+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Support (https://hashcat.net/forum/forum-3.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-45.html)
+--- Thread: Help with md5(md5($pass.$salt_1).$salt_2) (/thread-9556.html)
Help with md5(md5($pass.$salt_1).$salt_2) - Zeheson - 10-09-2020
Greetings!
So, as the title says, I have a few hashes which are hashed with two different salts using md5.
Having md5(md5($pass.$salt_1).$salt_2), the hashes list that I have are ordered like:
md5_innerHash.$salt_2
Where $salt_1 is the service's salt and is a static one (28 chars length) defined in a config file, and $salt_2 is a randomly generated hash.
Does hashcat supports this? If so, I would be grateful if someone could guide me towards an answer.
Thanks!
RE: Help with md5(md5($pass.$salt_1).$salt_2) - DanielG - 10-09-2020
If I read this correctly it seems you have the value of md5_innerHash? then you would only need to brute force md5($pass.$salt_1) right? And do you know $salt_1?
Or do you only have outer hash?
RE: Help with md5(md5($pass.$salt_1).$salt_2) - philsmd - 10-09-2020
I think -m 2611 or -m 2612 could help here, but you need to append $salt_1 to the password manually, i.e. you construct the password by combining the password and $salt_1 with either rules or fixed strings in masks etc
I think length 28 salt shouldn't be the problem, neither for 2611, nor for 2612 .
Another problem is that md5(md5 ()) is sometimes misleading.... there are at least 2 variants... the md5 hash could be used in binary form or converted to hex e.g. md5_hex (md5_hex (....)) or md5_hex (md5_bin (...)) ... they of course give very different results and therefore it's always good to get the algorithm right and be very specific about the details of how the hashes are generated
RE: Help with md5(md5($pass.$salt_1).$salt_2) - Zeheson - 10-11-2020
(10-09-2020, 08:43 AM)DanielG Wrote: If I read this correctly it seems you have the value of md5_innerHash? then you would only need to brute force md5($pass.$salt_1) right? And do you know $salt_1?
Or do you only have outer hash?
Luckily I have both salts, so I need to brute force md5($pass.$salt_1) and then brute force that result with $salt_2. Hope I made myself more clear.
RE: Help with md5(md5($pass.$salt_1).$salt_2) - Zeheson - 10-11-2020
(10-09-2020, 09:14 AM)philsmd Wrote: I think -m 2611 or -m 2612 could help here, but you need to append $salt_1 to the password manually, i.e. you construct the password by combining the password and $salt_1 with either rules or fixed strings in masks etc
I think length 28 salt shouldn't be the problem, neither for 2611, nor for 2612 .
Another problem is that md5(md5 ()) is sometimes misleading.... there are at least 2 variants... the md5 hash could be used in binary form or converted to hex e.g. md5_hex (md5_hex (....)) or md5_hex (md5_bin (...)) ... they of course give very different results and therefore it's always good to get the algorithm right and be very specific about the details of how the hashes are generated
Thanks, gonna try this as soon as I can!
RE: Help with md5(md5($pass.$salt_1).$salt_2) - philsmd - 10-11-2020
no, this is not how it works, you can't brute-force 16 random bytes. You need to apply the full algorithm to your input.
so while -m 2611 is md5 (md5 ($pass) . $salt)
you use a hash list with
hash:$salt_2
and manually construct $pass to be your password candidate concatenated with the $salt_1
of course best or user-fiendliest would be if hashcat would support the whole algorithm with hash:$salt1:$salt2 format, but this is not currently supported and also makes little sense because very few applications use this algo (as far as I know)