Re: Extreme Networks password hash

[Peter Kosinar <goober () ksp sk>]

Hello Alexander,

> ---------------------------------------
> configure account admin encrypted
> 452tVo$nEbHpfJFTUGyBrqmtY8q3.
> 452tVo$nEbHpfJFTUGyBrqmtY8q3.
> create account user "user" encrypted "yN/tVo$ARBcY8KlQBq.lvJg2nc5F."
> --------------------------------------
>
> Does anyone know about the kind of hash used, or recognize the ones in the
> configuration? If you do, would you happen to know any tool that can perform
> an attack against this kind of hash?

It's MD5, as used by crypt(). Prepend "$1$" to the password, and feed it 
to your favourite password cracker:

& cat pass
test1:$1$452tVo$nEbHpfJFTUGyBrqmtY8q3.:::::
test2:$1$yN/tVo$ARBcY8KlQBq.lvJg2nc5F.:::::
& ./john pass
Loaded 2 password hashes with 2 different salts (FreeBSD MD5 [32/32])
                 (test1)
                 (test2)
guesses: 2  time: 0:00:00:00 100% (2)  c/s: 1111  trying:

Peter

--
[Name] Peter Kosinar   [Quote] 2B | ~2B = exp(i*PI)   [ICQ] 134813278



------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------