Help needed for identifying the hash type

[andiaa734]

Hi there,

i need a little bit help identifying the hash type:

$6CJlS7VEVeK2:1:0:99999:7:::

JtR says it is (descrypt, traditional crypt(3) [DES 128/128 SSE2-16]

Running hashcat with -m 1500 ends up with Token length exception.

Any help would be appreciated.

[b8vr]

You need to remove everything after and including the first : as that is JtR style and not hashcat style. I'm a bit unsure of the leading $...... See mode 1500 to see how it should be formatted for hashcat:
https://hashcat.net/wiki/doku.php?id=example_hashes

[andiaa734]

You need to remove everything after and including the first : as that is JtR style and not hashcat style. I'm a bit unsure of the leading $...... See mode 1500 to see how it should be formatted for hashcat:
https://hashcat.net/wiki/doku.php?id=example_hashes

Thanky you. But I'm still getting Token length exception.

I have tried: $6CJlS7VEVeK2:0,  6CJlS7VEVeK2:0

6CJlS7VEVeK2: results in Token encoding exception

The Hash is from a system using little endian. can this be the reason?

[b8vr]

Removing everything after and including the first : gives 
$6CJlS7VEVeK2
Hashcat thinks that everything after the first : is the hash.
You should've looked at the link I provided.

[andiaa734]

Removing everything after and including the first : gives 
$6CJlS7VEVeK2
Hashcat thinks that everything after the first : is the hash.
You should've looked at the link I provided.

Oh, sorry. I misunderstood that. Okay, now i tried this but now im getting Token encoding exception?

[Snoopy]

first of all, the starting $6 and the rest seems more to look like a typical mode 1800 -> sha512crypt $6$, SHA512 (Unix) taken from a linux shadow file (but malformed)

example entry from a typical shadow file without any data

Code:

nobody:*:18375:0:99999:7:::

as you can see the  99999:7::: part is quite obvious

so in my opinion this is something taken from a shadow file and has nothing to to with DES as DES has to be of length 13

[andiaa734]

first of all, the starting $6 and the rest seems more to look like a typical mode 1800 -> sha512crypt $6$, SHA512 (Unix) taken from a linux shadow file (but malformed)

example entry from a typical shadow file without any data

Code:

nobody:*:18375:0:99999:7:::

as you can see the  99999:7::: part is quite obvious

so in my opinion this is something taken from a shadow file and has nothing to to with DES as DES has to be of length 13

You are right. it is taken from a shadow file. After unsahdow it looks like this:
root:$6CJlS7VEVeK2:0:0:root:/:/bin/sh

But it doesn't makes it easier. I start to believe that the shadow file was somehow modified.

[Snoopy]

first of all, the starting $6 and the rest seems more to look like a typical mode 1800 -> sha512crypt $6$, SHA512 (Unix) taken from a linux shadow file (but malformed)

example entry from a typical shadow file without any data

Code:

nobody:*:18375:0:99999:7:::

as you can see the  99999:7::: part is quite obvious

so in my opinion this is something taken from a shadow file and has nothing to to with DES as DES has to be of length 13

You are right. it is taken from a shadow file. After unsahdow it looks like this:
root:$6CJlS7VEVeK2:0:0:root:/:/bin/sh

But it doesn't makes it easier. I start to believe that the shadow file was somehow modified.

this entry on the other hand looks like taken from a passwd file (this is where the login shells are stored) see -> /bin/sh 

but i also never saw an entry like that before, looks like some weird kind of malformed merge between a shadow and a passwd file, do you know what kind of linux distribution this was taken from?

anyways this hash entry is way to short and you will not be able to recover a pass from that