Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 20 Jan 2013 22:44:44 -0500
From: Matt Gardenghi <mtgarden@...il.com>
To: john-users@...ts.openwall.com
Subject: UniqPass versus JtR default password list and weird behavior

I put together a quick list of passwords (ntlm) based on a short sample of
bad passwords:
47394fdd5150187c465228f0994e8485
cee791ecc8644e94d5e650da7fe93c4f
36cea0e644818081b18b0760ade25165
35d08b53d075ad3e7a042ee28eff1b00
fa8e1a3e8ac0a32b61ad5126f41752b3
1557fe8d82c72256fa5fdca8ca12461c
259745cb123a52aa2e693aaacca2db52
4e92f66afa557023e033a56ed61a0301

Those hashes include
12345678
Natalie1
dribgib
mfmitm
....

So, I ran >john --format==nt ntlm.txt

That immediately popped three passwords and then an 2 minutes later hit a
fourth.

I deleted the .pot file. I acquired the uniqpass list and tried to
substitute that list. Its a 1.2GB dictionary list. John pulled two
passwords and then ended saying it was done in one minute.

c:\Users\Matt\Desktop\john179j5\run>john --wordlist=uniq.txt --format=nt
ntlm.txt
Loaded 8 password hashes with no different salts (NT MD4 [128/128 SSE2 +
32/32])

12345678         (?)
dribgib          (?)

guesses: 2  time: 0:00:01:09 DONE (Sun Jan 20 22:28:07 2013)  c/s: 12383K
 trying:
~~~~~~87 - ~~~~~~~~~~~~~~~~~~~~

Use the "--show" option to display all of the cracked passwords reliably

I would have assumed that john would have started performing brute force
attacks before terminating. This makes me think something went wrong.

I have repeated this process and verified the behaviors.  Any tips on what
is going wrong?
-- 
Matt Gardenghi

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.