Date: Sat, 11 Mar 2006 06:41:54 +0300 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Re: does john crack xp passwords correctly? On Sat, Mar 11, 2006 at 02:40:53AM +0000, hadzijj qwerty wrote: > I tried to crack passwords on windows xp machine. First I tried several > wordlists without successes but then I started incremental mode. After a > short while john reported that it found administrator password. It looks > like this: > > Administrator:???????M2!:500:1b6619d8e85b32dbeff875a23a56d92d::: > > What does it mean '???????M2!'? It's not a password. It's seven unknown (not yet cracked) characters followed by the part of the password that's been cracked (the "M" might be upper- or lower-case, though - John does not check that). At this point, it is known that the password is exactly 10 characters long - and only the first 7 characters remain to be cracked. If it's the only password hash you're cracking, you can get some speedup by restricting your "incremental" mode definition to just 7 character long passwords (normally, it would try all lengths from 0 to 7 for LM hashes). In john.conf (or john.ini on Windows), edit this section: [Incremental:LanMan] File = $JOHN/lanman.chr MinLen = 0 MaxLen = 7 CharCount = 69 to read: [Incremental:LanMan] File = $JOHN/lanman.chr MinLen = 7 MaxLen = 7 CharCount = 69 then interrupt and continue the session (with "john --restore", or "john-mmx --restore" if you're on Windows). However, if you're cracking other password hashes at the same time (not only Administrator's), then _don't_ follow the above suggestion as there may remain password halves shorter than 7 characters that are yet to be cracked. Provided that you use the current version of John (1.7 or newer) and you run the MMX build of it, you should get your full Administrator password cracked reasonably soon (two weeks worst case for a modern CPU, but chances are that you'd get it cracked _much_ quicker - within hours). -- Alexander Peslyak <solar at openwall.com> GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598 http://www.openwall.com - bringing security into open computing environments Was I helpful? Please give your feedback here: http://rate.affero.net/solar
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.