Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 27 Jan 2007 23:26:39 +0300
From: Solar Designer <>
Cc: Paul <>
Subject: NTLM hash cracking given already cracked LM hashes


Regarding the NTLM hash cracking hack that I had mentioned in here a
year ago:
> > # Rename this section to [List.Rules:Wordlist] to activate it.
> > [List.Rules:NT]
> > l
> > lMT[*0]T[*1]T[*2]T[*3]T[*4]T[*5]T[*6]T[*7]T[*8]T[*9]T[*A]T[*B]T[*C]T[*D]Q
> > 
> > So you need to rename the section as the comment says, then run:
> > 
> > john -show pwfile | cut -d: -f2 > cracked
> > john -w=cracked -rules -format=nt pwfile

On Sat, Jan 27, 2007 at 02:33:54PM +0000, Paul wrote:
> I tried your technique and it worked like a champ except for one test 
> password.
> LM Cracked:
> AS*OD3U8
> Real Password:
> As*od3U8
> I am guessing that something with the asterisk is throwing it off the
> Rules:NT mode.

This is interesting.  No, the asterisk is not supposed to be any
special.  Only the colon, linefeed, and NUL characters should be
problematic with the above approach (well, maybe also CR and EOF on
non-Unix platforms).

What implementation/revision of the NTLM hash support patch to JtR did
you use?  What platform did you run this on?  Can you please post a
PWDUMP-style line for the LM/NTLM hashes that correspond to the above
passwords?  Are you able to login to the target system using the "Real
Password" above?


Alexander Peslyak <solar at>
GPG key ID: 5B341F15  fp: B3FB 63F4 D7A3 BCCC 6F6E  FC55 A2FC 027C 5B34 1F15 - bringing security into open computing environments

To unsubscribe, e-mail and reply
to the automated confirmation request that will be sent to you.

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.