The DMZ - 2011-11-13

« first day (332 days earlier) ← previous day next day → last day (4846 days later) »

Scott Pack

00:00

@Ninefingers I've done a full install of it. In the lab.

Iszi

00:15

@ScottPack 99, yeah.

@ScottPack Not using it as a tool to learn Linux, though that'll probably be a side effect as well. It's part of the CPT practical exam.

@Ninefingers Downloaded the latest Ubuntu for that.

1 hour later…

Scott Pack

01:18

CPT?

Hendrik Brummermann

Urks, the ruby and the java implementation of bcrypt are incompatible.

Is "my grand secret" -> "$2a$10$GtKs1Kbsig8ULHZzO1h2TetZfhO4Fmlxphp8bVKnUlZCBYYClPohG" correct?

That's from bcrypt-ruby.rubyforge.org/classes/BCrypt/Password.html but the java implementation says it is invalid.

Scott Pack

Are you generating user passwords?

Hendrik Brummermann

I am adding bcrypt support to an application.

But there does not seems to be a test suite for it. The java port of bcrypt can verify its own hashes, but not the one i found on the ruby page.

Iszi

@ScottPack Certified Penetration Tester

Scott Pack

Yeah, that makes sense from context.

@HendrikBrummermann Have you tried it unsalted?

Or, rather, have you tried an unsalted hash?

Hendrik Brummermann

01:34

The salt is an essential part of a bcrypt hash.

The Java code passes the .NET test suite.

Scott Pack

Can you generate an unsalted bcrypt hash?

Hendrik Brummermann

I blame ruby. The example in the ruby brcrypt README file works, too.

So I hope they have messed something up on their webpage.

@ScottPack I don't think there is a an unsalted hash in bcrypt. The salt has a fixed length and there is no delimiter between the salt and the result of the hash.

Scott Pack

Hm.

The hash you pasted above is a unix password hash with the 2nd field being the salt. Which is an optional field.

Hendrik Brummermann

2a is bcrypt, I don't think unix supports that.

My /etc/shadow only has 5 and 6 which is SHA-256 and SHA-512 respectivly.

Scott Pack

That hash is 2a, which is blowfish

Which is supported, so long as your glibc supports it.

So bcrypt == blowfish ?

Hendrik Brummermann

01:50

blowfish is an encryption algorithm, bcrypt is a hash function which is derived from it and designed for password hasing.

Putting either $2a$06$If6bvum7DFjUnE9p2uDeDu0YHzrHM6tf.iqN8.yx.jNN1ILEf7h0i or the broken one from above into my shadow file does not work.

This one is from a test suite for .NET, which works with the Java port, too.

Scott Pack

The fact that it doesn't work doesn't really surprise me. It's not in the mainline glibc, but the man page says that some distributions patch it in.

2 hours later…

Iszi

04:22

@ScottPack You still alive in here?

3 hours later…

AviD

07:51

@Ninefingers funny you should ask... asked him for more precise definition, and his answer: "he should know how to write process monitor"

of course they are not developing THAT, but the same skill set to write that kind of software

I assume you are up to that task?

(btw process monitor, he's referring to MS/sysinternals tool, not a general monitor counter...)

1 hour later…

AviD

08:59

user image

6 hours later…

Scott Pack

14:43

@Iszi I was probably asleep by that time. What's up?

Scott Pack

15:04

So, I'm noticing that my stats on the /review page aren't updating at all. Anyone know anything about that?

3 hours later…

Iszi

17:48

@ScottPack Was going to ask something about passing parameters through aliases, but Google tells me it's not doable.

Ended up figuring another way to get what I wanted out of the alias, and then some, without doing that anyway.

Scott Pack

18:07

Yeah, your best option is to just write a function

Iszi

I went with an alias that got me a bit more information than I was wanting, but with a name that reflects that. So, it's not so bad.

alias myips="ifconfig | grep 'inet addr' | cut -d ':' -f2 | cut -d ' ' -f1"

Scott Pack

ew

Iszi

@ScottPack What's "ew"? a five-letter alias that lists all the IPv4 addresses on the box?

(without any other fluff)

Scott Pack

It just looks nasty.

Iszi

@ScottPack I'm sure I could've done plenty worse.

Scott Pack

18:19

Well, that's weird. The man page for ifconfig on Fedora 15 says that it's obsolete

Iszi

Hm

What, you were hoping to find a less-emo way to do it?

Scott Pack

I was starting to work on cleaning it up, when I noticed that.

Do you care about v6?

Iszi

@ScottPack Not really at this point

Scott Pack

ip addr | awk '/inet / {print $2}'

Bam!

Iszi

Hence my use of grep 'inet addr' instead of just grep inet

Oh hey! CIDR subnet masks with that one, too!

Scott Pack

18:22

Yeah, I thought that was nice too.

Iszi

Didn't know about the ip addr command, and I'm only barely aware of awk.

Scott Pack

Change that to '/inet/ to get the ipv6 addresses as well.

Iszi

So... let me make sure I'm reading this right...

Scott Pack

I ended up learning awk instead of cut. Which worked out to be nice later on when I realized that most of the time I was just piping grep into awk.

So by putting the regex directly into awk it removed a step.

Iszi

You're running the ip addr command and passing it to awk obviously.

Then, awk looks for "inet " and prints the second word off of that line?

@ScottPack Ah, but that means learning regexes. I'm not quite to that level yet.

Scott Pack

18:26

More specifically, prints the second field where space is the default field delimiter, but yeah.

Iszi

@ScottPack By "default" I presume you mean that's alterable?

Scott Pack

While /inet / is technically a regex, from a practical standpoint it's just a string.

Indeed.

So, let's re-write that to use ifconfig.

Iszi

So, if I really didn't care about the CIDR, I'd tell awk to use ":" as a delimiter and run ifconfig instead.

Scott Pack

ifconfig | awk '/inet addr/ {print $2}' | awk -F: '{print $2}'

Iszi

@ScottPack That... doesn't look right.

Scott Pack

18:29

Which part?

Iszi

I mean, it obviously works...

It just seems that one of those awks is superfluous.

Scott Pack

So you're thinking that you can just split on ':' on the first one?

Iszi

@ScottPack It would seem you should be able to.

Scott Pack

You can only split on one string at a time

So, move the -F: to the first one and see what happens

Iszi

@ScottPack Yeah, that was... odd. I think there may be some order to the parameters.

And that was even weirder.

First I tried ifconfig | awk '/inet addr/ -F: '{print $2}'. That dropped me to some sort of blank command prompt.

Scott Pack

18:35

Well, you got two problems there

Let me back up.

awk is a programming language used for text processing.

Iszi

I tried ifconfig | awk -F: '/inet addr/ {print $2}' and it gave me the IP and the next word.

Scott Pack

So, the line, /inet addr/ {print $2} is really just code that awk is interpreting.

Iszi

Apparently, when you set a delimiter, it's ignoring the default delimiter altogether.

Scott Pack

The -F is an argument to the application itself, not part of the code.

Right, you're changing the delimiter.

Iszi

So, can you specify multiple delimiters?

Scott Pack

18:37

The blank command line you got is part of bash, not awk.

@Iszi To the best of my knowledge no.

There are thousands, of people out there that know way more about awk than I do. So if one of them shows me how, I'll change my mind.

Chore time. Gotta run

Check out this page

pement.org/awk/awk1line.txt

It could be way over your head right now, or it could help you learn the kinds of things you can do.

« first day (332 days earlier) ← previous day next day → last day (4846 days later) »

Transcript for

Nov '1113

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2025 Stack Exchange Inc; legal

mobile