb1a1828dc6c66801c19716bbd59f64bfbb2a06e13ad72fb4896d6b180e1c297fd49680014fac80616f56e20d73f9350f150ff6a1f$User1
SaltWithLimitOf32characterWorkss:c8620f4f0001dc11e61c134f541fd485cd875d77ab8c3f6112f1d821c2fea36018b32c6db96490cd321d4361b299d79f1cda27d7d2ad40e15d4437bca2e9acd2$User2
SaltWithMoreThan32characterWillNotWork:d8628ba8d3b35c21f5801216545bb232ff0280d04eb6b7b552217b1da117762507f457f5629216d0a6576efefb4df57de7a1acd8f28b6fc2f017a2d2aa991459$Unbreakable
john --format:"dynamic=sha512($s.$p.$u)" --wordlist=wordlist.txt solved.in
Now every password is found:
password (NormalSalt)
password (SaltWithLimitOf32characterWorkss)
password (SaltWithMoreThan32characterWillNotWork)
This is a VERY difficult bug to find! And there are some problems with it.
I have a bad salt (with new line). So I input it in hex. But...
- Because the salt is bigger than 32, I can't input it.
- If I use the hex salt as User, the John don't accept.
So, how can I solve it? How can I input the User as hex? Only after the bug is solved?
This is my version (the last):
John the Ripper 1.9.0-jumbo-1 OMP [cygwin 64-bit x86_64 AVX2 AC]
Copyright (c) 1996-2019 by Solar Designer and others
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the dynamic=sha512($u.$p.$s) commands with the supplied test.in data, then compare them with the reordered $s.$p.$u case. Trace the dynamic-format handling of salts longer than 32 characters and hex input; done should include an explicit warning instead of silently refusing the over-long salt and clarify how the reported input can be handled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100