john-users - Revisit of: --make-charset against a File with LANMAN and NTLM Passes?

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <5f4239741001211401q5588d588g1649fc6a2f1e1aa@mail.gmail.com>
Date: Thu, 21 Jan 2010 16:01:44 -0600
From: Minga Minga <mingakore@...il.com>
To: john-users@...ts.openwall.com
Subject: Revisit of: --make-charset against a File with LANMAN and NTLM 
	Passes?

All,

Previously I asked a question about using using --make-chars against a
pwdump.txt that contained both LANMAN and NTLM hashes.
The problem is, that currently (?) the resulting .chr file
will only contain CAPITAL letters because it uses
LANMAN as its input.  This appears to still be true in the
latest version with jumbo patch:

"Successfully written charset file: adf.chr (46 characters)"

$ strings adf.chr | egrep [a-z] | wc
      0       0       0
$ strings adf.chr | egrep [A-Z] | wc
     76      76     619

Discussed here;
http://marc.info/?l=john-users&m=123811421820149

The solution was:

"Oh, you're correct.  In version 1.7.3.1-all-5, patch line 66 in
options.c removing (or commenting out) "FLG_MAKECHR_CHK | ", and
recompile.  Then the above command will work as intended (I've just
tested it)."

-----

The latest version (with jumbo patch) of options.c is:

{"make-charset", FLG_MAKECHR_SET, FLG_MAKECHR_CHK,
0, FLG_CRACKING_CHK | FLG_SESSION | OPT_REQ_PARAM,
OPT_FMT_STR_ALLOC, &options.charset},

Removing the string "FLG_MAKECHR_CHK |" no longer appears to
be a valid fix.

------

Is there a new 'fix' that can be used so that --make-chars can be run
against an input file both lanman and NTLM hashes - in order to create
a custom .chr file that contains upper and lower case options ?

Also:
Alexander - to answer your previous question. YES! This is
a very effective way of brute forcing credentials when a large
sample size is available. When used in conjunction with
--markov mode - a large majority of the 30,000+ passwords
were cracked. Using this 'trick' quickly cracked passwords
that markov mode had not found, and also the
original all.chr file had not found as well.

Also, sorry I do not have the ability to reply to the previous
 conversation - so the 'thread' will not be complete.

-Minga

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.