Dealing with eCryptfs hash with default Salt (CVE 2014-9687)
#2
Ok gus, after some researches I found much better solution: using /etc/shadow and /etc/passwd files. If you currently updated your root/$USERpasswords, you can get copy from /etc/shadow- and /etc/passwd-. Using thes both files for particular username, for example "bob", extract and execute unshadow passwd shadow > unshadowed.txt
This line contains SHA-512 (5000 times hashed) password. Use hashcat or john to obtain the real pwd Smile for example hashcat -m 1800 or john unshadowed.txt.

According https://gist.github.com/Chick3nman/e4fce...2106d73fef using 3090:

Hashmode: 1800 - sha512crypt $6$, SHA512 (Unix) (Iterations: 5000)
Speed.#1.........: 469.5 kH/s (70.69ms) @ Accel:8 Loops:256 Thr:1024 Vec:1
vs
Hashmode: 12200 - eCryptfs (Iterations: 65536)
Speed.#1.........: 45432 H/s (57.60ms) @ Accel:2 Loops:1024 Thr:1024 Vec:1

Also, 469.500 H/s vs 45.432 H/s -> factor 10 !! Cheers Smile
Reply


Messages In This Thread
RE: Dealing with eCryptfs hash with default Salt (CVE 2014-9687) - by DLo - 09-18-2022, 09:02 PM