john-users - Using all.lst scan ends immediately with ??????

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <620985189.1080490.1373654597879.JavaMail.root@sz0152a.westchester.pa.mail.comcast.net>
Date: Fri, 12 Jul 2013 18:43:17 +0000 (UTC)
From: bshaw53@...cast.net
To: john-users@...ts.openwall.com
Subject: Using all.lst scan ends immediately with ??????  - ??? and no pwd
 found

Probably I'm making a newbie mistake, but I've tried this on both WinXP & Mac, using the appropriate john build for each, and with different pwd files, same result. 

Used Dave Grohl (dave -j) to extract the hash on my Mac (OS X 8.4 Mountain Lion), pasted into plain text file and saved as SHA1.txt 

Installed jtr (john-1.7.3.1-all-6-macosx-universal-1) and purchased the mega wordlist from Openwall, extracted 'all.lst' and put it in the john folder 

At first run, it didn't recognize the pwd file. I had copied the complete hash output from dave into the text file, (formatted Plain Text). While looking for answers to that prob, I watched a YouTube video which said you have to edit it down: 

    • delete everything between and including first three $ signs 
    • delete everything after and including fourth $ sign 
    • delete last remaining 32 characters & save file 

After doing this jtr did accept the sha1.txt file although didn't seem to recognize it as SHA512 (see below). 

Anyway first run with the default password.lst chugged along happily overnight, so next day I killed it and tried to run it with the all.lst file. First edited john.conf to make wordlist = all.lst 

This is the result, and btw I tried with hashes from different users on same MAC, Here is the output I get each time. 

XXs-MacBook-Pro:run root# ./john sha1.txt --wordlist=all.lst 
Loaded 2 password hashes with no different salts (LM DES [128/128 BS SSE2-16]) 
guesses: 0 time: 0:00:00:00 100% c/s: 12044K trying: ?????? - ??? 
XXs-MacBook-Pro:run root# 

FYI the user/pwd was simply 'johnsmith' / 'star789' 

also took the hash file over to Windows and tried it there - got pretty much the same result except the ???? were replaced with what looked like small shaded boxes. 

Any help much appreciated, as I said I am a newbie with john 

thanks 

Baz

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.