john-users - Re: Re: Extract the cracked pass from John.pot

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 21 Apr 2012 11:40:02 +0200
From: Frank Dittrich <frank_dittrich@...mail.com>
To: john-users@...ts.openwall.com
Subject: Re: Re: Extract the cracked pass from John.pot

On 04/20/2012 11:39 PM, donovan wrote:
> & find an lot of :
> 
> ( so the "hashes" come into the file )
> 
> *************
> 
> md5_gen(7)17c8dddfbf16fe4b14b1a8b368ad3977$8-4;undertaker01160
> md5_gen(7)f0398de8070bd35c8b4ebeccdef6e2d3$#>G;blue123ocean456
> md5_gen(7)d141c417ae1e12c9b4816870b94b6f47$&l5;onceuponaforest
> md5_gen(7)a023c92847d791488fb2179ace167dea$voc;mahalnamahalkita
> md5_gen(7)e6eefdbb86b77aefc18029d17493140f$~S=;franciscoalejandro
> 
> .....
> 
> ************
> 
> So seem that one's escape to the pasted CMD.

For some reason you do have lines in your pot file where a semicolon
instead of a colon separated the hash and the password.
May be you invoked john with --sep=";"

While my previous remark seems to be on topic here, I'm afraid the
following is off-topic on john-users, because it is related to usage of
basic unix commands. So, this kind of question is better asked in a
forum for unix users.

Anyway, you might try

export LC_ALL=C; grep -v ":*;" john.pot | cut -d";" -f 2- -s > test2.txt

to get all those passwords from lines with a semicolon as a separator.
the export makes sure that you avoid issues with illegal byte sequences
due to passwords using an iso-8859-* encoding.
The grep skips those lines with a colon as a separator, but a semicolon
as part of the password.
As a result, you would also miss the lines with a ";" as separator and a
password containing a ":" and a ";" somewhere after the ":".

Frank