john-users - Multiple guesses for cracked hashes and no working password

[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 12 Feb 2010 14:19:58 -0800
From: Anton <support3@...cast.net>
To: john-users@...ts.openwall.com
Subject: Multiple guesses for cracked hashes and no working password

Greetings,

I'm new to john and password recovering in general. I can not make out any
useful info out of the john guessed passwords, passwords provided are not
the one.
I need help understanding john's output and what is useful to me or what can
be ignored. Any input is greatly appriciated!
I've been learning on one of the Active Directory users.
I'm using John 1.7.0.1.
I am experimenting with the hash obtained from Windows 2003 DC. I used
pwddump to get the hashes.
The hashes look like this:
dar:1721:FBF279AE7CE2A2C197B57AF6F22B:A6D16E79FADB4A41E6DCBF387BEFC998:::
dar_history_0:172:879D21AEE0D96D88A3CF696C1:81297B5EDEA2A476F9CC9648D11E4360:::
dar_history_1:172:CBA33CD49AC21AA818381E4E281B:616A2901AC5A8C6ECFB8053289154A74:::
dar_history_2:172:C2C909A0DC09752A3293831D17:F694B8886C9997BB03BAB24656E014F2:::
dar_history_3:172:8F08A7A82292EAC541D19BC1646:B8018CE8E825756FE457C7A894B273CE:::
dar_history_4:172:2CEA139AA23AF651CA7A0DE4F362:2178C3041EA0EC17FACDA3AFF892CEA5:::
dar_history_5:172:2CEA139AA23AF651CA7A0DE4F362:2178C3041EA0EC17FACDA3AFF892CEA5:::
dar_history_6:172:9C9252BB08F5CB83B6B8F1BF552:697FEBA983C2C96E0982071AFED50431:::
dar_history_7:172:EA139AA23AF651CA7A0DE4F362:2178C3041EA0EC17FACDA3AFF892CEA5:::
dar_history_8:172:D0CF8F8740458666776101C2:37CB08DD45E5C53734AEDF915B3BB23A:::
When john was done with these, i got multiple password guesses, all appeared
in upper case (by design?):
C:\downloads\tmp\john1701\run>john-mmx emg1.txt
Loaded 20 password hashes with no different salts (NT LM DES [64/64 BS MMX])
3                (dar:2)
09               (dar:2)
009              (dar:2)
9                (dar:2)
983              (dar:2)
983              (dar:2)
983              (dar:2)
MAGANOV          (dar:1)
RODITEL          (dar:1)
A#1              (dar:2)
OME123           (dar:2)
IEDUT!           (dar:2)
SOLNCE1          (dar:1)
SOLNCE1          (dar:1)
SOLNCE1          (dar:1)
VESNA20          (dar:1)
guesses: 16  time: 0:00:15:18 (3)  c/s: 87730K  trying: DR926T7 - DR926AA
IAMAWES          (dar:1)
LETO200          (dar:1)
OSEN198          (dar:1)
guesses: 19  time: 0:00:22:34 (3)  c/s: 67330K  trying: C2MHJG3 - C2MRANZ
guesses: 19  time: 0:00:44:37 (3)  c/s: 40347K  trying: V8WLFO3 - V8WLFR0
guesses: 19  time: 0:00:55:52 (3)  c/s: 34860K  trying: Z1SYC0G - Z1SYCN2
RAZVOD2          (dar:1)
guesses: 20  time: 0:02:20:57 (3)  c/s: 18674K  trying: RAZVO9W - RAZVOK3

Now, if i used only the first hash
(dar:1721:FBF279AE7CE2A2C197B57AF6F22B:A6D16E79FADB4A41E6DCBF387BEFC998:::)
, not the history one, i got this:

\john1701\run>john-mmx.exe 1.txt
Loaded 1 password hash (NT LM DES [64/64 BS MMX])
IAMAWES          (dar:1)
guesses: 1  time: 0:00:19:08 (3)  c/s: 10216K  trying: IAMAWT! - IAMAWHY

-- 
Kind Regards, Anton