Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 1 Sep 2005 18:24:53 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Question With Windows password hash decryption

Hi Nicolas,

On Sun, Aug 28, 2005 at 11:44:45AM -0400, Nicolas Goles wrote:
> hi, I am trying to decript some windows 2000 sp4 pass, it is like this
> 
> 7FC0E1D29E0F3B56AAD3B435B51404EE:BD2D42EB21E94D859CB757112AFAD7ED:::

When cracking Windows passwords, John the Ripper expects password files
in PWDUMP output format.  This would be:

login-name:NT-hash:LM-hash:other-fields

What you have above is:

LM-hash:NT-hash:other-fields

Converting this to the proper format, we get:

user:BD2D42EB21E94D859CB757112AFAD7ED:7FC0E1D29E0F3B56AAD3B435B51404EE

(notice that I've swapped the two hashes).

> I know that the password of that file is = "4028"  (no quotes )

Correct - and John cracks it within seconds when run on the line above.

$ john pw-goles-lm 
Loaded 1 password hash (NT LM DES [64/64 BS MMX])
4028             (user)
guesses: 1  time: 0:00:00:05 (3)  c/s: 254700  trying: 4025 - 403D

> The thing is , that if I make a wordlist and put 4028 , as a  
> password,  its not working,  it doesn't detect it as a valid password

That's because you had the input file in the wrong format.  If you would
simply run John on the line you've posted, John would misinterpret the
LM hash as the login name and obviously not crack it.

> So ok , I though I had to install some patch to JTR , and I  
> downloaded this:
> 
> Windows NT/2000/XP/2003 NTLM (MD4) hash support for 1.6.36+, by Olle  
> Segerdahl

You didn't have to use this, although it would also happen to get the
password cracked.

> I downloaded latest version of JTR (  http://www.openwall.com/john/c/ 
> john-1.6.38.tar.gz )   sources only...
> 
> uncompressed the windows MD4 hash support file , and found john-ntlm- 
> v03.diff
> 
> I put "john-ntlm-v03.diff" in src directory , and tried to apply the  
> patch like
> 
> $patch < john-ntlm-v03.diff
> 
> patching file JOHN-NTLM-FAQ
> patching file Makefile
> Hunk #1 succeeded at 28 (offset 1 line).
> patching file NT_fmt.c
> patching file byteorder.h
> patching file john.c
> patching file loader.c
> patching file md4.c
> patching file options.c
> Hunk #2 FAILED at 101.
> 1 out of 2 hunks FAILED -- saving rejects to file options.c.rej
> patching file smbencrypt.c

Well, you're using a patch for 1.6.36 on 1.6.38.  Your options would be:

- patch options.c manually, or

- ignore this rejection since it is truly unimportant, or

- download 1.6.36 off the FTP (which holds all the previous versions)
and patch and use that.

> So I failed , I went to my options.c.rej file and this is what I got
[...]
> -     "(DES/BSDI/MD5/BF/AFS/LM)\n" \
[...]
> +     "(DES/BSDI/MD5/BF/AFS/LM/NT)\n" \

So the only hunk that failed to apply had to do with the usage message:
trivial to fix by hand and safe to ignore.

> What I am doing wrong???

Quite a few things, including typing multiple question marks. ;-)

-- 
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598  fp: 6429 0D7E F130 C13E C929  6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments

Was I helpful?  Please give your feedback here: http://rate.affero.net/solar

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