search

openwall / john

John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
https://www.openwall.com/john/
Other
10.05k stars 2.08k forks source link

Support PKZIP Master Key #3971

Open solardiz opened 5 years ago

solardiz commented 5 years ago

We might want to first decide on the general issue of supporting (or not) cracking of non-passwords in JtR. For example, we could also want to add cracking of raw DES, like hashcat already has, but perhaps not only on GPU, but also on FPGA. That said, here goes:

There's this recent paper about PKZIP cracking on GPU, which gives plenty of credit to our work and shows that a GPU implementation of what we already do on CPU is worthwhile (we might want to create a separate GitHub issue for that):

http://www.insticc.org/node/TechnicalProgram/icissp/presentationDetails/73605

There's also this recent addition to hashcat:

https://github.com/hashcat/hashcat/pull/2032 https://twitter.com/hashcat/status/1129441728761610242

where the Master Key is cracked by having it effectively reduced from 96 to just 48 still-unknown bits, if I understand correctly.

magnumripper commented 5 years ago

We might want to first decide on the general issue of supporting (or not) cracking of non-passwords in JtR.

I think we should support it. First thing to do is support nulls from mask mode - although that involves some work in core.

solardiz commented 5 years ago

support nulls from mask mode

If we want to use mask mode for cracking arbitrary binary keys (I thought we wouldn't, but it's OK to consider this), then maybe we can have it specify the key in hex and the format would know to unhex it? For fast formats, we'd have in-format (and on-device where applicable) mask support, so it'd skip the hex/unhex and work directly on binary for that portion of the mask.

solardiz commented 5 years ago

we might want to create a separate GitHub issue for that

Reopened #718 for implementing a basic pkzip-opencl format (testing passwords, not keys).

We might also need yet another format for testing passwords against an already cracked key. If I understood correctly, hashcat added a mode like this as well - I guess it's quicker to test passwords against the key than against the archive?

magnumripper commented 5 years ago

If we want to use mask mode for cracking arbitrary binary keys (I thought we wouldn't, but it's OK to consider this)

I just thought it'd be the "quickest" way to get there, but there are other alternatives of course. BTW one way to do it in Mask mode without even touching core code is to encode [CPU-side] nulls as modified UTF-8 where null is 0xC0, 0x80. Normally that's not considered valid UTF-8 but it's a good way to make legacy strcpy et. al work as-is.

We might also need yet another format for testing passwords against an already cracked key. If I understood correctly, hashcat added a mode like this as well - I guess it's quicker to test passwords against the key than against the archive?

Sure. We have some similar things already: Oldoffice can use a meet-in-the-middle key, if provided, within the one same format. In WPAPSK-PMK we took the other route of having a separate format. There are pros and cons, as usual.

magnumripper commented 5 years ago

We need to implement support for $HEX[deadcafe] before this, as in #3645 / #2354