Help with 7500 Kerberos 5 AS-REQ Pre-Auth

[atom]

Hey, first of all, the example works fine:

Code:

root@ht:~/oclHashcat-1.20# cat > hash
$krb5pa$23$user$realm$salt$4e751db65422b2117f7eac7b721932dc8aa0d9966785ecd958f971f622bf5c42dc0c70b532363138363631363132333238383835
root@ht:~/oclHashcat-1.20# ./oclHashcat64.bin -m 7500 hash -a 3 hashcat --quiet --potfile-disable
$krb5pa$23$user$realm$salt$4e751db65422b2117f7eac7b721932dc8aa0d9966785ecd958f971f622bf5c42dc0c70b532363138363631363132333238383835:hashcat

Now, get ready for the mad part, expect the unexpected!

In your post, I don't know how you do copy/paste, but is an invisible character. When I tried to reproduce your hash I got the following (note, that is with your hash from your post):

Code:

root@ht:~/oclHashcat-1.20# cat > hash
$krb5pa$23$user$realm$salt$4e751db65422b2117f7eac7b721932dc8aa0d9966785ecd958f97​1f622bf5c42dc0c70b532363138363631363132333238383835
root@ht:~/oclHashcat-1.20# ./oclHashcat64.bin -m 7500 hash -a 3 hashcat --quiet --potfile-disable
WARNING: Hashfile 'hash' in line 1 ($krb5pa$23$user$realm$salt$4e751db65422b2117f7eac7b721932dc8aa0d9966785ecd958f97​1f622bf5c42dc0c70b532363138363631363132333238383835): Salt-length exception

Beside, this is a salt-length exception, not a line-length exception. However, that was strange since that matches the hashcat example hash so it should work.

After I played around a bit with it I found the root of the problem when doing an hex dump:

Code:

root@ht:~/oclHashcat-1.20# xxd hash
0000000: 246b 7262 3570 6124 3233 2475 7365 7224  $krb5pa$23$user$
0000010: 7265 616c 6d24 7361 6c74 2434 6537 3531  realm$salt$4e751
0000020: 6462 3635 3432 3262 3231 3137 6637 6561  db65422b2117f7ea
0000030: 6337 6237 3231 3933 3264 6338 6161 3064  c7b721932dc8aa0d
0000040: 3939 3636 3738 3565 6364 3935 3866 3937  9966785ecd958f97
0000050: e280 8b31 6636 3232 6266 3563 3432 6463  ...1f622bf5c42dc
0000060: 3063 3730 6235 3332 3336 3331 3338 3336  0c70b53236313836
0000070: 3336 3331 3336 3331 3332 3333 3332 3338  3631363132333238
0000080: 3338 3338 3335 0a                        383835.

Take a close look at offset 0x50. I guess you have a different problem here...