Date: Thu, 25 Oct 2012 10:11:39 +0200 From: magnum <john.magnum@...hmail.com> To: john-dev@...ts.openwall.com Subject: Re: lm2ntlm On 2012-10-24 17:17, Solar Designer wrote: > On Wed, Oct 24, 2012 at 05:13:02PM +0400, Solar Designer wrote: >> "--loopback" is not in core JtR, it is a fairly recent addition to jumbo - >> in fact, I did not recall it when writing my previous reply. I think it >> addresses the issue with colons. So I think things are pretty good as-is, >> except that maybe we need to write a tutorial or something. > > Oh, things are not so good: I totally forgot that --loopback does not > combine LM hash halves (indeed, it does not have/know the input password > file to do so). So we're back to the approach with "cut", and this has > the colon problem. A solution may be to enhance --show so that we could > tell it to output first two fields only (then we'll use "cut -f2-"). > Another solution may be to get some LM2NT functionality into JtR proper. > > http://www.room362.com/blog/2012/10/24/lm2ntlm-with-john-the-ripper.html Another thing that -loopback can't do is the two-way codepage conversion needed for non-ascii passwords when you go from LM to NT. You have an excellent opportunity to crack 8-bit passwords like José123 or müller456 with LM. With some knowledge of what OEM codepage was used (or trial'n'error), you can include eg. iconv(1) in the pipe chain and supply --encoding to the second instance of JtR, eg: john -show pwfile | cut -d: -f2 | iconv -f cp437 -c -t cp1252 | john -pipe -enc:cp1252 -rules:nt -format=nt pwfile john -show pwfile | cut -d: -f2 | iconv -f cp858 -c -t iso-8859-15 | john -pipe -enc:iso-8859-15 -rules:nt -format=nt pwfile john -show pwfile | cut -d: -f2 | iconv -f cp737 -c -t cp1253 | john -pipe -enc:cp1253 -rules:nt -format=nt pwfile john -show pwfile | cut -d: -f2 | iconv -f cp866 -c -t cp1251 | john -pipe -enc:cp1251 -rules:nt -format=nt pwfile This way, even passwords containing non-ascii letters will be case-permuted correctly and cracked. Note that you can chose the second codepage (cp1252 in the first example) arbitrarily, it just has to be able to represent the characters from the source (the real characters, not just the byte values). And it can't be UTF-8 because only legacy codepages have full support for case-toggling in the rules engine (currently). magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.