3

Linux unshadow file

wolf@linux:~$ cat md5hash.txt 
root:$1$FTpMLT88$VdzDQTTcksukSKMLRSVlc.:0:0:root:/root:/bin/bash
john:$1$wk7kHI5I$2kNTw6ncQQCecJ.5b8xTL1:500:500::/home/john:/bin/bash
harold:$1$7d.sVxgm$3MYWsHDv0F/LP.mjL9lp/1:501:501::/home/harold:/bin/bash
wolf@linux:~$

md5hash only

wolf@linux:~$ cat md5hash_only.txt 
$1$FTpMLT88$VdzDQTTcksukSKMLRSVlc.
$1$wk7kHI5I$2kNTw6ncQQCecJ.5b8xTL1
$1$7d.sVxgm$3MYWsHDv0F/LP.mjL9lp/1
wolf@linux:~$

Since I know that these are md5 format, I used --format=md5 option in john.

Unfortunately, I'm getting Unknown ciphertext format name requested error.

wolf@linux:~$ john --format=md5 md5hash.txt 
Unknown ciphertext format name requested
wolf@linux:~$ 

wolf@linux:~$ john --format=md5 md5hash_only.txt 
Unknown ciphertext format name requested
wolf@linux:~$

I've verified that the format is similar with pentestmonkey cheat-sheet

Any idea what's wrong here?

Wolf
  • 347
  • 2
  • 3
  • 15

1 Answers1

4

What version of your John?

kali@kali:$ john | head -3
John the Ripper 1.9.0-jumbo-1 OMP [linux-gnu 64-bit x86_64 AVX2 AC]
Copyright (c) 1996-2019 by Solar Designer and others
Homepage: http://www.openwall.com/john/
kali@kali:$

For version 1.9, there are a few types of md5. md5 only are not one of them.

kali@kali:$ john --list=formats | tr , '\n' | grep md5
 md5crypt
 md5crypt-long
 asa-md5
 dmd5
 krb5pa-md5
 net-md5
 md5ns
 pix-md5
tcp-md5
kali@kali:$

If you're not sure of your hash type, use hashid tool

kali@kali:$ hashid '$1$FTpMLT88$VdzDQTTcksukSKMLRSVlc.'
Analyzing '$1$FTpMLT88$VdzDQTTcksukSKMLRSVlc.'
[+] MD5 Crypt 
[+] Cisco-IOS(MD5) 
[+] FreeBSD MD5 
kali@kali:$

This is actually MD5 Crypt

kali@kali:$ cat hash.txt
$1$FTpMLT88$VdzDQTTcksukSKMLRSVlc.
$1$wk7kHI5I$2kNTw6ncQQCecJ.5b8xTL1
$1$7d.sVxgm$3MYWsHDv0F/LP.mjL9lp/1
kali@kali:$

Try again ... voilà

kali@kali:$ john --format=md5crypt hash.txt
Using default input encoding: UTF-8
Loaded 3 password hashes with 3 different salts (md5crypt, crypt(3) $1$ (and variants) [MD5 256/256 AVX2 8x3])
Will run 2 OpenMP threads
Proceeding with single, rules:Single
Press 'q' or Ctrl-C to abort, almost any other key for status
Almost done: Processing the remaining buffered candidate passwords, if any.
Proceeding with wordlist:/usr/share/john/password.lst, rules:Wordlist
Proceeding with incremental:ASCII