Date: Sat, 30 Aug 2008 07:19:04 +0400 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Re: duplicate guesses with 220.127.116.11-all-2 jumbo patch On Fri, Aug 29, 2008 at 04:37:09PM -0400, Adam Turk wrote: > #./john hashes.txt I sure hope you're not running JtR as root. It does not require root privileges (after you have possibly obtained the shadow file as root). > Loaded 6 password hashes with no different salts (LM DES [64/64 BS MMX]) > BB (b) > A (a) > TESTTES (Administrator:1) > CDC (c) > DEDE (d) ... > The NT hash works fine now, but the NTLM hash still reports 6 hashes loaded Everything is correct here. (Well, except that it's "LM hash", not "NTLM hash" as you said, that "still reports 6 hashes loaded" for you.) One of your passwords is longer than 7 characters, so it corresponds to two LM hash halves, which are being loaded and cracked independently. This is addressed in the FAQ as follows: Q: I have 10 users, but John said it loaded 15 password hashes. What's going on? A: Some extremely poorly designed hash types (Windows LM hashes and double-length DES-based crypt(3) hashes also known as "bigcrypt" or "crypt16") have a property that allows John to split their encodings into two separate hashes (corresponding to halves of plaintext passwords) on load. John then proceeds to crack those hashes separately, so at a given time it might have only one of two halves of some passwords cracked. If interrupted and restarted, it would need to only load the hashes which correspond to uncracked password halves, so the number of such hashes is what John reports (in all cases, for consistency). > and won't stop. This means that it did not try the candidate password "T", which would correspond to the remaining LM hash half. I'm not sure why that is the case for you - have you customized john.conf in some way, or are you passing command-line options not shown above? It works fine for me (with a linux-x86-mmx build of 18.104.22.168-all-2-lpsfix1, which I assume is what you're testing): Loaded 6 password hashes with no different salts (LM DES [64/64 BS MMX]) BB (b) A (a) TESTTES (Administrator:1) T (Administrator:2) CDC (c) DEDE (d) guesses: 6 time: 0:00:00:01 (3) c/s: 386173 trying: DOON - DEDE Note that it has to get to "pass 3" (the "(3)" on the status line), which is "incremental" mode. If you have specified a large wordlist, then it might take a lot longer for JtR to get to "incremental" mode. To obtain all of the cracked passwords, with the halves combined, the "--show" option must be used. It reports: Administrator:TESTTEST:0::: a:A:1::: b:BB:2::: c:CDC:3::: d:DEDE:4::: 6 password hashes cracked, 0 left In fact, you must always use "--show", including with other hash types, to ensure you obtain all of the cracked passwords. Although JtR also prints successful guesses while it is running, there's no guarantee that it will print all of them. In many cases, it does not even load previously-cracked and duplicate hashes (if you have any in your input files) for cracking, yet it will correctly report them with "--show". Alexander -- To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.