Hi atom,
Great support!
First thing I noticed when you demonstrated the fix on your end is that you're using version 0.44 whereas I'm on 0.43. This may be of importance. Second, it looks like the high UTF-8 characters are the result of posting the hash to the forum. When comparing the fixed hash with the one I logged in the forum post, after copying and pasting the fixed one, an additional character is visible:
Original: $6$DNRlEKWm$tEcdDjEuxYJFaA41eq1Ro4SHot3ov3SHeLo4LQqKNtzjHCNExT5kED8KpIGzQZrt758sa/WwCnQsgRS80EHRT/
Fixed : $6$DNRlEKWm$tEcdDjEuxYJFaA41eq1Ro4SHot3ov3SHeLo4LQqKNtzjHCNExT5kED8KpIGzQZrt758s?a/WwCnQsgRS80EHRT/
From the forum post's HTML:
<blockquote><cite>Quote:</cite>$6$DNRlEKWm$tEcdDjEuxYJFaA41eq1Ro4SHot3ov3SHeLo4LQqKNtzjHCNExT5kED8KpIGzQZrt758s​a/WwCnQsgRS80EHRT/</blockquote>
this character was added: & # 8 2 0 3 ;​ between 's' and 'a'. This is probably from the high UTF-8 byte stream you noticed at offset 0x50: e280 8b.
Checking the data locally from file 'shadow-ubuntu-1-test-stripped.txt' with a hex editor:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 24 36 24 44 4E 52 6C 45 4B 57 6D 24 74 45 63 64 $6$DNRlEKWm$tEcd
00000010 44 6A 45 75 78 59 4A 46 61 41 34 31 65 71 31 52 DjEuxYJFaA41eq1R
00000020 6F 34 53 48 6F 74 33 6F 76 33 53 48 65 4C 6F 34 o4SHot3ov3SHeLo4
00000030 4C 51 71 4B 4E 74 7A 6A 48 43 4E 45 78 54 35 6B LQqKNtzjHCNExT5k
00000040 45 44 38 4B 70 49 47 7A 51 5A 72 74 37 35 38 73 ED8KpIGzQZrt758s
00000050 61 2F 57 77 43 6E 51 73 67 52 53 38 30 45 48 52 a/WwCnQsgRS80EHR
00000060 54 2F 0A T/.
shows no high UTF-8 characters at offset 0x50.
Just to make sure that I'm not messing up, I have triple-checked the hashes on ubuntu-1 using MD5 hashes:
root@ubuntu-1:/home/erwin/Documents/source/md5# ./md5 /etc/shadow
2F879E6B0665C70766EA4CEA10E70C0D /etc/shadow
E:\Temp\passwd>md5 shadow-ubuntu-1.txt
2F879E6B0665C70766EA4CEA10E70C0D shadow-ubuntu-1.txt (Original cut & paste generated file tested with when I reported the problem.)
E:\Temp\passwd>md5 shadow.copied
2F879E6B0665C70766EA4CEA10E70C0D shadow.copied (File copied from ubuntu-1 once more to triple check.)
Just to make absolutely sure that the hash is correct, here's the output of the grep command for user test:
root@ubuntu-1:~# grep test /etc/shadow
test:$6$DNRlEKWm$tEcdDjEuxYJFaA41eq1Ro4SHot3ov3SHeLo4LQqKNtzjHCNExT5kED8KpIGzQZrt758sa/WwCnQsgRS80EHRT/:15130:0:99999:7:::
I'm attaching my test files to this message so you can work with these if you like. I would appreciate it if you could look into it further. Also, I ran the command with the parameter format you suggested and it still didn't recognize the --hash-type option:
E:\Temp\passwd\hashcat-gui\hashcat-0.43>hashcat-cli32.exe --hash-type 1800 --attack-mode 0 ..\..\shadow-ubuntu-1-test.txt ..\..\wordlists\test-wordlist.txt
hashcat-cli32.exe: unknown option -- hash-type
Might I have a bad copy of hashcat? MD5 hash is below:
E:\Temp\passwd\hashcat-gui\hashcat-0.43>md5 hashcat-cli32.exe
6BEB279C2FBAF16D8E03C66EE9649300 hashcat-cli32.exe
OK, thanks for your help and look forward to reading your results.
P.S. Can't attach a file to my post:
Error Attaching File
The file upload failed. Please choose a valid file and try again. Error details: There was a problem moving the uploaded file to its destination.
Will try some other way: https://www.wetransfer.com/downloads/f74...756/61ecb5
Great support!
