openwall / john

John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
https://www.openwall.com/john/
Other
10.03k stars 2.07k forks source link

Toggle shift for single letter and add "keyboard layout" options. #3469

Open magnumripper opened 5 years ago

magnumripper commented 5 years ago

t toggles case (a<->A) for whole word and TN toggles position N only.

S toggles shift (eg. a<->A and 4<->$) for whole word. It's a superset of t. Unfortunately there is no variant similar to TN for a single position.

I experimented with this (nearly identical to the TN code) that implements toggle shift of character at position N as WN, and it has proven useful.

diff --git a/src/rules.c b/src/rules.c
index 0016b97e1..308943779 100644
--- a/src/rules.c
+++ b/src/rules.c
@@ -1794,6 +1794,14 @@ char *rules_apply(char *word_in, char *rule, int split, char *last)
                        in[0] = 0;
                        break;

+               case 'W':
+                       {
+                               int pos;
+                               POSITION(pos)
+                               in[pos] = conv_shift[ARCH_INDEX(in[pos])];
+                       }
+                       break;
+
                case 'S':
                        CONV(conv_shift);
                        break;

I picked W because it was the first unused one (in qwerty order). @solardiz @jsteube is WN OK or would you prefer some other letter?

jsteube commented 5 years ago

For me "W" is fine.

Question: The S rule is news to me and looks like that this also depends on the keyboard layout. For me (on a German keyboard layout) the 4 translates to $ as well. But for instance the 2 would not translate to @ but to " character. So how exactly do you do the mapping and more important, where do you get the configuration data from? This is kind of interesting because it is something that we need to do in order to crack bootable TrueCrypt volumes and I still haven't found a good solution to it.

solardiz commented 5 years ago

I think I introduced S very early in JtR development - 1996 or so, and certainly no later than 1998. I wasn't thinking of other keyboard layouts back then.

W is fine with me. I like that it's near S on a QWERTY keyboard, showing relevance of these two commands. It's unfortunate that s is taken (and had been taken in Crack before I introduced S).

For different keyboard layouts, I think it makes sense to have both a global setting (in john.conf or/and command-line) and a way to specify/override it in the rule (perhaps in JtR's rule flags). Due to the preprocessor, we'd be able to easily request that a rule be re-tested with multiple keyboard layouts - listing those rule flags in square brackets - to be used in default/generic rulesets intended to be applied to hashes of passwords of mixed origin (e.g., international users of an online service).

magnumripper commented 5 years ago

Good input. So we add a rule flag for keyboard layout. Let's say we pick -N (for nationality). This is somewhat generic: In the future it might be used for other nationality things as well (the few grammar rules come to mind).

So here's my RFC right now (typing as I think):

And we can use preprocessor for things like: -c -N[0-4] S Q

magnumripper commented 5 years ago

Basic functionality added in b67af09. I'll look at implementing nationality and rule flags later so keeping issue open for that.

magnumripper commented 5 years ago

8bfc599: Unlike TN, the WN command can't be used with -c rule rejection so could produce a humongous number of duplicates for a case insensitive format (eg. foo, Foo, fOo and foO would be seen as non-dupes by Q command while they are dupes in the format). This had me figure out a canonical way to fix that and similar problems without using a rule flag. It's effective on most commands that use conv_* arrays.

45% boost seen using ShiftToggle rule with LM format. Note that the boost is seen in wall clock time, not necessarily in reported speed.