Recovering/Cracking passphrase
Am Donnerstag, den 10.06.2010, 15:28 -0500 schrieb Justin Brown:
> Hello,
>
>
> I'm in a really bad situation. Basically, I've lost my passphrase, and > I'm trying to find a way to recover it. I know what the passphrase > should be (it's a really good 20 character passphrase), but I must > have mistyped it when configuring cryptsetup or added some complexity > which I failed to write down. I've tried about every combination of > all the passwords and passphrases that I use, and I can't come up with > anymore, so I'm going to try to build a cracker. I'd like to get some > feedback before I put a lot of time into writing the code.
I'm in a similar situation. Luckily, the Password is only 5 characters long.
I try a different approach. I want to use John the ripper for cracking the password.
Therefore I want to extract the sha1 key and salt from the luks Header. I don't know if this is possible somehow. Next I want to create a file from that data that is understood by JTR.
To test this approach I created sha1sums with sha1sum and libssl from a 3 letter word and put them in a password file. However I wasn't able to crack that password, even with sha1 support compiled into JTR. I guess I don't have the correct information in the password file and/or it is wrong formatted.
Any help and suggestions on this approach is welcome!
Signature · 2 lines
GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT! Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01
Quoted 10 lines · On Thu, Jul 1, 2010 at 10:34 PM, <[email protected]> wrote:
I'm in a similar situation. Luckily, the Password is only 5 characters long.
I try a different approach. I want to use John the ripper for cracking the password.
Therefore I want to extract the sha1 key and salt from the luks Header. I don't know if this is possible somehow. Next I want to create a file from that data that is understood by JTR.
Quoted 8 lines
To test this approach I created sha1sums with sha1sum and libssl from a 3 letter word and put them in a password file. However I wasn't able to crack that password, even with sha1 support compiled into JTR. I guess I don't have the correct information in the password file and/or it is wrong formatted.
Any help and suggestions on this approach is welcome!
The key is derived with PBKDF2, which is a bit more involved than a simple salted SHA-1 password hash.
You could use JTR to generate your password list (-stdout), but would need something else to do the PBKDF2 and checking (which is involved). You could use cryptsetup for that, either with or without modification depending on how slow you mind it being.
80^5 is still quite a few combinations to try, especially when you have to do at least tens of thousands of iterations for each combination.
Do you know much about your password? Is it all lower case? or only alphanumeric?
Any information that cuts down your search space is valuable.
-- Roscoe
Am Donnerstag, den 01.07.2010, 23:02 +1000 schrieb Roscoe:
Quoted 11 lines
You could use JTR to generate your password list (-stdout), but would need something else to do the PBKDF2 and checking (which is involved). You could use cryptsetup for that, either with or without modification depending on how slow you mind it being.
80^5 is still quite a few combinations to try, especially when you have to do at least tens of thousands of iterations for each combination.
Do you know much about your password? Is it all lower case? or only alphanumeric?
The number of characters is limited, yes. All are just lower case and one is known.