john-users - Re: --make-charset against a File with LANMAN and NTLM Passes?

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Fri, 27 Mar 2009 12:34:15 -0500
From: Minga Minga <mingakore@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: --make-charset against a File with LANMAN and NTLM 
	Passes?

>
> If your build of JtR supports NTLM, then try adding "--format=nt" to the
> above command.
>

Tried that first. Doesn't work.

./john --make-chars:adsfdsaf.chr --format:nt pwdump.txt
Invalid options combination or duplicate option: "--format:nt"

> If your build of JtR doesn't support NTLM or/and you don't mind JtR
> picking up all hashes at once (not just NTLM and not just those from the
> specific password file), then simply omit the password file name - keep
> "--make-charset=..." as the only command-line option you pass.
>

I was trying to create a custom CHR for just this one pwdump input file. My
john.pot file contains almost 2 million entries of which only 35000 are for
my input file. I was hoping to create a .CHR that eliminates special
characters that are "never" used by the people on this domain. In an effort
to speed up brute forcing. I can do it manually obviously though.

> Please let the list know which of these approaches (or another one) you
> ended up using, and whether it worked.
>

Neither. I can make a list of characters that are NOT used in any of my
passwords I have cracked so far - and make those be SKIPPED in the DumbForce
method. Not sure if that is really worth it to me at this point, but it
should work. It appears that DumbForce is faster than  using --external AND
an -i:all6   anyways (see below)

-----------------

Also: as per our previous emails I tried:

./john --external:6plus2008 --format:nt -i:All6 pwdump.txt

AND

./john --format:nt -external:DumbForce-All6plus2008 pwdump.txt

Both of which try 6 characters of ALL possibilities - then add 2008 so the
end. (aaaaaa2008 aaaaab2008 !!!!!!2008 etc)

-external:DumbForce-All6plus2008 - ended in 16 hours.
But
-external:6plus2008  with -i:All6 is still going at 24+ hours.

     Example: guesses: 2  time: 1:00:25:30  c/s: 59115M  trying: cy,xl{2008
- cy,xJ{2008

Looks like DumbForce wins the speed game.

-Minga