Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 22 Jan 2010 01:25:19 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Revisit of: --make-charset against a File with LANMAN and NTLM Passes?

On Thu, Jan 21, 2010 at 04:01:44PM -0600, Minga Minga wrote:
> Discussed here;
> http://marc.info/?l=john-users&m=123811421820149

More specifically:
http://www.openwall.com/lists/john-users/2009/03/28/3

> The solution was:
> 
> "Oh, you're correct.  In version 1.7.3.1-all-5, patch line 66 in
> options.c removing (or commenting out) "FLG_MAKECHR_CHK | ", and
> recompile.  Then the above command will work as intended (I've just
> tested it)."

Not exactly "the solution", but a workaround for your specific problem.
It also has a drawback (mentioned in the posting I referenced above).

> The latest version (with jumbo patch) of options.c is:
> 
> {"make-charset", FLG_MAKECHR_SET, FLG_MAKECHR_CHK,
> 0, FLG_CRACKING_CHK | FLG_SESSION | OPT_REQ_PARAM,
> OPT_FMT_STR_ALLOC, &options.charset},
> 
> Removing the string "FLG_MAKECHR_CHK |" no longer appears to
> be a valid fix.

You're looking at (and editing) the wrong place.  In fact, there's no
string "FLG_MAKECHR_CHK |" in the piece you quoted above, so I have no
idea how you can be removing that string.

Line 66 in options.c in 1.7.3.1 with the jumbo patch is within the
definition of "format", not "make-charset":

	{"format", FLG_FORMAT, FLG_FORMAT,
		0, /* not FLG_CRACKING_SUP to allow "--show --format=nt" */
		FLG_MAKECHR_CHK | FLG_STDOUT | OPT_REQ_PARAM,
		OPT_FMT_STR_ALLOC, &options.format},

This remained the same in the current version, but the line to edit is
now line 85 (in 1.7.4.2-jumbo-1).

> Is there a new 'fix' that can be used so that --make-chars can be run
> against an input file both lanman and NTLM hashes - in order to create
> a custom .chr file that contains upper and lower case options ?

Yes, please see above.  With the change, you should be able to use
"--format=nt" along with "--make-charset", which will make JtR filter
the john.pot entries based on the file(s)' NTLM rather than LM hashes.

Alexander

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.