john-users - Re: NTLM cracking

Openwall wordlists collection for password cracking (20+ languages)

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 12 Feb 2010 19:56:02 -0600
From: Minga Minga <mingakore@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: NTLM cracking

Replying again...  I figured it out ;)

This is what is wrong with your pwdump file:

You had:

dar_history_3:172:8F08A7A82292EAC541D19BC1646:B8018CE8E825756FE457C7A894B273CE:::
It needs to be:
dar_history_3:172:B5CC08F08A7A82292EAC541D19BC1646:B8018CE8E825756FE457C7A894B273CE:::

Notice the addition of B5CC0 at the beginning. I have NO idea why this
got deleted!?!?

with my version of 'john' it NOW cracks with NTLM

# ./john --rules:nt -w:a.dic --format:nt pwfile
Loaded 1 password hash (NT MD4 [128/128 X2 SSE2-16])
Vesna2009        (dar_history_3)

Re-check your input file for the deletion of characters.

-Minga