john-users - Re: Question With Windows password hash decryption

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 23 Sep 2005 10:44:45 +0000
From: zak@...is.com
To: john-users@...ts.openwall.com
Subject: Re: Question With Windows password hash decryption


-----Original Message-----
From: Nicolas Goles [mailto:goles@....net]
Sent: Sunday, August 28, 2005 11:44 AM
To: john-users@...ts.openwall.com
Subject: [john-users] Question With Windows password hash decryption

hi, I am trying to decript some windows 2000 sp4 pass, it is like this 

7FC0E1D29E0F3B56AAD3B435B51404EE:BD2D42EB21E94D859CB757112AFAD7ED:::


I know that the password of that file is = "4028" (no quotes )


The thing is , that if I make a wordlist and put 4028 , as a password, its not working, it doesn't detect it as a valid password


So ok , I though I had to install some patch to JTR , and I downloaded this:


Windows NT/2000/XP/2003 NTLM (MD4) hash support for 1.6.36+, by Olle Segerdahl


I downloaded latest version of JTR ( http://www.openwall.com/john/c/john-1.6.38.tar.gz ) sources only...


uncompressed the windows MD4 hash support file , and found john-ntlm-v03.diff


I put "john-ntlm-v03.diff" in src directory , and tried to apply the patch like


$patch < john-ntlm-v03.diff


patching file JOHN-NTLM-FAQ
patching file Makefile
Hunk #1 succeeded at 28 (offset 1 line).
patching file NT_fmt.c
patching file byteorder.h
patching file john.c
patching file loader.c
patching file md4.c
patching file options.c
Hunk #2 FAILED at 101.
1 out of 2 hunks FAILED -- saving rejects to file options.c.rej
patching file smbencrypt.c






So I failed , I went to my options.c.rej file and this is what I got 




***************
*** 101,107 ****
 "--salts=[-]COUNT load salts with[out] at least COUNT passwords " \
 "only\n" \
 "--format=NAME force ciphertext format NAME " \
- "(DES/BSDI/MD5/BF/AFS/LM)\n" \
 "--save-memory=LEVEL enable memory saving, at LEVEL 1..3\n"

 void opt_init(int argc, char **argv)
--- 101,107 ----
 "--salts=[-]COUNT load salts with[out] at least COUNT passwords " \
 "only\n" \
 "--format=NAME force ciphertext format NAME " \
+ "(DES/BSDI/MD5/BF/AFS/LM/NT)\n" \
 "--save-memory=LEVEL enable memory saving, at LEVEL 1..3\n"

 void opt_init(int argc, char **argv)








What I am doing wrong??? How can I make JTR to detect my windows password ??? Thanks!

______________________________________________________________________________________________________
hi,
 some versions JTR software is design to inject bugs into your computer. i suggest that you get the version released before the latest.
this will help. if this doesn;t work try decrypting the password again :perhaps you got it wrong...