Is it a md5 colision ? - Printable Version

Is it a md5 colision ? - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Deprecated; Previous versions (https://hashcat.net/forum/forum-29.html)
+--- Forum: General Help (https://hashcat.net/forum/forum-8.html)
+--- Thread: Is it a md5 colision ? (/thread-2228.html)

Pages: 1 2

Is it a md5 colision ? - Mem5 - 04-12-2013

Hi,

Quote:md5("elec@") = 7863783c727bc742d503f232f277e327

But hashcat find me :

Quote:9a214e678ed4e501d1576326ce84b41c:elec@

What is it ?!

RE: Is it a md5 colision ? - atom - 04-12-2013

Note for me:

Code:
root@sf:~/hashcat-0.45# ./hashcat-cliXOP.bin hash dict

Initializing hashcat v0.45 by atom with 8 threads and 32mb segment-size...

Added hashes from file hash: 1 (1 salts)

Activating quick-digest mode for single-hash

NOTE: press enter for status-screen

7863783c727bc742d503f232f277e327:elec@

All hashes have been recovered

Maybe you're using an old version?

RE: Is it a md5 colision ? - Mem5 - 04-13-2013

Interesting behaviour !

md5.txt contains :

Quote:9a214e678ed4e501d1576326ce84b41c
7863783c727bc742d503f232f277e327

dict.txt contains :

Quote:elec@

Quote:>oclHashcat-plus64.exe md5.txt dict.txt

oclHashcat-plus v0.14 by atom starting...
...
7863783c727bc742d503f232f277e327:elec@
...
Recovered......: 1/2 (50.00%) Digests, 0/1 (0.00%) Salts

OK.

When adding rules file :

Quote:>oclHashcat-plus64.exe md5.txt dict.txt -r rules.rule
...
9a214e678ed4e501d1576326ce84b41c:elec@
7863783c727bc742d503f232f277e327:elec@
...
Recovered......: 2/2 (100.00%) Digests, 1/1 (100.00%) Salts

I guess there is a bug regarding to the rules file ?

@atom : if you confirm the bug I'll send you my rules file.

RE: Is it a md5 colision ? - eljolot - 04-13-2013

also not for me

Code:
Recovered.: 1/2 hashes, 0/1 salts

Speed/sec.: - plains, - words

Progress..: 1/1 (100.00%)

Running...: --:--:--:--

Estimated.: --:--:--:--

RE: Is it a md5 colision ? - Mem5 - 04-13-2013

(04-13-2013, 08:03 PM)eljolot Wrote: also not for me

You do not have my rules file !

RE: Is it a md5 colision ? - Incisive - 04-14-2013

Set --outfile-format=7 (or whatever the hashcat CLI version of that argument is) and see if the hex versions of the passwords are identical; perhaps there's a nonprintable character in one or the other of them. Alternately, perhaps one of the characters isn't what it appears - some non-English speaking countries have a habit of high ASCII 1337 speak.

The 78... is the basic "elec@" md5 value.

RE: Is it a md5 colision ? - Mem5 - 04-14-2013

outfile-format=7 gives :

9a214e678ed4e501d1576326ce84b41c:elec@:656c656340
7863783c727bc742d503f232f277e327:elec@:656c656340

RE: Is it a md5 colision ? - philsmd - 04-14-2013

I would suggest you reduce your rule file to the bare minimum needed to reproduce this behaviour and post the few lines here.
As far as I understood, it could be a "bug" regarding the rules !?

RE: Is it a md5 colision ? - Mem5 - 04-14-2013

I did it.
Here is the rule file that cause this bug (2 rules) :

Quote::
'6

So first one does nothing, second one truncates word at position (here) 6.

Quote:>oclHashcat-plus64.exe md5.txt dict.txt -r 2rules.rule
oclHashcat-plus v0.14 by atom starting...

Hashes: 2 total, 1 unique salts, 2 unique digests
Bitmaps: 8 bits, 256 entries, 0x000000ff mask, 1024 bytes
Rules: 2
Workload: 256 loops, 80 accel
Watchdog: Temperature abort trigger disabled
Watchdog: Temperature retain trigger disabled
Device #1: Cypress, 1024MB, 850Mhz, 20MCU
Device #1: Kernel oclHashcat-plus-0.14/kernels/4098/m0000_a0.Cypress_1084.4_1084.4 (VM).kernel (1109768 bytes)

Cache-hit dictionary stats dict.txt: 5 bytes, 1 words, 2 keyspace

NOTE: autotuned --gpu-accel from 80 to 8

9a214e678ed4e501d1576326ce84b41c:elec@
7863783c727bc742d503f232f277e327:elec@

Session.Name...: oclHashcat-plus
Status.........: Cracked
Rules.Type.....: File (2rules.rule)
Input.Mode.....: File (dict.txt)
Hash.Target....: File (md5.txt)
Hash.Type......: MD5
Time.Started...: Sun Apr 14 11:36:52 2013 (1 sec)
Speed.GPU.#1...: 0/s
Recovered......: 2/2 (100.00%) Digests, 1/1 (100.00%) Salts
Progress.......: 2/2 (100.00%)
Rejected.......: 0/2 (0.00%)

RE: Is it a md5 colision ? - philsmd - 04-14-2013

Mystery solved!
Try:

Code:
echo  -en "elec@\00"|md5sum

9a214e678ed4e501d1576326ce84b41c *-

So the string terminator \0 is included into the "search string" when the 'x rule has a length of strlen(dict_entry)+1 e.g. strlen(elec@)+1 == 6 in your case.

Code:
$ cat 2rules.rule

:

'9

$ cat dict.txt

philsmd@

$ cat md5.txt # X MASKED

8e640164e8e1XXXX38d9ffb03b451XXX

5b370275e1bbXXXX24f89024bd8f5XXX

$ cudaHashcat-plus32.exe md5.txt dict.txt -r 2rules.rule

cudaHashcat-plus v0.15 by atom starting...

Hashes: 2 total, 1 unique salts, 2 unique digests

Bitmaps: 8 bits, 256 entries, 0x000000ff mask, 1024 bytes

Rules: 2

Workload: 256 loops, 80 accel

Watchdog: Temperature abort trigger set to 90c

Watchdog: Temperature retain trigger set to 80c

Device #1: GeForce GTX 580, 3072MB, 1682Mhz, 16MCU

Device #1: Kernel ./kernels/4318/m0000_a0.sm_20.32.ptx

Generated dictionary stats for dict.txt: 9 bytes, 1 words, 2 keyspace

NOTE: autotuned --gpu-accel from 80 to 1

8e640164e8e1XXXX38d9ffb03b451XXX:philsmd@

5b370275e1bbXXXX24f89024bd8f5XXX:philsmd@

Session.Name...: cudaHashcat-plus

Status.........: Cracked

Rules.Type.....: File (2rules.rule)

Input.Mode.....: File (dict.txt)

Hash.Target....: File (md5.txt)

Hash.Type......: MD5

Time.Started...: Sun Apr 14 12:24:32 2013 (2 secs)

Speed.GPU.#1...:        0/s

Recovered......: 2/2 (100.00%) Digests, 1/1 (100.00%) Salts

Progress.......: 2/2 (100.00%)

Rejected.......: 0/2 (0.00%)

HWMon.GPU.#1...:  0% Util, 53c Temp, 1830rpm Fan

Started: Sun Apr 14 12:24:32 2013

Stopped: Sun Apr 14 12:24:35 2013

Note: the second one was generated via:

Code:
echo -en "philsmd@\00"|md5sum