Thank you for all your help, it's appreciated!
Adding $1$ to the hashes before running JtR works perfect, just didn't know
that you had to do that (but I should probably have been able to guess that
by looking at /etc/shadow or such).
Cheers,
Alexander
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com] On
Behalf Of razi garbie
Sent: den 18 april 2008 08:44
To: Alexander Sandström Krantz A
Cc: pen-test@securityfocus.com
Subject: Re: Extreme Networks password hash
Hey,
I do recognize the hash but cant point out which it is..
However, you could try john the ripper against it, in most cases JTR tells
you what hash is used.
// Good luck, RG
2008/4/17, Alexander Sandström Krantz A
<alexander.a.sandstrom.krantz@ericsson.com>:
Hi!
I'm interested in finding out what kind of hash Extremeware (v 7.7)
uses to encrypt user passwords. The reason is that I'm trying to find
out how to perform a (dictionary or bruteforce) password attack
against an Extreme Networks switch. I could use Medusa or THC-Hydra
to perform a remote attack, but I would like to avoid it if it's not
necessary because of the performance drawbacks.
I've read through the documentation provided by Extreme, but found
nothing. I know that to set up the admin account with an empty
password, and create an account "user", also with an empty password,
the following configuration is
used:
---------------------------------------
configure account admin encrypted
452tVo$nEbHpfJFTUGyBrqmtY8q3.
452tVo$nEbHpfJFTUGyBrqmtY8q3.
create account user "user" encrypted "yN/tVo$ARBcY8KlQBq.lvJg2nc5F."
--------------------------------------
As these commands contain different hashes, even though both users
are given emtpy passwords, I guess the hash is salted. From the
length I also guess that it's SHA224, but that is a complete guess as I
really have no idea.
Does anyone know about the kind of hash used, or recognize the ones
in the configuration? If you do, would you happen to know any tool
that can perform an attack against this kind of hash?
Cheers,
Alexander
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!
http://www.cenzic.com/downloads
------------------------------------------------------------------------
smime.p7s
Description: S/MIME cryptographic signature
