[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <49f042da1002121419s53ad7326pf4796506fa7a8368@mail.gmail.com>
Date: Fri, 12 Feb 2010 14:19:58 -0800
From: Anton <support3@...cast.net>
To: john-users@...ts.openwall.com
Subject: Multiple guesses for cracked hashes and no working password
Greetings,
I'm new to john and password recovering in general. I can not make out any
useful info out of the john guessed passwords, passwords provided are not
the one.
I need help understanding john's output and what is useful to me or what can
be ignored. Any input is greatly appriciated!
I've been learning on one of the Active Directory users.
I'm using John 1.7.0.1.
I am experimenting with the hash obtained from Windows 2003 DC. I used
pwddump to get the hashes.
The hashes look like this:
dar:1721:FBF279AE7CE2A2C197B57AF6F22B:A6D16E79FADB4A41E6DCBF387BEFC998:::
dar_history_0:172:879D21AEE0D96D88A3CF696C1:81297B5EDEA2A476F9CC9648D11E4360:::
dar_history_1:172:CBA33CD49AC21AA818381E4E281B:616A2901AC5A8C6ECFB8053289154A74:::
dar_history_2:172:C2C909A0DC09752A3293831D17:F694B8886C9997BB03BAB24656E014F2:::
dar_history_3:172:8F08A7A82292EAC541D19BC1646:B8018CE8E825756FE457C7A894B273CE:::
dar_history_4:172:2CEA139AA23AF651CA7A0DE4F362:2178C3041EA0EC17FACDA3AFF892CEA5:::
dar_history_5:172:2CEA139AA23AF651CA7A0DE4F362:2178C3041EA0EC17FACDA3AFF892CEA5:::
dar_history_6:172:9C9252BB08F5CB83B6B8F1BF552:697FEBA983C2C96E0982071AFED50431:::
dar_history_7:172:EA139AA23AF651CA7A0DE4F362:2178C3041EA0EC17FACDA3AFF892CEA5:::
dar_history_8:172:D0CF8F8740458666776101C2:37CB08DD45E5C53734AEDF915B3BB23A:::
When john was done with these, i got multiple password guesses, all appeared
in upper case (by design?):
C:\downloads\tmp\john1701\run>john-mmx emg1.txt
Loaded 20 password hashes with no different salts (NT LM DES [64/64 BS MMX])
3 (dar:2)
09 (dar:2)
009 (dar:2)
9 (dar:2)
983 (dar:2)
983 (dar:2)
983 (dar:2)
MAGANOV (dar:1)
RODITEL (dar:1)
A#1 (dar:2)
OME123 (dar:2)
IEDUT! (dar:2)
SOLNCE1 (dar:1)
SOLNCE1 (dar:1)
SOLNCE1 (dar:1)
VESNA20 (dar:1)
guesses: 16 time: 0:00:15:18 (3) c/s: 87730K trying: DR926T7 - DR926AA
IAMAWES (dar:1)
LETO200 (dar:1)
OSEN198 (dar:1)
guesses: 19 time: 0:00:22:34 (3) c/s: 67330K trying: C2MHJG3 - C2MRANZ
guesses: 19 time: 0:00:44:37 (3) c/s: 40347K trying: V8WLFO3 - V8WLFR0
guesses: 19 time: 0:00:55:52 (3) c/s: 34860K trying: Z1SYC0G - Z1SYCN2
RAZVOD2 (dar:1)
guesses: 20 time: 0:02:20:57 (3) c/s: 18674K trying: RAZVO9W - RAZVOK3
Now, if i used only the first hash
(dar:1721:FBF279AE7CE2A2C197B57AF6F22B:A6D16E79FADB4A41E6DCBF387BEFC998:::)
, not the history one, i got this:
\john1701\run>john-mmx.exe 1.txt
Loaded 1 password hash (NT LM DES [64/64 BS MMX])
IAMAWES (dar:1)
guesses: 1 time: 0:00:19:08 (3) c/s: 10216K trying: IAMAWT! - IAMAWHY
--
Kind Regards, Anton
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
