0

As an exercise we need to reverse a SHA-1 to get the 'original' message.

All we know is that the lowercase SHA-1 of the code gives:

B39ECFBC2C64ADBB7C7A9292EEE31794D28FE224

And, the SHA-1 of the case sensitive code should be:

0D353038908AD0FC8C51A5312BB3E2FEE1CDDF83

And, the broken original message (letters can be upper or lowercase):

HV15-G.UJ-1.Q7-DYC2-WLRE-6..J

So, my question is, how can I reverse the hashes to get the full original message?

Any tips for me?

Improve this question
4
  • probably brute force
    – ratchet freak
    Commented Dec 9, 2015 at 15:29
  • I think there needs to be an other way :/
    – Ihara
    Commented Dec 9, 2015 at 15:33
  • 1
    This question should be asked on Crypto SE... You should have more accurate answers.
    – perror
    Commented Dec 9, 2015 at 15:38
  • 1
    If there are only 4 missing letters (in the dots) then you can brute force the lowercase one with at max (36^4 = ) 1.6 million guesses
    – ratchet freak
    Commented Dec 9, 2015 at 15:38

1 Answer 1

Reset to default
0

By design, SHA-1 can't be reversed.

The best approach would be to brute-force the lowercase version, and then once you've found the missing characters, use them to brute-force the case-sensitive version.

However, according to oclhashcat, there's no solution to this. See below:

C:\>oclHashcat64.exe -m 100 -a 3 -1 ?l?d B39ECFBC2C64ADBB7C7A9292EEE31794D28FE224 hv15-g?1uj-1?1q7-dyc2-wlre-6?1?1j
oclHashcat v2.00 starting...

Device #1: Hawaii, 4096MB, 947Mhz, 40MCU

Hashes: 1 hashes; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Applicable Optimizers:
* Zero-Byte
* Precompute-Init
* Precompute-Merkle-Demgard
* Early-Skip
* Not-Salted
* Not-Iterated
* Single-Hash
* Single-Salt
* Brute-Force
* Scalar-Mode
* Raw-Hash
Watchdog: Temperature abort trigger set to 90c
Watchdog: Temperature retain trigger set to 80c
Device #1: Kernel ./kernels/4098/m00100_a3.Hawaii_1912.5_1912.5 (VM)_1449240640.kernel (196520 bytes)
Device #1: Kernel ./kernels/4098/markov_be_v1.Hawaii_1912.5_1912.5 (VM)_1449240640.kernel (36168 bytes)


INFO: approaching final keyspace, workload adjusted


Session.Name...: oclHashcat
Status.........: Exhausted
Input.Mode.....: Mask (hv15-g?1uj-1?1q7-dyc2-wlre-6?1?1j) [29]
Hash.Target....: b39ecfbc2c64adbb7c7a9292eee31794d28fe224
Hash.Type......: SHA1
Time.Started...: 0 secs
Time.Estimated.: 0 secs
Speed.GPU.#1...:   106.5 MH/s
Recovered......: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.......: 1679616/1679616 (100.00%)
Rejected.......: 0/1679616 (0.00%)
HWMon.GPU.#1...: 19% Util, 53c Temp, 40% Fan

Started: Wed Dec 09 10:18:50 2015
Stopped: Wed Dec 09 10:18:52 2015
Improve this answer
4
  • is there a way to give oclhashcat the original code in order to use it for the bruteforce?
    – Ihara
    Commented Dec 9, 2015 at 15:44
  • Yes, see my updated answer above.
    – Jason Geffner
    Commented Dec 9, 2015 at 16:20
  • hm strange, maybe I messed something up with the original message, since we got it as an audio
    – Ihara
    Commented Dec 9, 2015 at 16:32
  • On the bright side, now you know how to crack it, and you also see how fast brute-force can be for this scenario -- less than 2 seconds of processing! :)
    – Jason Geffner
    Commented Dec 9, 2015 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.