1

I've been working on the pset2 hacker problem and decided to decompose a problem by creating subtasks. Anyway, the first part was to simply compare two crypted strings (at the moment, just one letter strings crypted using crypt) using strcmp, but it does not seem to work for some reason. Anyway, the key is 'a' and I made a loop around printable characters, but for some reason the strcmp works oddly with the codes (gives that crypted strings are equal when they are not). I've also been thinking about how to approach the "immutability of strings" and the overall changing the length of the string problem and I have a weird idea, that might work, but I am certain that some have created better solutions, so I'd be grateful if you could share.

Any other tips on this segment would also be appreciated! Thanks a lot!

string key = "a";
    string salt = "50";
    char test[2];
    string coded = crypt(key, salt);
    printf("%s\n", coded);
    int result;
    for (char i = 'B'; i <= 'z'; i++)
    {
        test[0] = (char)i;
        test[1] = '\0';
        result = strcmp(coded, crypt(test,salt));

        printf("%i\n", strcmp(coded, crypt(test,salt)));
        if (result == 0)
        {
            printf("%s\n", crypt(test,salt));
            for (int j = 0, n = strlen(test); j < n; j++)
            {
                printf("%c", test[j]);
            }
            printf("\n");
            break;
        }
    }

// results 
50OqznXGVcOJU
0
506AM4LYuoGsQ
B

1 Answer 1

4

If you read the man page of the crypt function it says in one point:

The return value points to static data whose content is overwritten by each call.

So the first time you call crypt, and assign its return value (which is a pointer to a string) to the coded variable, the coded variable contains the correct encrypted password. But the next time you call crypt, using 'B' as a parameter, the coded variable changes too, because the string where its pointer is pointing has changed to the new encrypted password, and therefore when you compare the two strings, they are the same. If you want to make your program work, you should "save" the first returned string to a new string, and then compare the new encrypted string to the saved one. See bellow:

char coded[14];
char* key = "a";
char* salt = "50";
char test[2];
strcpy(coded, crypt(key, salt));
int result;
for (int i = 'A'; i <= 'z'; i++)
{
    test[0] = (char) i;
    test[1] = '\0';
    result = strcmp(coded, crypt(test,salt));
    if (result == 0)
    {
        printf("%s\n", test);
    }
}
return 0;

It gives the result:

a

Great question! Had me searching for half an hour!

4
  • 1
    Thank you so much!!! I've been working on this for a while, and got completely lost, but I am more than eager to do this thing :) Jul 16, 2015 at 12:37
  • You can mark the answer as accepted! Have a nice day!
    – ChrisG
    Jul 16, 2015 at 12:38
  • Thanks, you too! I just wanted to see opinions on dealing with the length of strings - I wanted to deal with the fact that the length of the password can be from 1 to 8. So my idea was to create something like an array of numbers (by casting to int and char repeatedly) that would go from the first ASCII code to the last. I would start with length 1, and change the letter. When I reach the last possibility ("~"), I wanted to use "%" and "/" to reset the current letter to the beginning, and add to the next letter +1 and increase the length so to say. Does that sound sane to you? :) Jul 16, 2015 at 12:51
  • What you describe is called a brute force attack and even though the passwords have a maximum length of 8, the possibilities are too too many for your computer to calculate. You should probably try a dictionary attack instead. The brute force method is definitely going to find the password eventually but it won't happen in less than a day (trust me I tried :P)
    – ChrisG
    Jul 16, 2015 at 12:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .