[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 30 Aug 2008 07:19:04 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: duplicate guesses with 1.7.3.1-all-2 jumbo patch
On Fri, Aug 29, 2008 at 04:37:09PM -0400, Adam Turk wrote:
> #./john hashes.txt
I sure hope you're not running JtR as root. It does not require root
privileges (after you have possibly obtained the shadow file as root).
> Loaded 6 password hashes with no different salts (LM DES [64/64 BS MMX])
> BB (b)
> A (a)
> TESTTES (Administrator:1)
> CDC (c)
> DEDE (d)
...
> The NT hash works fine now, but the NTLM hash still reports 6 hashes loaded
Everything is correct here. (Well, except that it's "LM hash", not
"NTLM hash" as you said, that "still reports 6 hashes loaded" for you.)
One of your passwords is longer than 7 characters, so it corresponds to
two LM hash halves, which are being loaded and cracked independently.
This is addressed in the FAQ as follows:
Q: I have 10 users, but John said it loaded 15 password hashes. What's
going on?
A: Some extremely poorly designed hash types (Windows LM hashes and
double-length DES-based crypt(3) hashes also known as "bigcrypt" or
"crypt16") have a property that allows John to split their encodings
into two separate hashes (corresponding to halves of plaintext
passwords) on load. John then proceeds to crack those hashes
separately, so at a given time it might have only one of two halves of
some passwords cracked. If interrupted and restarted, it would need to
only load the hashes which correspond to uncracked password halves, so
the number of such hashes is what John reports (in all cases, for
consistency).
> and won't stop.
This means that it did not try the candidate password "T", which would
correspond to the remaining LM hash half. I'm not sure why that is the
case for you - have you customized john.conf in some way, or are you
passing command-line options not shown above?
It works fine for me (with a linux-x86-mmx build of
1.7.3.1-all-2-lpsfix1, which I assume is what you're testing):
Loaded 6 password hashes with no different salts (LM DES [64/64 BS MMX])
BB (b)
A (a)
TESTTES (Administrator:1)
T (Administrator:2)
CDC (c)
DEDE (d)
guesses: 6 time: 0:00:00:01 (3) c/s: 386173 trying: DOON - DEDE
Note that it has to get to "pass 3" (the "(3)" on the status line),
which is "incremental" mode. If you have specified a large wordlist,
then it might take a lot longer for JtR to get to "incremental" mode.
To obtain all of the cracked passwords, with the halves combined, the
"--show" option must be used. It reports:
Administrator:TESTTEST:0:::
a:A:1:::
b:BB:2:::
c:CDC:3:::
d:DEDE:4:::
6 password hashes cracked, 0 left
In fact, you must always use "--show", including with other hash types,
to ensure you obtain all of the cracked passwords. Although JtR also
prints successful guesses while it is running, there's no guarantee that
it will print all of them. In many cases, it does not even load
previously-cracked and duplicate hashes (if you have any in your input
files) for cracking, yet it will correctly report them with "--show".
Alexander
--
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
