John the ripper passwd file format with salt not working

Question

I'm trying test password strength in one of our e-commerce sites. I'm using john the ripper to brute-force a password file. The algorithm used by PHP is:

$hash = md5($salt . $pass)

No other transformation is performed nor in the $salt or in the pass, I've manually checked one example. I've found in the documentation that the sub-format that goes with the algorithm is dynamic_4. The problem is that passwd file format as written in documentation, doesn't seems to work, John is unable to load the hashes, this is the format that I've used:

// user:$dynamic_4$hash$salt
emi:$dynamic_4$83a3f08cfb2d9d0bac5d1a1619d8b7dd$Z3MkG2FZsaoV9EDCpmSRWvgANQAeXOeN7oadrAugu0rKEvfKqoNj6D9a

I've tried to change the salt for the hash but still nothing

I've tried the following parameters combination:

john --single passwd
john --format=dynamic_4 --single passwd
john --subformat=dynamic_4 --single passwd
john --format=md5 --single passwd
john --format=raw-md5 --single passwd

Answer 1

I've looked John the ripper source code and your syntax of using John The Ripper .

• In john the ripper dynamic hash subformats salts lenght are limited .

src/dynamic_preloads.c: 

static DYNAMIC_Setup Setups[] =
{
    { "dynamic_0: md5($p) (raw-md5)",           _Funcs_0, _Preloads_0, _ConstDefault, MGF_NO_FLAG, MGF_KEYS_INPUT },
    { "dynamic_1: md5($p.$s) (joomla)",         _Funcs_1, _Preloads_1, _ConstDefault, MGF_SALTED, MGF_NO_FLAG, -32 },
    { "dynamic_2: md5(md5($p)) (e107)",         _Funcs_2, _Preloads_2, _ConstDefault, MGF_NO_FLAG, MGF_KEYS_INPUT|MGF_SET_INP2LEN32 },
    { "dynamic_3: md5(md5(md5($p)))",           _Funcs_3, _Preloads_3, _ConstDefault, MGF_NO_FLAG, MGF_KEYS_INPUT|MGF_SET_INP2LEN32 },
    { "dynamic_4: md5($s.$p) (OSC)",            _Funcs_4, _Preloads_4, _ConstDefault, MGF_SALTED, MGF_NO_FLAG, -24  },
    { "dynamic_5: md5($s.$p.$s)",               _Funcs_5, _Preloads_5, _ConstDefault, MGF_SALTED, MGF_NO_FLAG, -12, 31, 56  },
    { "dynamic_6: md5(md5($p).$s)",             _Funcs_6, _Preloads_6, _ConstDefault, MGF_SALTED, MGF_KEYS_BASE16_IN1, -23, 55, 80 },
    ...
    ...
    ...

for example dynamic_0 is 32 byte,dynamic_4 is 24 byte,dynamic_5 is 12 byte, and ... .

You must modify the source code and recompiling JTR for supporting more than defualt value for salts .

---

• dynamic_4 field is not allow in passwd file .

Simple of cracking a salted hash :

sajjad@xxx:~/Downloads/john-1.7.9-jumbo-7/run$ cat pass.txt
admin:d5fedea70cf14c3191fc8e94fe4ca8b9$Y0g7Wx78AdpjIdZd

sajjad@xxx:~/Downloads/john-1.7.9-jumbo-7/run$ ./john -form=dynamic_1 -w=password.lst pass.txt
Loaded 1 password hash (dynamic_1: md5($p.$s)  (joomla)  [128x1 (MD5_Body)])
admin            (admin)
    ...
    ...
    ...

In order to show the cracked password, use the --show option

sajjad@xxx:~/Downloads/john-1.7.9-jumbo-7/run$ ./john --show pass.txt