[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20060311034154.GA11011@openwall.com>
Date: Sat, 11 Mar 2006 06:41:54 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: does john crack xp passwords correctly?
On Sat, Mar 11, 2006 at 02:40:53AM +0000, hadzijj qwerty wrote:
> I tried to crack passwords on windows xp machine. First I tried several
> wordlists without successes but then I started incremental mode. After a
> short while john reported that it found administrator password. It looks
> like this:
>
> Administrator:???????M2!:500:1b6619d8e85b32dbeff875a23a56d92d:::
>
> What does it mean '???????M2!'? It's not a password.
It's seven unknown (not yet cracked) characters followed by the part of
the password that's been cracked (the "M" might be upper- or lower-case,
though - John does not check that). At this point, it is known that the
password is exactly 10 characters long - and only the first 7 characters
remain to be cracked.
If it's the only password hash you're cracking, you can get some speedup
by restricting your "incremental" mode definition to just 7 character
long passwords (normally, it would try all lengths from 0 to 7 for LM
hashes). In john.conf (or john.ini on Windows), edit this section:
[Incremental:LanMan]
File = $JOHN/lanman.chr
MinLen = 0
MaxLen = 7
CharCount = 69
to read:
[Incremental:LanMan]
File = $JOHN/lanman.chr
MinLen = 7
MaxLen = 7
CharCount = 69
then interrupt and continue the session (with "john --restore", or
"john-mmx --restore" if you're on Windows).
However, if you're cracking other password hashes at the same time (not
only Administrator's), then _don't_ follow the above suggestion as there
may remain password halves shorter than 7 characters that are yet to be
cracked.
Provided that you use the current version of John (1.7 or newer) and you
run the MMX build of it, you should get your full Administrator password
cracked reasonably soon (two weeks worst case for a modern CPU, but
chances are that you'd get it cracked _much_ quicker - within hours).
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments
Was I helpful? Please give your feedback here: http://rate.affero.net/solar
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
