[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20050901142453.GA4381@openwall.com>
Date: Thu, 1 Sep 2005 18:24:53 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Question With Windows password hash decryption
Hi Nicolas,
On Sun, Aug 28, 2005 at 11:44:45AM -0400, Nicolas Goles wrote:
> hi, I am trying to decript some windows 2000 sp4 pass, it is like this
>
> 7FC0E1D29E0F3B56AAD3B435B51404EE:BD2D42EB21E94D859CB757112AFAD7ED:::
When cracking Windows passwords, John the Ripper expects password files
in PWDUMP output format. This would be:
login-name:NT-hash:LM-hash:other-fields
What you have above is:
LM-hash:NT-hash:other-fields
Converting this to the proper format, we get:
user:BD2D42EB21E94D859CB757112AFAD7ED:7FC0E1D29E0F3B56AAD3B435B51404EE
(notice that I've swapped the two hashes).
> I know that the password of that file is = "4028" (no quotes )
Correct - and John cracks it within seconds when run on the line above.
$ john pw-goles-lm
Loaded 1 password hash (NT LM DES [64/64 BS MMX])
4028 (user)
guesses: 1 time: 0:00:00:05 (3) c/s: 254700 trying: 4025 - 403D
> The thing is , that if I make a wordlist and put 4028 , as a
> password, its not working, it doesn't detect it as a valid password
That's because you had the input file in the wrong format. If you would
simply run John on the line you've posted, John would misinterpret the
LM hash as the login name and obviously not crack it.
> So ok , I though I had to install some patch to JTR , and I
> downloaded this:
>
> Windows NT/2000/XP/2003 NTLM (MD4) hash support for 1.6.36+, by Olle
> Segerdahl
You didn't have to use this, although it would also happen to get the
password cracked.
> I downloaded latest version of JTR ( http://www.openwall.com/john/c/
> john-1.6.38.tar.gz ) sources only...
>
> uncompressed the windows MD4 hash support file , and found john-ntlm-
> v03.diff
>
> I put "john-ntlm-v03.diff" in src directory , and tried to apply the
> patch like
>
> $patch < john-ntlm-v03.diff
>
> patching file JOHN-NTLM-FAQ
> patching file Makefile
> Hunk #1 succeeded at 28 (offset 1 line).
> patching file NT_fmt.c
> patching file byteorder.h
> patching file john.c
> patching file loader.c
> patching file md4.c
> patching file options.c
> Hunk #2 FAILED at 101.
> 1 out of 2 hunks FAILED -- saving rejects to file options.c.rej
> patching file smbencrypt.c
Well, you're using a patch for 1.6.36 on 1.6.38. Your options would be:
- patch options.c manually, or
- ignore this rejection since it is truly unimportant, or
- download 1.6.36 off the FTP (which holds all the previous versions)
and patch and use that.
> So I failed , I went to my options.c.rej file and this is what I got
[...]
> - "(DES/BSDI/MD5/BF/AFS/LM)\n" \
[...]
> + "(DES/BSDI/MD5/BF/AFS/LM/NT)\n" \
So the only hunk that failed to apply had to do with the usage message:
trivial to fix by hand and safe to ignore.
> What I am doing wrong???
Quite a few things, including typing multiple question marks. ;-)
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments
Was I helpful? Please give your feedback here: http://rate.affero.net/solar
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
