Date: Thu, 14 May 2015 18:59:45 +0300 From: Aleksey Cherepanov <lyosha@...nwall.com> To: john-dev@...ts.openwall.com Subject: Re: Johnny: 1.5.2 Hash type suggestion/guessing, using --show=types (was: displaying full meta information about hashes with --show=types) Mathieu, On Thu, May 14, 2015 at 10:39:24AM -0500, Mathieu Laprise wrote: > Aleksey said: > > > The patch was pulled into bleeding-jumbo branch (default). So pull the > > new version and try to run it against some files. You'll see the > > output, the format is described above. Skeleton of parser in Perl is > > in attach. > > > I played with the latest bleeding-jumbo branch and show=types and now I > understand the output and the format you described. Thanks. Good. > Is it our goal > to call the perl script in Johnny or is it just to help me write a C++ > function ? Perl script is supposed to help you write parser in C++. It is supposed to be called from Johnny. The output from --show=types is better for Johnny unlike output of the parser. > Files in PWDUMP format need special handling: per line list show only > > lm and nt, lm for 3rd field and nt for 4th field. IIRC Johnny shows lm > > and nt on separate lines. When you read the file with hashes, you may > > need to remember if line is in PWDUMP format. I am sure you'll find a > > way to connect everything correctly. > > > I didn't work yet with that kind of file. I've only used /etc/shadow files > in john yet. I've made some research on Google about LM ,NT password hashes > and pwdumping of SAM to understand what you are talking about. I found this > sample that I send to john --show=types > Input: > Administrator:500:207277225E983B147AC464727886BD82:90BBDB25BC6556610DAA4F03900FBE9 I guess this line is from http://h.foofus.net/?page_id=55 and it is not full, the full line from the site is Administrator:500:207277225E983B147AC464727886BD82:90BBDB25BC6556610DAA4F03900FBE92::: > The website where I found it said it has LM and NT(not sure if it's true, > the Windows things is really new to me and I seriously lack files to test > for now :( ). > Output : > Administrator:207277225E983B147AC464727886BD82:500:::::LM:0:0:1:$LM$207277225e983b14:$LM$7ac464727886bd82:0: > Output parser: > valid format LM (disabled 0, dynamic 0) > orig: 207277225E983B147AC464727886BD82 > 2 parts: > $LM$207277225e983b14 > $LM$7ac464727886bd82 > > Is this normal that the 4th field 90BBDB25BC6556610DAA4F03900FBE9 seems to > be ignored ? I thought it was supposed to be the NT one? Without "2" on the end, there are 31 hex digits, so it is not a correct NT hash. > Are the field "2 parts:" from last example's parser important for Johnny or > is it only the orig: XXXXXXXXx thing that is important ? Orig thing is loaded into table view already. To suggest types, it is not important at all. Thanks! -- Regards, Aleksey Cherepanov
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.