First thing I noticed when you demonstrated the fix on your end is that you're using version 0.44 whereas I'm on 0.43. This may be of importance. Second, it looks like the high UTF-8 characters are the result of posting the hash to the forum. When comparing the fixed hash with the one I logged in the forum post, after copying and pasting the fixed one, an additional character is visible:
Original: $6$DNRlEKWm$tEcdDjEuxYJFaA41eq1Ro4SHot3ov3SHeLo4LQqKNtzjHCNExT5kED8KpIGzQZrt758sa/WwCnQsgRS80EHRT/
Fixed : $6$DNRlEKWm$tEcdDjEuxYJFaA41eq1Ro4SHot3ov3SHeLo4LQqKNtzjHCNExT5kED8KpIGzQZrt758s?a/WwCnQsgRS80EHRT/
From the forum post's HTML:
<blockquote><cite>Quote:</cite>$6$DNRlEKWm$tEcdDjEuxYJFaA41eq1Ro4SHot3ov3SHeLo4LQqKNtzjHCNExT5kED8KpIGzQZrt758s​a/WwCnQsgRS80EHRT/</blockquote>
this character was added: & # 8 2 0 3 ;​ between 's' and 'a'. This is probably from the high UTF-8 byte stream you noticed at offset 0x50: e280 8b.
Checking the data locally from file 'shadow-ubuntu-1-test-stripped.txt' with a hex editor:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 24 36 24 44 4E 52 6C 45 4B 57 6D 24 74 45 63 64 $6$DNRlEKWm$tEcd
00000010 44 6A 45 75 78 59 4A 46 61 41 34 31 65 71 31 52 DjEuxYJFaA41eq1R
00000020 6F 34 53 48 6F 74 33 6F 76 33 53 48 65 4C 6F 34 o4SHot3ov3SHeLo4
00000030 4C 51 71 4B 4E 74 7A 6A 48 43 4E 45 78 54 35 6B LQqKNtzjHCNExT5k
00000040 45 44 38 4B 70 49 47 7A 51 5A 72 74 37 35 38 73 ED8KpIGzQZrt758s
00000050 61 2F 57 77 43 6E 51 73 67 52 53 38 30 45 48 52 a/WwCnQsgRS80EHR
00000060 54 2F 0A T/.
shows no high UTF-8 characters at offset 0x50.
Just to make sure that I'm not messing up, I have triple-checked the hashes on ubuntu-1 using MD5 hashes:
root@ubuntu-1:/home/erwin/Documents/source/md5# ./md5 /etc/shadow
2F879E6B0665C70766EA4CEA10E70C0D /etc/shadow
E:\Temp\passwd>md5 shadow-ubuntu-1.txt
2F879E6B0665C70766EA4CEA10E70C0D shadow-ubuntu-1.txt (Original cut & paste generated file tested with when I reported the problem.)
E:\Temp\passwd>md5 shadow.copied
2F879E6B0665C70766EA4CEA10E70C0D shadow.copied (File copied from ubuntu-1 once more to triple check.)
Just to make absolutely sure that the hash is correct, here's the output of the grep command for user test:
root@ubuntu-1:~# grep test /etc/shadow
test:$6$DNRlEKWm$tEcdDjEuxYJFaA41eq1Ro4SHot3ov3SHeLo4LQqKNtzjHCNExT5kED8KpIGzQZrt758sa/WwCnQsgRS80EHRT/:15130:0:99999:7:::
I'm attaching my test files to this message so you can work with these if you like. I would appreciate it if you could look into it further. Also, I ran the command with the parameter format you suggested and it still didn't recognize the --hash-type option:
E:\Temp\passwd\hashcat-gui\hashcat-0.43>hashcat-cli32.exe --hash-type 1800 --attack-mode 0 ..\..\shadow-ubuntu-1-test.txt ..\..\wordlists\test-wordlist.txt
hashcat-cli32.exe: unknown option -- hash-type
Might I have a bad copy of hashcat? MD5 hash is below:
E:\Temp\passwd\hashcat-gui\hashcat-0.43>md5 hashcat-cli32.exe
6BEB279C2FBAF16D8E03C66EE9649300 hashcat-cli32.exe
OK, thanks for your help and look forward to reading your results.
P.S. Can't attach a file to my post:
Error Attaching File
The file upload failed. Please choose a valid file and try again. Error details: There was a problem moving the uploaded file to its destination.
Will try some other way: https://www.wetransfer.com/downloads/f74...756/61ecb5