Date: Sat, 27 Jan 2007 23:26:39 +0300 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Cc: Paul <paul@...thor.com> Subject: NTLM hash cracking given already cracked LM hashes Paul, Regarding the NTLM hash cracking hack that I had mentioned in here a year ago: > > # Rename this section to [List.Rules:Wordlist] to activate it. > > [List.Rules:NT] > > l > > lMT[*0]T[*1]T[*2]T[*3]T[*4]T[*5]T[*6]T[*7]T[*8]T[*9]T[*A]T[*B]T[*C]T[*D]Q > > > > So you need to rename the section as the comment says, then run: > > > > john -show pwfile | cut -d: -f2 > cracked > > john -w=cracked -rules -format=nt pwfile On Sat, Jan 27, 2007 at 02:33:54PM +0000, Paul wrote: > I tried your technique and it worked like a champ except for one test > password. > > LM Cracked: > AS*OD3U8 > > Real Password: > As*od3U8 > > I am guessing that something with the asterisk is throwing it off the > Rules:NT mode. This is interesting. No, the asterisk is not supposed to be any special. Only the colon, linefeed, and NUL characters should be problematic with the above approach (well, maybe also CR and EOF on non-Unix platforms). What implementation/revision of the NTLM hash support patch to JtR did you use? What platform did you run this on? Can you please post a PWDUMP-style line for the LM/NTLM hashes that correspond to the above passwords? Are you able to login to the target system using the "Real Password" above? Thanks, -- Alexander Peslyak <solar at openwall.com> GPG key ID: 5B341F15 fp: B3FB 63F4 D7A3 BCCC 6F6E FC55 A2FC 027C 5B34 1F15 http://www.openwall.com - bringing security into open computing environments -- To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.