Date: Tue, 27 Mar 2007 05:34:23 +0400 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Re: No hash? On Mon, Mar 26, 2007 at 09:54:37AM +0200, Oliver Völker wrote: > (I've x-ed a part of my password) Yet it might be cracked based on the information that you did post - the partial LM hash and the full NTLM hash. > I've tried to get the password for the testaccount of my wife.... but > john only gets the following: > > D:\Temp\Passwort\john1701\run>john-mmx test.txt > Loaded 2 password hashes with no different salts (NT LM DES [64/64 BS MMX]) > guesses: 0 time: 0:01:58:38 (3) c/s: 11867K trying: Z9M7IMY - Z9M7IUG > RSUFHXZ (Hilfeassistent:2) > guesses: 1 time: 1:02:35:26 (3) c/s: 8246K trying: X_X&#RV - X_X&#O- ... > UB(4XDT (Hilfeassistent:1) > guesses: 2 time: 3:01:07:24 (3) c/s: 6918K trying: UB(4XR - UB(4XDQ > > Why doesn't it show the other password? What other password? The reason it loaded only two LM hash halves is that you probably already have the rest of them cracked. John's output while it's cracking is to report its progress only. It does not always contain all of the cracked passwords. It will not contain passwords cracked in previous sessions, and, depending on cracking mode, it might also not contain any duplicate passwords (when two users have the same password or, in case of LM hashes, the same 7-character password part). To obtain the complete list of cracked accounts, you should use the "--show" option: john-mmx --show test.txt > If I copy the line with Martinas account in a seperate file john shows > me: > > D:\Temp\Passwort\john1701\run>john-mmx martina.txt > No password hashes loaded This confirms that those hashes have already been cracked. In fact, this is one of possible answers given to this question on the FAQ: Q: Why doesn't John load my password file? It says "No password hashes loaded". ... A: All of the password hashes found in the file (that John recognizes as such) might be already cracked by previous invocations of John. -- Alexander Peslyak <solar at openwall.com> GPG key ID: 5B341F15 fp: B3FB 63F4 D7A3 BCCC 6F6E FC55 A2FC 027C 5B34 1F15 http://www.openwall.com - bringing security into open computing environments Was I helpful? Please give your feedback here: http://rate.affero.net/solar -- To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Powered by Openwall GNU/*/Linux - Powered by OpenVZ