Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 5 Nov 2008 14:36:41 -0500
From: Adam Turk <>
To: <>
Subject: RE: ntlm and lm hashes questions

> I have a Windows hash output file that contains some lm hashes and
> some ntlm hashes.  Not every user has an lm hash so I would like to
> crack ntlm hashes when lm hashes are not present.  I applied the
> ntlm-alainesp patch to John so I can crack ntlm hashes when need be.
> From what I can tell, if I don't specify the format John only attempts
> the lm hashes.  Is this correct?  

> Is there a way to have it crack the
> ntlm if no lm is present or will I need to run the processes
> separately, once with the format=LM and then once with format=NT using
> the cut field delimited method listed on the "uppercase only thread" -
Having john trying to crack NTLM and LM hashes is good in theory but
will have a negative impact on performance.

For best results you will have to run a john process on two separate 
PCs (one for LM hashes and one for NTLM) or use a PC with a duo or 
quad core processor.

Stay up to date on your PC, the Web, and your mobile phone with Windows Live
To unsubscribe, e-mail and reply
to the automated confirmation request that will be sent to you.

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