+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Deprecated; Ancient Versions (https://hashcat.net/forum/forum-46.html)
+--- Forum: Very old oclHashcat-plus Support (https://hashcat.net/forum/forum-23.html)
+--- Thread: Salted SHA-1 found by Lite but not by Plus (/thread-2407.html)
Salted SHA-1 found by Lite but not by Plus - qweasd - 06-26-2013
Hi folks, strange issue here...
I am using this input file as sha1($pass.$salt):
4205d56d3102258cc00b5eed8d13886225ebd618:134e012e33e18783de360103c1fb07798df0e1cf
When I run oclHashcat-lite64, it ils immediately found (password "test"), but it seems to transform the hash:
Code:
oclHashcat-lite64.exe -m 110 C:\hash.txt
(...)
Session.Name...: oclHashcat-lite
Status.........: Cracked
Hash.Target....: 6dd505428c250231ed5e0bc06288138d18d6eb25:134e012e33e18783de360103c1fb07798df0e1cf
Hash.Type......: sha1($pass.$salt)However, when I run oclHashcat-plus64 in bruteforce mode, the hash does not go through the same transformation and doesn't get cracked:
Code:
oclHashcat-plus64.exe -a 3 -m 110 C:\hash.txt
(...)
Session.Name...: oclHashcat-plus
Status.........: Running
Input.Mode.....: Mask (?1?2?2?2?2?2)
Hash.Target....: 4205d56d3102258cc00b5eed8d13886225ebd618:134e012e33e18783de360103c1fb07798df0e1cf
Hash.Type......: sha1($pass.$salt)What am I doing wrong here? I use the exact same command, except "-a 3" for the "plus" version. Same behaviour when I run "plus" with a dictionary and/or mask.
Thanks for your help!
RE: Salted SHA-1 found by Lite but not by Plus - atom - 06-26-2013
In oclHashcat-plus, the max. supported salt length is 32
RE: Salted SHA-1 found by Lite but not by Plus - qweasd - 07-02-2013
Hi atom,
Thanks for the reply. Can you explain what kind transformation oclHashcat lite applies to the hash it displays? I've tried with shorter salts, oclHashcat plus is able to crack them without applying this transformation.
I try to script some password cracking tasks, and I can't compare the original hash with the one oclHashcat lite produces when it cracks passwords.
Thank you again
RE: Salted SHA-1 found by Lite but not by Plus - philsmd - 07-02-2013
I don't know if this is a problem w/ lite, but it seems to output the digest just in byte-swapped format, see here to understand that (first plus - correct -, then lite):
4205d56d
6dd50542
what happened? 42 was first is now last, 05 was second -> becomes second last, d5 was third -> 3rd to last, 6d last -> first
Will check if I can reproduce this w/ latest lite today.
Maybe this helps in the meantime (this will revert all hashes (before colon ":") in hashcat.pot, you could do the same by specifing the outfile instead):
Code:
sed -r 's@^([^:]*)(.*)$@echo -n \1|sed -r "s!([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})([0-9a-f]{2})!\\4\\3\\2\\1!g";echo \2;@ge' hashcat.potRE: Salted SHA-1 found by Lite but not by Plus - qweasd - 07-03-2013
Hey philsmd,
Good job on seeing that
- And congrats on the sed kung-fu - I'll be able to script something up to revert the resulting hashes in the good format now.Problem solved for now.
RE: Salted SHA-1 found by Lite but not by Plus - qweasd - 07-03-2013
Here is the php version of it, if someone cares...
Code:
<?php
$hash = '6dd505428c250231ed5e0bc06288138d18d6eb25';
$res = '';
if (strlen($hash) % 8 == 0)
{
$tab = str_split($hash, 8);
foreach ($tab AS $chunk)
$res .= join('', array_reverse(str_split($chunk, 2)));
}
echo $res;
?>RE: Salted SHA-1 found by Lite but not by Plus - philsmd - 07-03-2013
I would like to trac(k) this problem here: https://hashcat.net/trac/ticket/174