5

A part of my /etc/login.defs file looks like this:

ENCRYPT_METHOD SHA512

# Define the number of SHA rounds.
# If not specified, the libc will choose the default number of rounds (5000).
# The values must be inside the 1000-999999999 range.
# If only one of the MIN or MAX values is set, then this value will be used.
# If MIN > MAX, the highest value will be used.
#
# SHA_CRYPT_MIN_ROUNDS 5000

SHA_CRYPT_MAX_ROUNDS 6000

From what I understand of this, is that the password will go through 6000 rounds of hash.

Now, when I used a tool like hashcat how do I tell it that the hash has gone through 'x' number of rounds.

I am able to use hashcat like so: hashcat -m 1800 -a 0 -o found.txt hash.txt rockyou.txt and it is still able to find it. Is it able to figure out the number of rounds by itself?

Edit: I just found out that the Linux box wasn't actually using 6000 rounds of hash, although I thought I had configured it to use 6000 rounds. Instead it was just 5000.

With some Python code, I was able to replicate the "SHA512" password encryption in Linux:

from passlib.hash import sha512_crypt
sha512_crypt.encrypt("testing123",rounds=6000,salt="6EGwX1iP")

The resulting hash is $6$rounds=6000$6EGwX1iP$oMerxGPimb/4ZXcI0Vbt87sNfw07eh7VPzcQwHOls8t3hLYGLQR0KjncrpyAjLTfPC3Fj7jhFoZKeuPRfTbJa/

This string of course has the number of rounds which can be passed to hashcat.

Royce Williams
  • 9,128
  • 1
  • 31
  • 55
user1720897
  • 603
  • 2
  • 10
  • 18

1 Answers1

4

Edit: I saw that you found your answer, but I'll add it here for completeness sake. (And I already had this written down).

Hashcat doesn't guess the # of rounds, and the amount of rounds specified in your /etc/login.defs isn't properly applied.

I took an example from my Linux box:

$6$elIIOT8d$lXVE7ZxTaBnvyi3kgrVGOpq.I/tQU9CN.G2FgpcjyxovibRB1TjDbk7NFkOwo7ySt.w8BwnacxQ0876/hz6l//

This is the same as:

$6$rounds=5000&elIIOT8d$lXVE7ZxTaBnvyi3kgrVGOpq.I/tQU9CN.G2FgpcjyxovibRB1TjDbk7NFkOwo7ySt.w8BwnacxQ0876/hz6l//

If the amount of rounds was properly set, you would see a different number instead of 5000 in the hash.

Linux

On my box running Kali Linux I was able to specify the number of rounds by going to the /etc/pam.d/common-password and finding the line (line 25 in my case):

password [success=1 default=ignore] pam_unix.so obscure sha512

I appended "rounds=1234" to it:

password [success=1 default=ignore] pam_unix.so obscure sha512 rounds=1234

saved and created a user:

$> adduser test3

And ended up with this in my /etc/shadow-file:

$>tail --lines=1 /etc/shadow

test3:$6$rounds=1234$SzWcxuIH$YX1QDmE1PG7grJ/4rJ8LkwggmEffoo9vUCuPAhL3x2sBQZJ8n2a2OeHpFEKaWDH2o.NGYwbLFZNabfOQlQuZ21:16627:0:99999:7:::

Hashcat

You can manually specify how many iterations Hashcat should do by appending rounds=[# of iterations] after the signature, e.g:

$6$rounds=5000&elIIOT8d$lXVE7ZxTaBnvyi3kgrVGOpq.I/tQU9CN.G2FgpcjyxovibRB1TjDbk7NFkOwo7ySt.w8BwnacxQ0876/hz6l//

This will, however, be automatically applied if the amount of rounds != 5000, in /etc/shadow

Community
  • 1
Mrtn
  • 1,274
  • 10
  • 18