john-users - Re: Problem with Session restore

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGcw5iSK=yAQ=1ETOWwoWNWCx7nECfrKmhAhDdHoS36ZjBCfaw@mail.gmail.com>
Date: Thu, 5 Sep 2013 08:22:35 +0200
From: Marc Brinkmann <marc.brinkmann@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: Problem with Session restore

hey Magnum,
here is the hash:
%FILENAME%.xlsx:$office$*2010*100000*128*16*5b3562a5c7bd56ebe9b2594d0198efc0*34d8cc707bc3721b58cee968fdb4d8a5*f708f83afaca392c6d006ac78c891d5642b21212aa89f5231d331b36946aee8b

this is the rec-file:
i ran office2john and stored it into a textfile.

"REC3
3
--format=office
%HASH-TEXT-FILE%
7427544
0
b6293571
00000000
3
0
a6d3ae70
1442
0
8
11
12
14
13
19
13
0
0
0
3055984871"

Thanks for your help
best regards
Marc


2013/9/4 magnum <john.magnum@...hmail.com>

> On 4 Sep, 2013, at 9:04 , Marc Brinkmann <marc.brinkmann@...il.com> wrote:
> > i have a Problem with my Server, working on and Office2010 Hash.
> > Yesterday i stopped the running job, pulled the latest GIT and
> re-compiled.
> >
> > I have not done this in 90 days i think, so the version i used before
> > should be from 6.6.2013.
> >
> > if i try to resume, it tells me:
> > $ ./john --restore
> > $ Loaded 1 password hash (Office 2007/2010 (SHA-1) / 2013 (SHA-512), with
> > AES [32/64 OpenSSL])
> > $ No password hashes left to crack (see FAQ)
> > I checked the FAQ, but i could not find an explanation for my problem.
> > I re-run office2john on my xlsx file and the hash was identical to the
> one
> > i worked on, before so i think it is still "correct".
> >
> > if i try to view the Password it tells me.
> > "0 password hashes cracked, 1 left"
> >
> > if i try to restore, it's the same. I also tried to start john with -i
> but
> > it always tells me, there is nothing to do.
> >
> > Can i do something to restore my session?
>
>
> That format has not had any real change since May 2. The input file does
> not contain the actual document, so could you post it here, or to me
> off-list? To fully anonymize it, you can pipe it through "cat -d: -f2".
> This will remove the file name and any GECOS data and just leave the hash.
>
> Please also include a copy of the 90 days .rec file.
>
> magnum
>

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.