john-users - Charset problem with special characters

Openwall wordlists collection for password cracking (20+ languages)
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 28 Apr 2010 17:08:55 +0200
From: Pablo Catalina Gómez <pcatalina@...sec.com>
To: john-users@...ts.openwall.com
Subject: Charset problem with special characters

Hello,

I compile john-1.7.5 with the jumbo-patch-3, and I'm trying to crack LM
or NTLM hashes with special characters like ñ or ç. Spanish uses these
characters a lot.
But when I try to use a dictionary or make-charset using a spanish
dictionary, john doesn't look up the passwords with these characters.

For example:
portal:10561:F27D23D3E93C31DC364B0DFC3955A01C:305A42A96D4DF77C1F0434F63A28239A:::

The password is "contraseña" (without quotes)

If I create a UTF-8, ISO8859-1 or ISO8859-15 with these content word :
contraseña, john doesn't find the password.

I don't know if it's a problem. What can I do to solve the problem?

These is an example:

$ file ../../portal.pwdump
../../portal.pwdump: ASCII text, with CRLF line terminators
$ cat ../../portal.pwdump 
portal:10561:F27D23D3E93C31DC364B0DFC3955A01C:305A42A96D4DF77C1F0434F63A28239A:::

$ file dict-iso8859-1 dict-iso8859-15 dict-UTF8
dict-iso8859-1:  ISO-8859 text
dict-iso8859-15: ISO-8859 text
dict-UTF8:       UTF-8 Unicode text
$ cat dict-iso8859-1
contrase�a
CONTRAS
E�A
$ cat dict-iso8859-15
contrase�a
CONTRAS
E�A
$ cat dict-UTF8
contraseña
CONTRAS
EÑA



$ ./john --wordlist=dict-iso8859-1 --format:LM ../../portal.pwdump 
Loaded 2 password hashes with no different salts (LM DES [128/128 BS SSE2-16])
CONTRAS          (portal:1)
guesses: 1  time: 0:00:00:00 100.00% (ETA: Wed Apr 28 17:03:10 2010)  c/s: 100  trying: CONTRAS - E�A
$ ./john --wordlist=dict-iso8859-15 --format:LM ../../portal.pwdump 
Loaded 1 password hash (LM DES [128/128 BS SSE2-16])
guesses: 0  time: 0:00:00:00 100.00% (ETA: Wed Apr 28 17:03:16 2010)  c/s: 27.27  trying: CONTRAS - E�A
$ ./john --wordlist=dict-UTF8 --format:LM ../../portal.pwdump 
Loaded 1 password hash (LM DES [128/128 BS SSE2-16])
guesses: 0  time: 0:00:00:00 100.00% (ETA: Wed Apr 28 17:03:25 2010)  c/s: 23.07  trying: CONTRAS - EÑA
$ ./john --show --format:LM ../../portal.pwdump 
portal:CONTRAS???????:10561:::

1 password hash cracked, 1 left



$ ./john --wordlist=dict-iso8859-1 --format:NT ../../portal.pwdump 
Loaded 1 password hash (NT MD4 [128/128 X2 SSE2-16])
guesses: 0  time: 0:00:00:00 100.00% (ETA: Wed Apr 28 17:05:30 2010)  c/s: 42.85  trying: contrase�a - E�A
$ ./john --wordlist=dict-iso8859-15 --format:NT ../../portal.pwdump 
Loaded 1 password hash (NT MD4 [128/128 X2 SSE2-16])
guesses: 0  time: 0:00:00:00 100.00% (ETA: Wed Apr 28 17:05:34 2010)  c/s: 20.00  trying: contrase�a - E�A
$ ./john --wordlist=dict-UTF8 --format:NT ../../portal.pwdump 
Loaded 1 password hash (NT MD4 [128/128 X2 SSE2-16])
guesses: 0  time: 0:00:00:00 100.00% (ETA: Wed Apr 28 17:05:40 2010)  c/s: 150  trying: contraseña - EÑA
$ ./john --show --format:NT ../../portal.pwdump 
0 password hashes cracked, 1 left





[ CONTENT OF TYPE text/html SKIPPED ]

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]