[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20051005172223.GA30012@openwall.com>
Date: Wed, 5 Oct 2005 21:22:23 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Newbie question on jtc show
On Wed, Oct 05, 2005 at 11:55:55AM -0500, Shashank Khanvilkar wrote:
> I am trying to crack a windows2000/XP passwd file. I was able to extract
> information using pwdump2 and the dump file contains something like below:
> --SNIP--`````````
> #>cat passwd.2
> Administrator:500:aad1b433b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d9e0c089c0:::
> Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
> --SNIP--
The above looks correct, although it appears that you've been re-typing
this (why?) and made two typos in the Administrator's password hash.
Both Guest and Administrator (with the typos corrected) have empty
passwords, and the current version of John the Ripper reports that
correctly.
> I then used jtc as below
> #>jtc passwd.2
>
> it started doing something, spit out some messages (which i have no idea
> what they mean, where to get more doc on this)
As the README says, "Cracked passwords will be printed to the terminal ..."
What you should have seen are the cracked passwords (or their halves) -
in this case just empty strings - followed by the corresponding usernames
in braces.
> finally when i stopped it and did
> #>john -show passwd.2
> Administrator:???????:500:31d6cfe0d16ae931b73c59d9e0c089c0:::
> Guest:???????:501:31d6cfe0d16ae931b73c59d7e0c089c0:::
> --SNIP--
>
> what do these "???" signify
John uses the question marks to indicate uncracked portions of
partially-cracked passwords. However, in your case this appears to be a
bug in the version of John you're using. What version was that?
There's a known bug like that in version 1.6.38 (and only in that
version). If that's what you were using, please upgrade to 1.6.39.
Thanks,
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments
Was I helpful? Please give your feedback here: http://rate.affero.net/solar
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
