[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20070127202639.GA26819@openwall.com>
Date: Sat, 27 Jan 2007 23:26:39 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Cc: Paul <paul@...thor.com>
Subject: NTLM hash cracking given already cracked LM hashes
Paul,
Regarding the NTLM hash cracking hack that I had mentioned in here a
year ago:
> > # Rename this section to [List.Rules:Wordlist] to activate it.
> > [List.Rules:NT]
> > l
> > lMT[*0]T[*1]T[*2]T[*3]T[*4]T[*5]T[*6]T[*7]T[*8]T[*9]T[*A]T[*B]T[*C]T[*D]Q
> >
> > So you need to rename the section as the comment says, then run:
> >
> > john -show pwfile | cut -d: -f2 > cracked
> > john -w=cracked -rules -format=nt pwfile
On Sat, Jan 27, 2007 at 02:33:54PM +0000, Paul wrote:
> I tried your technique and it worked like a champ except for one test
> password.
>
> LM Cracked:
> AS*OD3U8
>
> Real Password:
> As*od3U8
>
> I am guessing that something with the asterisk is throwing it off the
> Rules:NT mode.
This is interesting. No, the asterisk is not supposed to be any
special. Only the colon, linefeed, and NUL characters should be
problematic with the above approach (well, maybe also CR and EOF on
non-Unix platforms).
What implementation/revision of the NTLM hash support patch to JtR did
you use? What platform did you run this on? Can you please post a
PWDUMP-style line for the LM/NTLM hashes that correspond to the above
passwords? Are you able to login to the target system using the "Real
Password" above?
Thanks,
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: 5B341F15 fp: B3FB 63F4 D7A3 BCCC 6F6E FC55 A2FC 027C 5B34 1F15
http://www.openwall.com - bringing security into open computing environments
--
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
