Return Styles: Pseud0ch, Terminal, Valhalla, NES, Geocities, Blue Moon. Entire thread

Linuxy decrypting

Name: Zomglies. 2006-10-20 15:55

Anyone know how to decrypt Linuxy passwords?
such as..
$1$zPaRqWj1$bNnX6Wnu6waR7fm0/dt7M/
and etc..  John The Ripper ain't helping a whole lot.

Name: Anonymous 2006-10-20 16:37

>>1
Buy some CPU time at a cluster.

Name: Anonymous 2006-10-22 13:00

No.

Name: Anonymous 2006-10-22 20:02 (sage)

>>1
Write a bash script to brute force it, then let it run on your computer for a few years. Good luck.

Name: Anonymous 2006-10-23 4:29

What's the username?  Tell us about the computer and who uses it.  Maybe we can guess it using heuristics.

Name: Anonymous 2006-10-23 6:11

gimme ip and ill crack it for you

Name: Anonymous 2006-10-23 8:40

The "passwords" in /etc/shadow are not encrypted, nor are they passwords. They're hashes. They can *not* be reversed. That's the whole idea.

You take a seed (a somewhat random 128 bit number for md5 hashes) and the password and generated a hash (md5 for example) of the value.  The hash and the seed get stored in the shadow file.  If you want to validate the password, you take the seed from the shadow file and combine it with the puntative password and take the hash of that.  If it matches the hash in the shadow
file, the pasword must have matched the original password and it passes. If the hashes don't match, then the passwords didn't match and it fails. You NEVER have to reverse the hash and recover the plaintext password from the hash.  The seed is there to insure that if two instances (accounts) use the same password, they DON'T get the same hash (because the seeds are different) making brute force guessing and precomputed dictionary hash attacks neigh unto impossible.
 
Best you can do is brute force guessing different passwords. John the Ripper or Crack do a pretty fair job against lame passwords. Against good passwords, you don't stand much of a chance.  Unfortunately, few people use good passwords...

Name: Anonymous 2006-10-23 9:13

They can *not* be reversed. That's the whole idea.
QFT

BUT!
You can use Brute-Force - just a bit modified.
The Brute-Forcer picks the next combination, you make the hash of that combination, and compare it to the one in the file. If they match, then you have found the password.

But this takes even longer than normal Brute-Force...

Name: Anonymous 2006-10-23 10:07

LOL yeah, good luck.  Even on one of the new quad core systems, it would take an average of thirty thousand years to just brute force a decent password (eight characters, upper and lower case, and a couple numbers).

Name: Anonymous 2006-10-23 13:41

>>8
You cannot do that, because each user account uses a different hash seed made from pseudorandom entropy

Name: Anonymous 2006-10-23 16:28

>>9 thinks a quad core computer is the Gibson

Name: Anonymous 2006-10-23 19:35

write a program called decrypt that cracks passwords
do it so that you can run the command as such:
decrypt <password>

easy.

Name: Anonymous 2006-10-23 20:12

>>12
There are two of these on the Undernet right now, actually

Name: Anonymous 2006-10-23 20:13

>>13
what is this Undernet of which you speak

Name: Anonymous 2006-10-23 20:14

>>14
the Dark Internet you can only get to once you've been v& for hacking

it's pretty awesome in here

Name: Anonymous 2006-10-23 20:14

>>15
oh ok my friend marc told me about this once but I thought he was lying

Name: Anonymous 2006-10-24 17:15

Anyone who manages to get it gets a prize.

Newer Posts
Don't change these.
Name: Email:
Entire Thread Thread List