Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 11 Mar 2006 06:41:54 +0300
From: Solar Designer <>
Subject: Re: does john crack xp passwords correctly?

On Sat, Mar 11, 2006 at 02:40:53AM +0000, hadzijj qwerty wrote:
> I tried to crack passwords on windows xp machine. First I tried several 
> wordlists without successes but then I started incremental mode. After a 
> short while john reported that it found administrator password. It looks 
> like this:
> Administrator:???????M2!:500:1b6619d8e85b32dbeff875a23a56d92d:::
> What does it mean '???????M2!'? It's not a password.

It's seven unknown (not yet cracked) characters followed by the part of
the password that's been cracked (the "M" might be upper- or lower-case,
though - John does not check that).  At this point, it is known that the
password is exactly 10 characters long - and only the first 7 characters
remain to be cracked.

If it's the only password hash you're cracking, you can get some speedup
by restricting your "incremental" mode definition to just 7 character
long passwords (normally, it would try all lengths from 0 to 7 for LM
hashes).  In john.conf (or john.ini on Windows), edit this section:

File = $JOHN/lanman.chr
MinLen = 0
MaxLen = 7
CharCount = 69

to read:

File = $JOHN/lanman.chr
MinLen = 7
MaxLen = 7
CharCount = 69

then interrupt and continue the session (with "john --restore", or
"john-mmx --restore" if you're on Windows).

However, if you're cracking other password hashes at the same time (not
only Administrator's), then _don't_ follow the above suggestion as there
may remain password halves shorter than 7 characters that are yet to be

Provided that you use the current version of John (1.7 or newer) and you
run the MMX build of it, you should get your full Administrator password
cracked reasonably soon (two weeks worst case for a modern CPU, but
chances are that you'd get it cracked _much_ quicker - within hours).

Alexander Peslyak <solar at>
GPG key ID: B35D3598  fp: 6429 0D7E F130 C13E C929  6447 73C3 A290 B35D 3598 - bringing security into open computing environments

Was I helpful?  Please give your feedback here:

Powered by blists - more mailing lists

Your e-mail address:

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.