[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 07 Mar 2007 16:15:09 +0100
From: antares <antares@....ch>
To: john-users@...ts.openwall.com
Subject: Re: LM an NTLM combination
Oh, the last two messages were "crossing" each other...
Here the commands I used
(How I "produced" the word list is explained in the other message)
./john -w=wordlist -rules -format=NT passwd > FirstRun
guesses: 1459 time: 0:00:01:10 100% c/s: 330221K trying: 3230
PASSWORD hashes cracke
./john -w=wordlist -rules -format=NT passwd > SecondRun
guesses: 54 time: 0:00:01:15 100% c/s: 223027K trying: 3230 PASSWORD
hashes cracke
(Note: the missing "d" in the word "cracke" is real, no copy paste error)
---FirstRun-----------------------------------------------------------
Loaded 2127 password hashes with no different salts (NT MD4 [Rapid NT MD4])
password1 (username1)
password2 (usernane2)
(...)
password1459 (username1459)
----------------------------------------------------------------------
---SecondRun-----------------------------------------------------------
Loaded 668 password hashes with no different salts (NT MD4 [Rapid NT MD4])
password1 (username1)
password2 (usernane2)
(...)
password54 (username54)
----------------------------------------------------------------------
The problem is well reproducible here. I think this is due to the
different word list we use, especially due to the fact that my word list
originates from an unfinished pot file, leading maybe to some kind of
string which are of more offense to the ntlm patch than to the jumbo
patch. However I can only speculate since I am a poor programmer...
Thank again
antares
Solar Designer wrote:
> Antares,
>
>> On Wed, Mar 07, 2007 at 12:03:42PM +0100, Antares wrote:
>>> My first run found i.e. 1459 guesses (in 1 min, 10s)
>>> Invoking the very same command again (using by bash history) found
>>> another 65 guesses (in 1 min, 11s)
>
> I wrote:
>> This sounds like a bug, and I suspect the new NTLM patch - it has not
>> been tested extensively yet.
>
> Well, I am not able to reproduce the problem, albeit with fewer NTLM
> hashes. In addition to trying out the older NTLM patch, please also
> post the exact shell commands that you run and parts of their output
> (the "Loaded ..." and status lines).
>
>> ... 1 minute feels a bit excessive ...
>
> Actually, no, my testing suggests that it's about right.
>
> Thanks,
>
--
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
