Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 10 Mar 2010 23:30:18 +0100
From: "Magnum, P.I." <rawsmooth@...dband.net>
To: john-users@...ts.openwall.com
Subject: Re: MPIrun and multifound

websiteaccess@...il.com skrev:
> Hi
> 
> 
>  With my JTr 1.7.5 mpirun and this short hashlist : 
> 
>  mpirun -np 6 ./john -format=raw-md5 -i:alphafr -pot=test1.pot test1.txt
> 
> user:d40e33cbde7de5c38d8978baa1e5d57f
> user:d41d8cd98f00b204e9800998ecf8427e
> user:d48e2391e98c08027a689ae5ad517696
> 
> I get :
> Loaded 3 password hashes with no different salts (Raw MD5 [raw-md5 SSE2 
> 16x4])
>                  (laaaal)
>                  (laaaal)
>                  (laaaal)
>                  (laaaal)
>                  (laaaal)
>                  (laaaal)
> ^Cmpirun: killing job...
> 
> 
>  As you can see, second hash is found 6 times ! how a password found by 
> 1 core, and "marked" as found , can it be still found 5 times other 
> time ?

There are two issues here. One is that it seems all nodes are trying the 
empty password (I just confirmed it here too). I never saw that before, 
but I'm sure this is an exception. I suppose john tries the empty 
password before actually starting the real (and distributed) Incremental 
mode.

The other issue is the known fact that when one node cracks a password, 
the other nodes do not get to know about it. The same problem exists 
when running several processes manually. A workaround (if a lot of 
passwords was cracked) is to stop and restart the jobs.

Anyway you can ignore this as long as you don't see it happen with some 
other password than the empty one.

By the way it gets a little confusing when you present hashes with the 
username "user" while the john output says it's "laaaal".

magnum

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.