Hash Prestashop

[hashnoob]

Hi everyone,

I'm trying to crack a md5 password. This password is salted with a key and is encrypted like this : md5($salt.$password).

I'm using this command to decode it :

C:\Users\florentroche66\Downloads\hashcat-0.49\hashcat-0.49>hashcat-cli64.exe -m20 -a 3 test.hash.txt -o result.txt ?l?l?l?l

in test.hash.txt i put :
d653ea7ea31e77b41041e7e3d32e3e4a:k8k8yBEO7bXXjjRH9BoKTojYIA1dNmHDaKiC3sfGRp8eNORfW3joAA3c

The encoded password i'm trying to decode is "test".

"k8k8yBEO7bXXjjRH9BoKTojYIA1dNmHDaKiC3sfGRp8eNORfW3joAA3c" is a typical salt used in prestashop, it's always that long !

The problem i have is that when i press enter, i have this error :

Initializing hashcat v0.49 with 8 threads and 32mb segment-size...

Skipping line: d653ea7ea31e77b41041e7e3d32e3e4a:k8k8yBEO7bXXjjRH9BoKTojYIA1dNmHD
aKiC3sfGRp8eNORfW3joAA3c (line length exception)
No hashes loaded

I'm pretty sure i have this error because the salt is too long. But all prestashop salts are that long, is there a way to increase the acceptable size length so i can try to decode prestashop passwords


Thanks for your help

[atom]

It's good you've add the plaintext of the password, otherwise you'd have been banned now

To your question, yes it's the salt length. I've never heard before of Prestashop, is it popular?

[hashnoob]

Hey, thanks for your answer, and for not having me banned

To answer your question, prestashop is actually a pretty popular CMS for ecommerce as you can see there : http://blog.aheadworks.com/2014/10/e-com...ober-2014/

it's mostly used in Europe, especially in France where it represents almost 50% of all ecommerce websites.

I'm sorry if i look like i'm trying to sell it lol

Knowing that, is there a way to achieve my goal ?

[philsmd]

Seems interesting.

Devs need to add a special hash format for this one, since the salt+password is too long for a single md5 transform.
Could you please add a trac ticket ( https://hashcat.net/trac/ ) with the details about this hash algorithm. Additional info that might be required would for example be, are there limits for minimum/maximum salt length, password length etc.
(maybe also link to source code if open source etc)

Thx

[hashnoob]

All right, i've done so : https://hashcat.net/trac/ticket/589

Thanks

[andreihash]

Hey! I just tried doing the EXACT same thing today, and I've been trying to figure it out for a few hours now... just to find this dead end ¬_¬

should I open a ticket if I have the absolute exact request? should I provide my salt and a hash or two, as another example, here in the thread?

also, what is the max lenght for the password, for, say, a simple md5 hash? could we simply make a mask containing a known 56-character long salt, glued to, say, 5 wildcards, and try for a simple md5 format, rather than md5($salt.$pass) ?

note: if it isn't completely obvious, I just started using hashcat recently, sorry for any stupid things I say.

[atom]

no you can not do that as md5 works blockwise. you have to do a new round of transformation for each 64 bytes (and the last one only 55 bytes). therefore it requires a new kernel

[philsmd]

There is some good news here, the new hash type -m 11000 = PrestaShop made it to cpu hashcat already (beta!), oclHashcat support will follow.

But let me use this opportunity for a big Warning for forum user hashnoob (which according to the rules https://hashcat.net/forum/announcement-2.html should already be banned).
The example hash (which you should not have posted at all without explicit request from a moderator), is furthermore a fake/invalid hash. The proof:
$ echo -n salttest | md5sum
d653ea7ea31e77b41041e7e3d32e3e4a

So basically here the salt is "salt" and not k8k8yBEO7bXXjjRH9BoKTojYIA1dNmHDaKiC3sfGRp8eNOR​fW3joAA3c since md5 ("salttest") == d653ea7ea31e77b41041e7e3d32e3e4a

This is not really what devs (and mods) want to see here. Wrong/fake hash examples do not necessarily help the devs much in implementing the algorithm!

[hashnoob]

Hi, well, i'm sorry for my first post. I understand that i should'nt have posted the hash, and that
i should have been more carefull while making the hash (it was actually an "inadvertent error " since i wasn't trying to fool anyone, i guess i was doing too many things the same time )

Anyway, thank you for being kind enough no to ban me and for your very quick answer to all my requests.