[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAN4B4167Pn+8mkr_qZH9J+oKvkR4ajrzb0QB+qiPA40X=D3ifA@mail.gmail.com>
Date: Sat, 1 Aug 2015 23:48:45 +0200
From: Luis Rocha <luiscrocha@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: Why does john display some cracked passwords twice?
user@...kstation:/home/Downloads/JohnTheRipper/run$ ./john
John the Ripper 1.8.0.6-jumbo-1-587-gc6e3042 [linux-gnu 64-bit AVX2-ac]
user@...kstation:/home/Downloads/JohnTheRipper/run$ rm john.pot
user@...kstation:/home/Downloads/JohnTheRipper/run$ ./john
/home/data/hashes/2013cmiyc/2013cmiyc_dist/Company1/pro-hashes.8.txt
--fork=4 --wordlist=/home/data/wordlists/bestwordlist/allwords.txt
--format=descrypt
Using default input encoding: UTF-8
Loaded 1793 password hashes with 1471 different salts (descrypt,
traditional crypt(3) [DES 256/256 AVX2-16])
Node numbers 1-4 of 4 (fork)
Press 'q' or Ctrl-C to abort, almost any other key for status
acetabul (?)
acetabul (?)
acetabul (?)
acetabul (?)
aluminum (?)
aluminum (?)
americiu (?)
americiu (?)
americiu (?)
americiu (?)
americiu (?)
americiu (?)
anesthet (?)
anesthet (?)
anesthet (?)
anesthet (?)
antiquit (?)
antiquit (?)
antiquit (?)
antiquit (?)
antimony (?)
antimony (?)
antimony (?)
antimony (?)
antimony (?)
antimony (?)
aquarian (?)
aquarian (?)
astatine (?)
astatine (?)
astatine (?)
astatine (?)
3 11g 0:00:00:00 5.67% (ETA: 23:41:34) 11.11g/s 3103p/s 4888Kc/s 5966KC/s
athetisi..autophyt
1 6g 0:00:00:01 5.73% (ETA: 23:41:50) 5.940g/s 3041p/s 4791Kc/s 5850KC/s
atomized..autovacs
4 6g 0:00:00:01 5.71% (ETA: 23:41:50) 5.940g/s 3041p/s 4755Kc/s 5815KC/s
atlases..autotell
2 9g 0:00:00:01 5.71% (ETA: 23:41:50) 8.910g/s 3041p/s 4754Kc/s 5811KC/s
atlantes..autothei
Waiting for 3 children to terminate
Use the "--show" option to display all of the cracked passwords reliably
Session aborted
user@...kstation:/home/Downloads/JohnTheRipper/run$ ./john
/home/data/hashes/2013cmiyc/2013cmiyc_dist/Company1/pro-hashes.8.txt --show
?:astatine
?:aluminum
?:americiu
?:americiu
?:anesthet
?:antimony
?:aquarian
?:antimony
?:astatine
?:antiquit
?:americiu
?:acetabul
12 password hashes cracked, 1781 left
user@...kstation:/home/Downloads/JohnTheRipper/run$ cat john.pot | grep amer
7JpcP81ty/DMQ:americiu
QWyXv.xH/6Ip.:americiu
YsZ1t7vlDLPfg:americiu
7JpcP81ty/DMQ:americiu
QWyXv.xH/6Ip.:americiu
YsZ1t7vlDLPfg:americiu
user@...kstation:/home/Downloads/JohnTheRipper/run$ cat john.pot | grep
aceta
y4Z/1ZBLd0XBk:acetabul
y4Z/1ZBLd0XBk:acetabul
y4Z/1ZBLd0XBk:acetabul
y4Z/1ZBLd0XBk:acetabul
On Sat, Aug 1, 2015 at 11:36 PM, Rich Rumble <richrumble@...il.com> wrote:
> On Sat, Aug 1, 2015 at 5:28 PM, Rich Rumble <richrumble@...il.com> wrote:
> > On Sat, Aug 1, 2015 at 4:34 PM, Luis Rocha <luiscrocha@...il.com> wrote:
> >> Hello,
> >>
> >> I am not sure if it is related but I am seeing the same behavior. Please
> >> see below:
> >>
> >> user@...kstation:~/JohnTheRipper/run$ ./john
> >> /home/data/hashes/2013cmiyc/2013cmiyc_dist/Company1/pro-hashes.8.txt
> >> --fork=4 --wordlist=/home/data/wordlists/bestwordlist/allwords.txt
> >> --rules:Single --format=descrypt
> >> Using default input encoding: UTF-8
> >> Loaded 1793 password hashes with 1471 different salts (descrypt,
> >> traditional crypt(3) [DES 256/256 AVX2-16])
> >> Node numbers 1-4 of 4 (fork)
> >> Each node loaded 1/4 of wordfile to memory (about 661 KB/node)
> >> Press 'q' or Ctrl-C to abort, almost any other key for status
> >> acetabul (?)
> >> acetabul (?)
> >> acetabul (?)
> > When fork was first introduced as very alpha just before a certain
> > CMIYC, the same issue occurred I thought. Then it was fixed, in
> > addition to the duplicates there was an issue with not every fork
> > writing to the pot, but they would display stdout. I believe there was
> > a john.conf setting to log them until it was fixed... I don't recall
> > and I don't have those threads from contest. I wish I could find those
> > conversations... I'm going to try to reproduce with my binaries btw.
> I was unable to reproduce with a very recent version of jumbo, the
> passwords loaded are salted in the example above, so unless those
> hashes and salts are the same in the POT. Look in the POT to see if
> they are actually duplicates. You can see "repeats" on stdout with any
> hash, if john.pot is storing duplicates, then that is a problem. Again
> using --show or during cracking it's not unexpected to see duplicates,
> it is unexpected to see them in the POT.
> -rich
>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
