Title:使用john破解ubuntu(linux)9.10密码 --2011-11-23 15:00

ubuntu 9.10的账户密码加密方式改用sha512了，默认的john是破不了的，还好官方有补丁。
 
首先解压缩john1.75的源代码，vi编辑Makefile文件，添加我下面标注好的红色字体
 
LDFLAGS = -s -lcrypt
 JOHN_OBJS_MINIMAL = \
 DES_fmt.o DES_std.o DES_bs.o \
 BSDI_fmt.o \
 MD5_fmt.o MD5_std.o \
 BF_fmt.o BF_std.o \
 AFS_fmt.o \
 LM_fmt.o \
 batch.o bench.o charset.o common.o compiler.o config.o cracker.o \
 crc32.o external.o formats.o getopt.o idle.o inc.o john.o list.o \
 loader.o logger.o math.o memory.o misc.o options.o params.o path.o \
 recovery.o rpp.o rules.o signals.o single.o status.o tty.o wordlist.o \
 unshadow.o \
 unafs.o \
 unique.o \
 crypt_fmt.o

然后新建一个crypt_fmt.c文件，代码如下/* public domain proof-of-concept code by Solar Designer */
 
#define _XOPEN_SOURCE /* for crypt(3) */
 #include <string.h>
 #include <unistd.h>
 
#include "arch.h"
 #include "params.h"
 #include "formats.h"
 
#define FORMAT_LABEL "crypt"
 #define FORMAT_NAME "generic crypt(3)"
 #define ALGORITHM_NAME "?/" ARCH_BITS_STR
 
#define BENCHMARK_COMMENT ""
 #define BENCHMARK_LENGTH 0
 
#define PLAINTEXT_LENGTH 72
 
#define BINARY_SIZE 128
 #define SALT_SIZE BINARY_SIZE
 
#define MIN_KEYS_PER_CRYPT 1
 #define MAX_KEYS_PER_CRYPT 1
 
static struct fmt_tests tests[] = {
 {"CCNf8Sbh3HDfQ", "U*U*U*U*"},
 {"CCX.K.MFy4Ois", "U*U***U"},
 {"CC4rMpbg9AMZ.", "U*U***U*"},
 {"XXxzOu6maQKqQ", "*U*U*U*U"},
 {"SDbsugeBiC58A", ""},
 {NULL}
 };
 
static char saved_key[PLAINTEXT_LENGTH + 1];
 static char saved_salt[SALT_SIZE];
 static char *crypt_out;
 
static int valid(char *ciphertext)
 {
 #if 1
 int l = strlen(ciphertext);
 return l >= 13 && l < BINARY_SIZE;
 #else
 /* Poor load time, but more effective at rejecting bad/unsupported hashes */
 char *r = crypt("", ciphertext);
 int l = strlen(r);
 return
 !strncmp(r, ciphertext, 2) &&
 l == strlen(ciphertext) &&
 l >= 13 && l < BINARY_SIZE;
 #endif
 }
 
static void *binary(char *ciphertext)
 {
 static char out[BINARY_SIZE];
 strncpy(out, ciphertext, sizeof(out)); /* NUL padding is required */
 return out;
 }
 
static void *salt(char *ciphertext)
 {
 static char out[SALT_SIZE];
 int cut = sizeof(out);
 
#if 1
 /* This piece is optional, but matching salts are not detected without it */
 switch (strlen(ciphertext)) {
 case 13:
 case 24:
 cut = 2;
 break;
 
case 20:
 if (ciphertext[0] == '_') cut = 9;
 break;
 
case 34:
 if (!strncmp(ciphertext, "$1$", 3)) {
 char *p = strchr(ciphertext + 3, '$');
 if (p) cut = p - ciphertext;
 }
 break;
 
case 59:
 if (!strncmp(ciphertext, "$2$", 3)) cut = 28;
 break;
 
