EPiServer hash format

[thorsheim]

It looks like that in the JtR source is somehow different to your expectation. I guess the algorithm changed in the meanwhile.

• Inside the JtR source it says the salt length is of fixed size 30 (binary).
  
• Your base64 encoded example salt decodes to a salt of length 16 (binary)?
  
• JtR expects an hex format, not base64.
  

This is from JtR source with their values and it works:

root@ht:~/oclHashcat-plus-0.08# perl -e 'print "\x5F\x1D\x84\xA6\xDE\x97\xE2\xBE\xFB\x63\x7A\x3C\xB5\x31\x8A\xFE\xF0\x75\x0B\x85\x6C\xF1\x83\x6B\xD1\xD4\x47\x01\x75Abc.!23\x00"' | sha1sum
4d5efdfa143edf74193076f174ac47cebf2f417f -

I played a bit with your Base64 values:

Hash: UQgnz/vPWap9UeD8Dhaw3h/fgFA= -> 510827cffbcf59aa7d51e0fc0e16b0de1fdf8050
Salt: fGJ2wn/5WlzqQoDeCA2kXA== -> 7c6276c27ff95a5cea4280de080aa45c

root@ht:~/oclHashcat-plus-0.08# perl -e 'print "\x7c\x62\x76\xc2\x7f\xf9\x5a\x5c\xea\x42\x80\xde\x08\x0a\xa4\x5ctestPassword"' | sha1sum
3e0f809853d3fbdf392a2959ccf803ee6312d401 -

... does not match, so i tried original algorithm:

root@ht:~/oclHashcat-plus-0.08# perl -e 'print "\x7c\x62\x76\xc2\x7f\xf9\x5a\x5c\xea\x42\x80\xde\x08\x0a\xa4testPassword\x00"' | sha1sum
988c21fec2c4fd168201bba7b7ec4f266a270ecd -

... still does not match

Without the exact algorithm I cant do anything, sorry

Hm. Well, I will spend some time looking for the answers to this little puzzle. I'm pretty sure it can be found somewhere inside the episerver documentation, second I'll ask some other friends in crypto to have a look at it. :-)

I'll get back as soon as I have something more useful. Thx atom!