john-users - Re: Extract the cracked pass from John.pot

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 21 Apr 2012 00:16:53 +0000 (UTC)
From: donovan <contact.newangels@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: Extract the cracked pass from John.pot

jfoug <jfoug@...> writes:

>  Ouchhhh !! so that mean they are no DES but Plain cracked Pass !!
> >that's right ?
> >
> >Well it does seem so but I am yet to confirm them (maybe later). That
> >would be a freaking b <at> stard of a plaintext to crack for crypt-md5
> >though, you must have done something very right or you were extremely
> >lucky. Or something else :)
> 
> Looks like conversion of some uninitialized pointer or something.  NOTE, the
> 'pw' is exactly the same for every line.  Looks very busted to me.
> 
> This is why I added the code to the test suite, to rip the passwords OUT of
> the .pot file, and to re-run using them as the dictionary.  This shows that
> the build of john can both properly crack the data, AND that it writes the
> proper data to the .pot file.   But here, I am pretty sure, the cracked
> passwords are bogus.
> 
> You might want to see if you can find them in the john.log file. Possibly it
> was written there correctly.
> 
> Jim.
> 
> 

Hi Jim,

Thanks for your comments & explain.

I don't save the log file, i remove them generaly cause heavy one's ....

I take an look on the pot & here the part after the line we talking about :

( without the space for sure,i put it for isolated the line)
***********

$1$PRN$PxPp5PQ7nz5kgpGmztuuj.:7jeJCek5H3xi2


$1$PRN$PzzVwm88g8Gkv/hP2fXPt/:AuipuY6wqpUrq
$1$PRN$Q./tr7s9HpFf3/xeJd66C0:DFcyP27lZKc1
$1$PRN$Q50Hqu6VEkKVgfCsqeHDi0:n87938GK6fqnN
$1$PRN$Q81B90JVNcY3DEEON47Vp.:hammer
$1$PRN$QIFkCMofERPiJ/DrpUnCG/:tkGMgk9UMBq8
$1$PRN$QKAPt3In7i.GDJWEXh05r/:LC0tZR1EYCtI


*************

Regards,

Donovan