[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 17 Sep 2008 08:10:55 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Mac OS X salted SHA-1 hashes (was: No password hashes loaded? hashes in .lst form)
On Tue, Sep 16, 2008 at 08:31:10PM -0700, William wrote:
> Hello, I'm a complete noob with an old account on my mac I'm trying to get the PW for.
What is the reason for recovering that password, as opposed to merely
resetting it? Do you have a keychain or something else that supposedly
shares the same password? That would be a good reason to recover the
original password, yes.
> I've got the pro version of John (1.7.2) and not quite sure what's up...
JtR 1.7.2 Pro did not support the Mac OS X 10.4+ salted SHA-1 hashes
yet. You need to use the beta version of 1.7.3.1 Pro for that. It is
found under beta/ in your download directory. Also, with the beta
version you would not have to extract the password hash manually - it
includes the XPWDUMP tool for that.
> Question: the hash I've extracted for the account is:
> user:70801FD2FA3729F0222624B2D75E08B581476E72AC48B89V (I've changed a couple numbers/letters, but the count and order is the same).
Please note that changing only "a couple" of the numbers/letters is not
sufficient to prevent someone determined from cracking your password.
> Is this the correct hash/format?
Yes. It looks like a salted SHA-1 hash that is supported by the beta
version mentioned above.
> Whats the correct form to enter into the bash shell to get John to crack the hash?
The commands you've tried would work with the beta version. The first
one - without any options - would likely work best.
I hope this helps.
Alexander
--
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
