john-users - Re: LM an NTLM combination

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / community lists wiki CVSweb mirrors signatures
bringing security into open environments

Order Openwall GNU/*/Linux 2.0 on a CD with delivery worldwide

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Wed, 07 Mar 2007 19:46:40 +0100
From: "Frank Dittrich" <frank_dittrich@...mail.com>
To: john-users@...ts.openwall.com
Subject: Re: LM an NTLM combination

Antares wrote:
>My first run found i.e. 1459 guesses (in 1 min, 10s)
>Invoking the very same command again (using by bash history) found another 
>65 guesses (in 1 min, 11s)
>
>How is that possible? Times are almost the same, by coincident?

Are the NTLM hashes case sensitive?
If so, the problem could be related to
http://thread.gmane.org/gmane.comp.security.openwall.john.user/50

Meaning: the passwords are the same as those cracked before.
But the corresponding hashes differ in case.
If you convert all your hashes to upper case,
the problem should disappear.

Even the correct solution has been discussed in that thread.
(A path in the split function, IIRC)

Regards, Frank

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today it's FREE! 
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

-- 
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.