[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <554E762F.20307@web.de>
Date: Sat, 09 May 2015 22:03:43 +0100
From: Demian Smith <demian.smith@....de>
To: john-users@...ts.openwall.com
Subject: Re: Advise on best approach (truecrypt pw based on pdf
file)
Hi,
> If someone with a truecrypt encrypted Windows system partition can
> verify that the known password works when running truecrypt2john and
> john, then there is obviously no need to share any more details than
> just confirming that it worked.
> Is that a truecrypt encrypted Windows System partition, or just a normal
> partition or truecrypt volume?
In this case it's not a windows partition but an external RAID1, fully
disk encryption with truecrypt. I did create a full encrypted second
device (USB flash key) and truecrypt2john was extracting hashes and did
find the correct "guess2 from a wordlist. However, the RAID had been
encrypted on Windows, whereas the flash key has been done on linux.
Should this matter?
> If that's it, we can create permutation rules tailored for this and should be able to crack it. I think you should concentrate on this for a while before resuming that incremental run.
Thanks for the pointer, I will look into these - I did not yet use them
at all up till now.
> Note that it still says 44.21p/s here but that's just the average speed from job start so this figure will now increase slowly towards your new faster figure.
I was wondering about this, but (naturally) you're right and the number
keeps slowly climbing up.
> Let's concentrate on wordlist rules. If it's indeed a partial sentence, would you think it's truncated in the end and still starting with an uppercase letter?
It does start with a upper case letter, that's for sure. If I understand
correctly, it would have been truncated at the end - if the original
sentence would have been
> To be or not to be, that is the question, and indeed a question which
shall
> be answered, by this circle of fine man who gathered on this moonlit
December night
It would be any of these
Tbontb
Tbontbtistq
Tbontbtistqaiaqwsba
Tbontbtistqaiaqwsbabtcofm
and so on.
I have tried replacing "and" with a fullstop to force a linebreak with
sed, but this would not work if it would have been two ands in a
sentence or a comma ...
> Also, how large (number of lines) is that wordlist? Did you try just running it with --rules (and perhaps --rules=single in another run)?
The list I have created by removing all lines starting with non capital
letters is a whopping 3803 lines long, but the last lines are in the
ranks of 50 and more chars (the longest being 97 chars).
After your pointer towards rules I have now cut the lines at 20 chars
and am running it with the rules on the wordlist. I've not worked with
rules either, would I have to write some useful ones (for my case) first?
Cheers,
Demian
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
