john-users - Jumbo patch breaks "--users=<uid>" for pwdump

Openwall wordlists collection for password cracking (20+ languages)
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 19 Jan 2012 11:50:43 -0800
From: Kurt Grutzmacher <grutz@...gojango.net>
To: john-users@...ts.openwall.com
Subject: Jumbo patch breaks "--users=<uid>" for pwdump

Hey guys,

During testing we noticed a little oddity today between the standard
John release and the -jumbo release when requesting UID vs. Username in
the --user option with PWDUMP files. For example:

Latest 1.7.9-jumbo-5 downloaded today:

root@...ckah:~/jtr/test-hashes/pwdump#
~/jtr/1.7.9/john-1.7.9-jumbo-5/run/john -users=500 *-pwdump -show -fo:lm
0 password hashes cracked, 0 left

root@...ckah:~/jtr/test-hashes/pwdump#
~/jtr/1.7.9/john-1.7.9-jumbo-5/run/john -users=500 *-pwdump -show -fo:nt
0 password hashes cracked, 0 left

root@...ckah:~/jtr/test-hashes/pwdump#
~/jtr/1.7.9/john-1.7.9-jumbo-5/run/john -users=Administrator *-pwdump
-show -fo:lm
Administrator:INSTALL:183af1da106c5fbcaad3b435b51404ee:e5fc8b7cb519f6a41bd61c5293ef8df7:::
Administrator:ROOT1234:37a728f8a50e2d91ff17365faf1ffe89:49368eb4218315d83fbc3a779c7fc903:::

3 password hashes cracked, 38 left

root@...ckah:~/jtr/test-hashes/pwdump#
~/jtr/1.7.9/john-1.7.9-jumbo-5/run/john -users=Administrator *-pwdump
-show -fo:nt
Administrator:install:183af1da106c5fbcaad3b435b51404ee:e5fc8b7cb519f6a41bd61c5293ef8df7:::
Administrator:root1234:37a728f8a50e2d91ff17365faf1ffe89:49368eb4218315d83fbc3a779c7fc903:::

2 password hashes cracked, 23 left 
Latest 1.7.9 release downloaded today:

root@...ckah:~/jtr/test-hashes/pwdump# ~/jtr/1.7.9/john-1.7.9/run/john
-users=500 *-pwdump -show -fo:lm
Administrator:INSTALL:500:e5fc8b7cb519f6a41bd61c5293ef8df7:::
Administrator:ROOT1234:500:49368eb4218315d83fbc3a779c7fc903:::

3 password hashes cracked, 38 left

We tested the Unix passwd format and that works as it should, only
Windows formats seem to be affected.

-- 
- grutz;