| I am looking for a program to brute force .htpasswd
| using MD5 encryption using by Apache on W32 platform.
Attached a patch against john-1.6 to make the freebsd
method work with arbitrary magic strings.
diff -ruN john-1.6/src/MD5_fmt.c john-1.6-apmd5/src/MD5_fmt.c
--- john-1.6/src/MD5_fmt.c Wed Dec 2 19:29:50 1998
+++ john-1.6-apmd5/src/MD5_fmt.c Fri Nov 30 00:33:14 2001
@@ -31,6 +31,7 @@
{"$1$12345678$f8QoJuo0DpBRfQSD0vglc1", "12345678"},
{"$1$12345678$xek.CpjQUVgdf/P2N9KQf/", ""},
{"$1$1234$BdIMOAWFOV2AQlLsrN/Sw.", "1234"},
+ {"$apr1$Q6ZYh...$RV6ft2bZ8j.NGrxLYaJt9.", "test"},
{NULL}
};
@@ -40,11 +41,19 @@
{
char *pos, *start;
- if (strncmp(ciphertext, "$1$", 3)) return 0;
+ if(*ciphertext != '$') return 0;
- for (pos = &ciphertext[3]; *pos && *pos != '$'; pos++);
- if (!*pos || pos < &ciphertext[4] || pos > &ciphertext[11]) return 0;
+ /* magic string */
+ start = &ciphertext[1];
+ for (pos = start; *pos && *pos != '$'; pos++);
+ if (!*pos || pos < start+1 || pos > start+MD5_MAGIC_LENGTH+1) return 0;
+ /* salt */
+ start = ++pos;
+ for (pos = start; *pos && *pos != '$'; pos++);
+ if (!*pos || pos < start || pos > start+8) return 0;
+
+ /* hash */
start = ++pos;
while (atoi64[(ARCH_INDEX)*pos] != 0x7F) pos++;
if (*pos || pos - start != CIPHERTEXT_LENGTH) return 0;
diff -ruN john-1.6/src/MD5_std.c john-1.6-apmd5/src/MD5_std.c
--- john-1.6/src/MD5_std.c Wed Dec 2 19:29:50 1998
+++ john-1.6-apmd5/src/MD5_std.c Fri Nov 30 01:02:11 2001
@@ -14,6 +14,8 @@
#include "common.h"
#include "MD5_std.h"
+char cryptmd5_magic[MD5_MAGIC_LENGTH];
+
MD5_binary MD5_out;
typedef union {
@@ -463,6 +465,7 @@
MD5_block block;
int length, index;
struct pattern *line;
+ int l;
#if ARCH_LITTLE_ENDIAN
MD5_word *last;
#endif
@@ -519,11 +522,12 @@
MD5_body(block.w, MD5_out);
MD5_swap(MD5_out, MD5_out, 4);
- memcpy(&block, patterns.o.p.b, patterns.l.p);
- memcpy(&block.b[patterns.l.p], "$1$", 3);
- memcpy(&block.b[patterns.l.p + 3], patterns.s, patterns.l.s);
- memcpy(&block.b[patterns.l.ps + 3], MD5_out, patterns.l.p);
- length = patterns.l.psp + 3;
+ l = strlen(cryptmd5_magic);
+ memcpy(&block, patterns.o.p.b, patterns.l.p);
+ memcpy(&block.b[patterns.l.p], cryptmd5_magic, l);
+ memcpy(&block.b[patterns.l.p + l], patterns.s, patterns.l.s);
+ memcpy(&block.b[patterns.l.ps + l], MD5_out, patterns.l.p);
+ length = patterns.l.psp + l;
if ((index = patterns.l.p))
do {
block.b[length++] = (index & 1) ? 0 : patterns.o.p.b[0];
@@ -564,9 +568,15 @@
{
static char out[9];
int length;
+ char *pos;
+ char *start;
+
+ start = &ciphertext[1];
+ for (pos = start; *pos && *pos != '$'; pos++);
+ start = ++pos;
for (length = 0; length < 8; length++)
- if ((out[length] = ciphertext[3 + length]) == '$') break;
+ if ((out[length] = start[length]) == '$') break;
out[length] = 0;
return out;
@@ -590,9 +600,18 @@
char b[16];
} out;
char *pos;
+ char *start;
MD5_word value;
+
+ memset(cryptmd5_magic, 0, MD5_MAGIC_LENGTH);
+
+ start = &ciphertext[1];
+ for (pos = start; *pos && *pos != '$'; pos++);
+ if (!*pos || pos < start+1 || pos > start+MD5_MAGIC_LENGTH+1) return 0;
+ pos++;
+ strncpy(cryptmd5_magic, start-1, 1 + (int)pos - (int)start);
- pos = ciphertext + 3; while (*pos++ != '$');
+ while (*pos++ != '$');
TO_BINARY(0, 6, 12);
TO_BINARY(1, 7, 13);
diff -ruN john-1.6/src/MD5_std.h john-1.6-apmd5/src/MD5_std.h
--- john-1.6/src/MD5_std.h Wed Dec 2 19:29:50 1998
+++ john-1.6-apmd5/src/MD5_std.h Fri Nov 30 00:45:54 2001
@@ -27,6 +27,8 @@
#define MD5_ALGORITHM_NAME "32/" ARCH_BITS_STR
+#define MD5_MAGIC_LENGTH 10
+
/*
* Sets a salt for MD5_std_crypt().
*/
----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/
This archive was generated by hypermail 2b30 : Fri Nov 30 2001 - 07:44:57 PST