case 60:
 if (!strncmp(ciphertext, "$2a$", 4)) cut = 29;
 break;
 }
 #endif
 
/* NUL padding is required */
 memset(out, 0, sizeof(out));
 memcpy(out, ciphertext, cut);
 
return out;
 }
 
static int binary_hash_0(void *binary)
 {
 return ((unsigned char *)binary)[12] & 0xF;
 }
 
static int binary_hash_1(void *binary)
 {
 return ((unsigned char *)binary)[12] & 0xFF;
 }
 
static int binary_hash_2(void *binary)
 {
 return
 (((unsigned char *)binary)[12] & 0xFF) |
 ((int)(((unsigned char *)binary)[11] & 0xF) << 8);
 }
 
static int get_hash_0(int index)
 {
 return (unsigned char)crypt_out[12] & 0xF;
 }
 
static int get_hash_1(int index)
 {
 return (unsigned char)crypt_out[12] & 0xFF;
 }
 
static int get_hash_2(int index)
 {
 return
 ((unsigned char)crypt_out[12] & 0xFF) |
 ((int)((unsigned char)crypt_out[11] & 0xF) << 8);
 }
 
static int salt_hash(void *salt)
 {
 int pos = strlen((char *)salt) - 2;
 
return
 (((unsigned char *)salt)[pos] & 0xFF) |
 ((int)(((unsigned char *)salt)[pos + 1] & 3) << 8);
 }
 
static void set_salt(void *salt)
 {
 strcpy(saved_salt, salt);
 }
 
static void set_key(char *key, int index)
 {
 strcpy(saved_key, key);
 }
 
static char *get_key(int index)
 {
 return saved_key;
 }
 
static void crypt_all(int count)
 {
 crypt_out = crypt(saved_key, saved_salt);
 }
 
static int cmp_all(void *binary, int count)
 {
 return !strcmp((char *)binary, crypt_out);
 }
 
static int cmp_exact(char *source, int index)
 {
 return 1;
 }
 
struct fmt_main fmt_crypt = {
 {
 FORMAT_LABEL,
 FORMAT_NAME,
 ALGORITHM_NAME,
 BENCHMARK_COMMENT,
 BENCHMARK_LENGTH,
 PLAINTEXT_LENGTH,
 BINARY_SIZE,
 SALT_SIZE,
 MIN_KEYS_PER_CRYPT,
 MAX_KEYS_PER_CRYPT,
 FMT_CASE | FMT_8_BIT,
 tests
 }, {
 fmt_default_init,
 valid,
 fmt_default_split,
 binary,
 salt,
 {
 binary_hash_0,
 binary_hash_1,
 binary_hash_2
 },
 salt_hash,
 set_salt,
 set_key,
 get_key,
 fmt_default_clear_keys,
 crypt_all,
 {
 get_hash_0,
 get_hash_1,
 get_hash_2
 },
 cmp_all,
 cmp_all,
 cmp_exact
 }
 };
 最后修改john.c文件，添加我下面标注的红色字体
 extern struct fmt_main fmt_DES, fmt_BSDI, fmt_MD5, fmt_BF;
 extern struct fmt_main fmt_AFS, fmt_LM;
 extern struct fmt_main fmt_crypt;
 
john_register_one(&fmt_DES);
 john_register_one(&fmt_BSDI);
 john_register_one(&fmt_MD5);
 john_register_one(&fmt_BF);
 john_register_one(&fmt_AFS);
 john_register_one(&fmt_LM);
 john_register_one(&fmt_crypt);

现在可以编译了，选择好你的平台和CPU类型，能够提高破解速度，我这里用的是linux,X86架构，所以选择的是
 linux-x86-sse2 Linux, x86 with SSE2 (best if 32-bit)
 如果你和我一样，输入下面的红色字体
  make linux-x86-sse2
 
现在实践下，可以发现能够破解了

摘自中国云安网(www.yunsec.net) 原文：http://www.yunsec.net/a/security/web/invasion/2010/0411/3284.html