|
Message-ID: <20100222181230.GA23822@openwall.com> Date: Mon, 22 Feb 2010 21:12:30 +0300 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Re: New updated lanman.chr based on RockYou Data On Fri, Feb 19, 2010 at 07:32:00PM +0100, Magnum P. I. wrote: > Minga Minga wrote: > >To give you an idea how it was created, I performed the following commands: > >1) Taking the rockyou list - and converting to upper case. > >2) cut -b 1-7 rockyou.dic >> lanmanrockyou.dic > >3) cut -b 8-14 rockyou.dic >> lanmanrockyou.dic > >4) cut -b 15-21 rockyou.dic >> lanmanrockyou.dic > >5) generated LANMAN hashes for all entries in lanmanrockyou.dic > >6) cracked all the LANMAN hashes > >7) generated a .chr file from the cracked hashes. > > That cutting in step 2 and 3 is a clever idea as far as I can tell. The cutting is required when steps 5 and 6 are omitted, but it is not needed when steps 5 and 6 are to be performed (JtR itself will effectively do the cutting then). > But shouldn't step 4 be omitted? Definitely. > Anyway, maybe the filter_lanman ruleset could be rewritten to take care > of this splitting? If it's at all possible? There's no need for that as long as john.pot was actually produced by JtR (rather than "by external means") and it contains LM hashes only. With LM hashes, JtR always stores LM hash halves and the corresponding password "halves" into john.pot. As to making better use of non-LM hash passwords for generating lanman.chr, yes, such a change to Filter_LanMan would make sense. Unfortunately, right now there's no way for a filter() to produce more than one "modified word" for a single input "word". So right now Filter_LanMan simply truncates at 7 characters. Perhaps I should implement support for producing multiple "modified words" from a single input "word" with a filter(). This is on my to-do list. Thanks, Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.