Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I am trying to get access to my eReader and I managed to get the passwd file.

root:$1$hdhxObPx$TYFuTKsB9GGIgo53rF4bi1:0:0:root:/:/bin/sh
bin:*:1:1:bin:/bin:
daemon:*:2:2:daemon:/sbin:
nobody:*:99:99:Nobody:/:
s3c2440x::507:507:root:/:/bin/sh

I expected to see a standard hash string there or just "x" but this reminds me of something I have seen in MySQL databases, can anyone point me in the right direction please? What am I looking at?

share|improve this question
1  
This question on U&L might help, too: unix.stackexchange.com/questions/8229/… –  Ninefingers Jun 18 '12 at 18:30
    
Thanks for the useful link. –  mistrfu Jun 18 '12 at 18:44
add comment

1 Answer 1

up vote 5 down vote accepted

Crypt based password hashes have several parts separated by $

  • The hash type, 1 in your case, this stands for MD5-crypt (this is not plain MD5)
  • The salt, hdhxObPx in your case
  • The actual hash TYFuTKsB9GGIgo53rF4bi1 in your case
  • Some schemes have additional parameters, such as a work-factor, but this does not apply to the scheme used in your example.

The MD5-Crypt scheme should be avoided, in favor of modern schemes, such as bcrypt (usually starting with $2a$). Not because MD5 is cryptographically broken, but because it has a constant work-factor, that's too small for the computational power modern attackers can field.

Check out crypt (C) on Wikipedia for further information.

share|improve this answer
    
Thank you so much for a very quick answer! –  mistrfu Jun 18 '12 at 18:40
    
"First the passphrase and salt are hashed together, yielding an MD5 message digest. Then a new digest is constructed, hashing together the passphrase, the salt, and the first digest, all in a rather complex form. Then this digest is passed through a thousand iterations of a function which rehashes it together with the passphrase and salt in a manner that varies between rounds. The output of the last of these rounds is the resulting passphrase hash." means I should probably look for a different vector af attack, right? –  mistrfu Jun 18 '12 at 18:50
    
The standard attack vector is guessing the password. Since GPUs are fast, you can use many password candidates. –  CodesInChaos Jun 18 '12 at 19:05
    
I have John running already, with default settings and only slightly larger dictionary. This is not something I normally do that's why I don't really understand it. I just need to get in so I can install my own OS on it and make the device usable. I only have a laptop, without decent GPU. –  mistrfu Jun 18 '12 at 19:52
    
+1. Recently people at Wikipedia shuffled things around. Is crypt (C) on Wikipedia what this answer ought to link to? –  David Cary Aug 4 '13 at 0:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.