[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20070327013423.GA7567@openwall.com>
Date: Tue, 27 Mar 2007 05:34:23 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: No hash?
On Mon, Mar 26, 2007 at 09:54:37AM +0200, Oliver VŠlker wrote:
> (I've x-ed a part of my password)
Yet it might be cracked based on the information that you did post - the
partial LM hash and the full NTLM hash.
> I've tried to get the password for the testaccount of my wife.... but
> john only gets the following:
>
> D:\Temp\Passwort\john1701\run>john-mmx test.txt
> Loaded 2 password hashes with no different salts (NT LM DES [64/64 BS MMX])
> guesses: 0 time: 0:01:58:38 (3) c/s: 11867K trying: Z9M7IMY - Z9M7IUG
> RSUFHXZ (Hilfeassistent:2)
> guesses: 1 time: 1:02:35:26 (3) c/s: 8246K trying: X_X&#RV - X_X&#O-
...
> UB(4XDT (Hilfeassistent:1)
> guesses: 2 time: 3:01:07:24 (3) c/s: 6918K trying: UB(4XR - UB(4XDQ
>
> Why doesn't it show the other password?
What other password? The reason it loaded only two LM hash halves is
that you probably already have the rest of them cracked. John's output
while it's cracking is to report its progress only. It does not always
contain all of the cracked passwords. It will not contain passwords
cracked in previous sessions, and, depending on cracking mode, it might
also not contain any duplicate passwords (when two users have the same
password or, in case of LM hashes, the same 7-character password part).
To obtain the complete list of cracked accounts, you should use the
"--show" option:
john-mmx --show test.txt
> If I copy the line with Martinas account in a seperate file john shows
> me:
>
> D:\Temp\Passwort\john1701\run>john-mmx martina.txt
> No password hashes loaded
This confirms that those hashes have already been cracked. In fact,
this is one of possible answers given to this question on the FAQ:
Q: Why doesn't John load my password file? It says "No password hashes
loaded".
...
A: All of the password hashes found in the file (that John recognizes as
such) might be already cracked by previous invocations of John.
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: 5B341F15 fp: B3FB 63F4 D7A3 BCCC 6F6E FC55 A2FC 027C 5B34 1F15
http://www.openwall.com - bringing security into open computing environments
Was I helpful? Please give your feedback here: http://rate.affero.net/solar
--
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
