Date: Wed, 07 Mar 2007 15:52:20 +0100 From: antares <antares@....ch> To: john-users@...ts.openwall.com Subject: Re: LM an NTLM combination > Please try with the older NTLM patch that > is a part of the jumbo patch - > > http://www.openwall.com/john/contrib/john-1.7.2-all-2.diff.gz > > and let the list know of your results. This time, using the jumbo patch, subsequent executions did NOT lead to new guesses, as it should be. :) Conclusion: Wordlist out of the LM pot with "--show | cut -d: -f2 > wordlist" (unsorted, not unique, with unfinished "passwords" (unknown letters presented by "?")) wordlist length: 2227 lines smooth would be: 1628 lines (with "tr A-Z a-z < wordlist | sort -u > smooth) But in order to be comparable to the original situation, I did not use "smooth" but "wordlist" in all runs. The state before the first run was: -same wordlist and passwd files -no john.pot, john.log, john.rec in the directory "john-1-7-2" with "john-1.7.2-ntlm-alainesp-4.diff" First run: 1459 guesses Second run: 65 guesses Third run: 0 guesses Some more: 0 guesses "john-1-7-2" with "john-1.7.2-all-2.diff.gz" First run: 1546 guesses Second run: 0 guesses Some more: 0 guesses There may be really a bug... interesting is also, that the jumbo patch lead to 22 guesses in addition to the sum of the first and second run with the ntlm patch. > ...although 1 minute feels a > bit excessive - what hardware are you on, how many cracked LM hashes do > you have in your john.pot? I use an aged P4 2 GHz for testing... And another instance of john is running on the LM hashes (and some calculation for my thesis too) So the time is not very meaningful... Thank you and kind regards antares -- To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Powered by Openwall GNU/*/Linux - Powered by OpenVZ