Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20071214154144.825C2645D0@panta-rhei.eu.org>
Date: Fri, 14 Dec 2007 16:41:44 +0100 (CET)
From: madfran <madfran@....panta-rhei.eu.org>
To: john-users@...ts.openwall.com
Cc: 
Subject: hash from pwdump and external functions

Hi,

I donwload a hash from a Windows 2000 target using pwdump6.
The first half of the password it will cracked using LC5.
With the second half I have some problem and I am afraid I do some mistake.
I wonder in the second half are some special character and I try to use
the external functions of John.

The external function is:

**********************************************************************
[List.External:prepend-pims]
void init()
{
        int i;

	word[0] = 'A';
	word[1] = '%';
	word[2] = 'D';
	word[3] = 'M';
	word[4] = 'I';
	word[5] = 'N';
	word[6] = '7';
	word[7] = 'I';
	word[8] = 0x20;
	word[9] = 0x20 - 1;
	word[10] = 0x20 - 2;
	word[11] = 0x20 - 3;
	word[12] = 0x20 - 4;
	word[13] = 0x20 - 5;
}

void generate()
{
	int i;
	i = 13;                   
        while (++word[i] > 0xff)  
        if (i > 8)                
          word[i--] = 0x20;       
	else {
	  word=0;                 
	  return;
	}
}

**********************************************************************

but when I launch,
john -session=pims -format=NT -e=prepend-pims hash-pims.txt
the output if,
"No password hashes loaded"

if I launch,
john -session=pims-NTLM  -e=prepend-pims hash-pims.txt
the output is
Loaded 1 password hash (NT LM DES [128/128 BS SSE2])
guesses: 0  time: 0:00:00:03  c/s: 9502K  trying: A%DMIN7 - A%DMIN7

,... it seem they are not able to see the second half.

if I launch,
john -session=pims-NTLM  -format=mscash -e=prepend-pims hash-pims.txt
the output is
Loaded 1 password hash (M$ Cache Hash [Generic 1x])
guesses: 0  time: 26:22:05:42  c/s: 2681K  trying: A%DMIN7I+,UqO¬ - A%DMIN7I+,UqO–

It try the whole password but the format it is mot mscash !!!

The hash is,
administrator:8ED0A046696658941180BC49698B0D39

What is wrong in my exam I doing wrong external function?

madfran

-- 
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.