[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150520154346.GA16921@openwall.com>
Date: Wed, 20 May 2015 18:43:46 +0300
From: Aleksey Cherepanov <lyosha@...nwall.com>
To: john-dev@...ts.openwall.com
Subject: Re: Johnny: 1.5.2 Hash type suggestion/guessing, using
--show=types (was: displaying full meta information about hashes with
--show=types)
Mathieu, Shinnok,
On Wed, May 20, 2015 at 11:09:35AM -0400, Mathieu Laprise wrote:
> Aleksey,
>
> Aleksey wrote:
>
> > Files in PWDUMP format need special handling: per line list show only
> > lm and nt, lm for 3rd field and nt for 4th field. IIRC Johnny shows lm
> > and nt on separate lines. When you read the file with hashes, you may
> > need to remember if line is in PWDUMP format. I am sure you'll find a
> > way to connect everything correctly.
>
> I tested Johnny behavior regarding PWDUMP file and the LM part is in the
> "Hash" field and the NT field is in the GECOS.
> For example :
> Administrator:500:207277225E983B147AC464727886BD82:
> 90BBDB25BC6556610DAA4F03900FBE92:::
>
> will appear in Johnny :
> Login : Administrator
> Hash : 207277225E983B147AC464727886BD82
> GECOS : 500:90BBDB25BC6556610DAA4F03900FBE92
Oh, I thought pwdump is fully supported in Johnny. But it turns out
that only LMs are loaded. It raises an interesting question: how
should it look like? Two hashes on 1 line? Two lines (bad case, see
below)?
> I also dumped my own local hashes from windows 8.1 with Quarkspwdump and I
> got similar results.
>
> Is it what you meant by separate lines ? I thought "separate lines" meant
> having two rows : 1. administrator, LM and 2. administrator NT so I want to
> make sure this is not a bug.
It is not a "bug", it is just not implemented.
I am not sure that showing 2 hashes on 2 lines would be ok because
passwords of these hashes are connected: if password is shorter than
15 chars then LM has the same password as NT, if password is longer or
equal to 15 chars than only NT is used (LM is either LM with empty
password or not showed at all depending on dumping tool). LMs are not
case sensitive, so the common scenario is the following: crack LM,
then toggle case to find NT. So there is no need to separate LM and
NT.
Thanks!
--
Regards,
Aleksey Cherepanov
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
