[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <BANLkTimH8F8ybah7byY2yMgBjFNJKiMH0A@mail.gmail.com>
Date: Wed, 6 Apr 2011 13:15:58 -0400
From: Rich Rumble <richrumble@...il.com>
To: john-users@...ts.openwall.com
Cc: Papa Tango <papatango.nyc@...il.com>
Subject: Re: exhausted all lanman hashes -- error? -- newbie Q
On Wed, Apr 6, 2011 at 9:48 AM, Papa Tango <papatango.nyc@...il.com> wrote:
> Most recently however, I attempted the same for a very old machine that had
> been running windows 2000. I let John run for 22 days before it apparently
> exhausted all possible passwords and ended itself. It found "(guest)" as a
> password for a guest account...or perhaps I misinterpreted the on-screen
> output and the guest account had no password at all. Other than that, it
> found no other passwords. My pawdump file included an administrator password
> hash that has a LANMAN hash.
The guest account password defaults to none/blank/no-password which is the
hash of: AAD3B435B51404EEAAD3B435B51404EE for LM and
31D6CFE0D16AE931B73C59D7E0C089C0 for NT.
A password of "guest" would be
A0E150C75A17008EAAD3B435B51404EE (lm)
823893ADFAD2CDA6E1A414F3EBDF58F7 (nt)
John doesn't do an exhaustive bruteforce, but rather tries to be
faster by picking
more likely passwords once the incremental mode is being used.
You can try more wordlists aka a bigger dictionary, better rules to
try against the
passwords, or even do an exhaustive BF against the password. Rainbow tables
may prove to help you more, you can submit the hash to a number of free
rainbow table sites that have precomputed 99.99% of all possible LM hashes
and see if you get a return on them.
I typically use the following commands when I begin a new attack against
passwords:
John.exe c:\hashes.txt –format=nt –session=nt-wordlist
-w=dictionary.txt -rules=single
John.exe c:\hashes.txt –format=nt –session=nt-wordlist
-w=dictionary.txt -rules=wordlist
This uses keyboard patterns (qwertyhgfdsa, qazwsxedc etc...)
John.exe c:\hashes.txt –format=nt –session=nt-keyboard-hashes
--external=keyboard
This uses bruteforce (a, aa, ab, ac, ad...aaaa, aaab, aaac etc...)
John.exe c:\hashes.txt –format=nt –session=nt-dumbforce-hashes
--external=dumbforce
The JtR website has links to various wordlist/dictionaries.
-rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
