Date: Wed, 17 Sep 2008 08:10:55 +0400 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Mac OS X salted SHA-1 hashes (was: No password hashes loaded? hashes in .lst form) On Tue, Sep 16, 2008 at 08:31:10PM -0700, William wrote: > Hello, I'm a complete noob with an old account on my mac I'm trying to get the PW for. What is the reason for recovering that password, as opposed to merely resetting it? Do you have a keychain or something else that supposedly shares the same password? That would be a good reason to recover the original password, yes. > I've got the pro version of John (1.7.2) and not quite sure what's up... JtR 1.7.2 Pro did not support the Mac OS X 10.4+ salted SHA-1 hashes yet. You need to use the beta version of 220.127.116.11 Pro for that. It is found under beta/ in your download directory. Also, with the beta version you would not have to extract the password hash manually - it includes the XPWDUMP tool for that. > Question: the hash I've extracted for the account is: > user:70801FD2FA3729F0222624B2D75E08B581476E72AC48B89V (I've changed a couple numbers/letters, but the count and order is the same). Please note that changing only "a couple" of the numbers/letters is not sufficient to prevent someone determined from cracking your password. > Is this the correct hash/format? Yes. It looks like a salted SHA-1 hash that is supported by the beta version mentioned above. > Whats the correct form to enter into the bash shell to get John to crack the hash? The commands you've tried would work with the beta version. The first one - without any options - would likely work best. I hope this helps. Alexander -- To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.