[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANWtx0094MjCHPcKRTVkHhTDKVyNstJykgHcBrPfYxznoQ+=pg@mail.gmail.com>
Date: Thu, 13 Sep 2012 08:28:14 -0400
From: Rich Rumble <richrumble@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: Re: Help for JTR
On Thu, Sep 13, 2012 at 3:20 AM, Jonathan Xiao
<bravowarrior5203@...il.com> wrote:
> Hi Rich,
>
> If it's based on the following hash input, can I safely say that the
> password is of length 7 characters or below?
The 2 halves are still two 16 character lengths each, the hash length
is fixed, most hashes are, but not all.
password12345 = e52cac67419a9a22 (PASSWOR) and e1c7c53891cb0efa (D12345)
The password is "cut" into two halves, so you can crack PASSWOR and
D12345 much faster than the longer 13 character password. I wrote them
in uppercase because they are converted, even if the input is
lowercase on input. NTLM will preserve the proper case and use the
entire password as it was input.
Cain&Abel has a hash calculator and you can see, that calculator will
only hash the first 7 characters for LM, but most others have much
higher limits. If the password exceeds 14 characters windows will
store the null hash (aad3b435b51404ee). It will have that value
repeated so it's 32 characters long, and only the NTLM hash is
accurate. In vista and beyond the LM hash is no longer enabled by
default, it can be turned back on, but that only makes it easier for
an attacker if the password is under 15 characters.
-rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
