john-users - Re: Using all.lst scan ends immediately with ??????

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <51E4AFA5.9010105@comcast.net>
Date: Mon, 15 Jul 2013 22:27:49 -0400
From: Barry Shaw <bshaw53@...cast.net>
To: john-users@...ts.openwall.com
Subject: Re: Using all.lst scan ends immediately with ??????
  - ??? and no pwd found

HI just wanted to follow up to say thanks, and ask one more question if 
I may.

       Dhiru your suggested worked great - I grabbed just the ml2john.py
       code from the bleeding-jumbo page and saved it in the new version
       of jtr that magnum pointed me too.


       When I ran it on my MAC it pulled the hash and the password
       (star789) immediately, as it is a simple one:

       XXs-MacBook-Pro:run root# sudo python ml2john.py 
/private/var/db/dslocal/nodes/Default/users/johnsmith.plist

johnsmith:$pbkdf2-hmac-sha512$38759.c6c1a8fc5a91543ff73409577e5b3e37e9c996dac5fb26e3c2f1cd12802d69ea.f666f74c8198e7344367a4adec6ee62f1c6c2a0a78ffbaade769150dfef887935fb21ef0abcfcb137124d30ce310c9cdf1674a0074e687d7f0bc386619c4a279:502:20:John
Smith,star789:/bin/bash:/private/var/db/dslocal/nodes/Default/users/johnsmith.plist

XXs-MacBook-Pro:run root#

       Next I wanted to run the hash again in john to make sure I'm 
doing it right and get the same result. But where I'm stumbling is in 
creating the pwd file (sha1.txt) from the output hash.
       Specifically what portion of the complete output above needs to 
go into the password file? If I put everything in, or everything up to 
the final colon before the username (John Smith), running john
       produces the error 'No hash loaded'.&nbsp;&nbsp; If I create it 
with the main body of the hash, ie all 128 chara, john accepts the hash 
but  when using --wordlist=all.lst, terminates with 'trying: ???_??? '
       after a few seconds, which is where I was in the beginning.

       I'm sure it's my fault, which is why I came here to learn!

       thanks

       Baz
On 7/12/2013 7:21 PM, Dhiru Kholia wrote:
> On 07/12/13 at 06:43pm, bshaw53@...cast.net wrote:
>> Used Dave Grohl (dave -j) to extract the hash on my Mac (OS X 8.4
>> Mountain Lion), pasted into plain text file and saved as SHA1.txt
> JtR can do this hash extraction too.
>
> Use the latest JtR-jumbo code from,
> https://github.com/magnumripper/JohnTheRipper/tree/bleeding-jumbo
>
> Running "ml2john.py /private/var/db/dslocal/nodes/Default/users/<username>.plist"
> will give you the hash which will be recognized 100% by the latest JtR-jumbo code.
>
> --
> Dhiru
>

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.