John the Ripper password cracker users

Shashank Khanvilkar | 5 Oct 2005 18:55

Picon

Newbie question on jtc show

Hi,
I couldn't find any info on this.
I am trying to crack a windows2000/XP passwd file. I was able to extract 
information using pwdump2 and the dump file contains something like below:
--SNIP--`````````
#>cat passwd.2
Administrator:500:aad1b433b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d9e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
--SNIP--

I then used jtc as below
#>jtc passwd.2

it started doing something, spit out some messages (which i have no idea 
what they mean, where to get more doc on this)
finally when i stopped it and did
#>john -show passwd.2
Administrator:???????:500:31d6cfe0d16ae931b73c59d9e0c089c0:::
Guest:???????:501:31d6cfe0d16ae931b73c59d7e0c089c0:::
--SNIP--

what do these "???" signify

Any help appreciated.
Shashank

--

-- 
To unsubscribe, e-mail
john-users-unsubscribe@... and reply
to the automated confirmation request that will be sent to you.

(Continue reading)

Solar Designer | 5 Oct 2005 19:22

Re: Newbie question on jtc show

On Wed, Oct 05, 2005 at 11:55:55AM -0500, Shashank Khanvilkar wrote:
> I am trying to crack a windows2000/XP passwd file. I was able to extract 
> information using pwdump2 and the dump file contains something like below:
> --SNIP--`````````
> #>cat passwd.2
> Administrator:500:aad1b433b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d9e0c089c0:::
> Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
> --SNIP--

The above looks correct, although it appears that you've been re-typing
this (why?) and made two typos in the Administrator's password hash.

Both Guest and Administrator (with the typos corrected) have empty
passwords, and the current version of John the Ripper reports that
correctly.

> I then used jtc as below
> #>jtc passwd.2
> 
> it started doing something, spit out some messages (which i have no idea 
> what they mean, where to get more doc on this)

As the README says, "Cracked passwords will be printed to the terminal ..."
What you should have seen are the cracked passwords (or their halves) -
in this case just empty strings - followed by the corresponding usernames
in braces.

> finally when i stopped it and did
> #>john -show passwd.2
> Administrator:???????:500:31d6cfe0d16ae931b73c59d9e0c089c0:::

(Continue reading)

One21921 | 5 Oct 2005 20:00

Picon

Re: Newbie question on jtc show

Hi. I need help running john the ripper. Can you help me and show me how to 
install it?

Shashank Khanvilkar | 5 Oct 2005 22:51

Picon

Re: Newbie question on jtc show


>>--SNIP--`````````
>>#>cat passwd.2
>>Administrator:500:aad1b433b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d9e0c089c0:::
>>Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
>>--SNIP--
> 
> 
> The above looks correct, although it appears that you've been re-typing
> this (why?) and made two typos in the Administrator's password hash.

Yes I realised this just now. Some mistake.

> 
>>finally when i stopped it and did
>>#>john -show passwd.2
>>Administrator:???????:500:31d6cfe0d16ae931b73c59d9e0c089c0:::
>>Guest:???????:501:31d6cfe0d16ae931b73c59d7e0c089c0:::
>>--SNIP--
>>
>>what do these "???" signify
> 
> 
> John uses the question marks to indicate uncracked portions of
> partially-cracked passwords.  However, in your case this appears to be a
> bug in the version of John you're using.  What version was that?
> 
> There's a known bug like that in version 1.6.38 (and only in that
> version).  If that's what you were using, please upgrade to 1.6.39.
I changed the version and it seems to be working now.

(Continue reading)

Solar Designer | 6 Oct 2005 02:51

Re: Newbie question on jtc show

On Wed, Oct 05, 2005 at 09:22:23PM +0400, Solar Designer wrote:
> On Wed, Oct 05, 2005 at 11:55:55AM -0500, Shashank Khanvilkar wrote:
> > #>john -show passwd.2
> > Administrator:???????:500:31d6cfe0d16ae931b73c59d9e0c089c0:::
> > Guest:???????:501:31d6cfe0d16ae931b73c59d7e0c089c0:::
> > --SNIP--
> > 
> > what do these "???" signify
> 
> John uses the question marks to indicate uncracked portions of
> partially-cracked passwords.  However, in your case this appears to be a
> bug in the version of John you're using.  What version was that?

This was determined to be a bug in John 1.6 ("stable") in that it fails
to properly detect LM hashes of empty passwords when those hashes are
encoded with lowercase characters.  I believe the original PWDUMP used
all-uppercase characters.

This has been corrected shortly after John 1.6 release...  Yes, it's
high time I put out a John 1.7.

-- 
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598  fp: 6429 0D7E F130 C13E C929  6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments

Was I helpful?  Please give your feedback here: http://rate.affero.net/solar

--

-- 
To unsubscribe, e-mail

(Continue reading)

Heiko Schulz | 6 Oct 2005 22:18

Picon

problem with unafs

Hi:

I tried to use unafs to convert my kaserver.DB0 file, but it failed.
It works very well on an old kaserver.DB0 from Transarc AFS 3.4; so
I believe unafs is unable to handle newer openafs databases. Who can
help me? I tried the debian version 1.6.37 and john-1.6.39 from source.

Best regards
Heiko Schulz

-- 
Dr. Heiko Schulz
Fachbereich Mathematik
Systemadministration
Pfaffenwaldring 57
Raum 8.313
Universität Stuttgart

Tel.   : (0711) 685 5344
Fax    : (0711) 685 5348
E-Mail : schulz@...

--

-- 
To unsubscribe, e-mail
john-users-unsubscribe@... and reply
to the automated confirmation request that will be sent to you.

Lionel Cons | 7 Oct 2005 17:31

Picon

Picon

Re: problem with unafs

Heiko Schulz writes:
 > I tried to use unafs to convert my kaserver.DB0 file, but it failed.
 > It works very well on an old kaserver.DB0 from Transarc AFS 3.4; so
 > I believe unafs is unable to handle newer openafs databases. Who can
 > help me? I tried the debian version 1.6.37 and john-1.6.39 from source.

Heiko,

I've made some tests on my side and it seems that some kaserver.DB0
files created by OpenAFS contain incorrect header information.

Try the following patch, it works for me.

Cheers,

Lionel

--- unafs.c~    2002-04-10 16:13:25.000000000 +0200
+++ unafs.c     2005-10-07 17:29:49.000000000 +0200
 <at>  <at>  -41,6 +41,7  <at>  <at> 
        size =
                ((long)buffer[6] << 8) +
                (long)buffer[7];
+       if (size == 0) size = 64;
        if (fseek(file, size, SEEK_SET)) pexit("fseek");

        if (fread(buffer, 8, 1, file) != 1) return 1;

--

-- 
To unsubscribe, e-mail

(Continue reading)

O.A Anthony | 7 Oct 2005 20:09

Picon

Re: Newbie question on jtc show

yes

One21921@... wrote:Hi. I need help running john the ripper. Can you help me
and show me how to 
install it?

		
---------------------------------
Yahoo! for Good
 Click here to donate to the Hurricane Katrina relief effort.

Solar Designer | 9 Oct 2005 01:09

Re: problem with unafs

On Fri, Oct 07, 2005 at 05:31:54PM +0200, Lionel Cons wrote:
> I've made some tests on my side and it seems that some kaserver.DB0
> files created by OpenAFS contain incorrect header information.
> 
> Try the following patch, it works for me.

Thanks!  I've applied this patch to my tree for now, although it'd be
great to hear from Heiko that the patch works for him as well.

-- 
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598  fp: 6429 0D7E F130 C13E C929  6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments

--

-- 
To unsubscribe, e-mail
john-users-unsubscribe@... and reply
to the automated confirmation request that will be sent to you.

Heiko Schulz | 9 Oct 2005 13:48

Picon

Re: problem with unafs

On Sun, Oct 09, 2005 at 03:09:56AM +0400, Solar Designer wrote:
> On Fri, Oct 07, 2005 at 05:31:54PM +0200, Lionel Cons wrote:
> > I've made some tests on my side and it seems that some kaserver.DB0
> > files created by OpenAFS contain incorrect header information.
> > 
> > Try the following patch, it works for me.
> 
> Thanks!  I've applied this patch to my tree for now, although it'd be
> great to hear from Heiko that the patch works for him as well.
> 

It worked very well also for me.

Heiko

--

-- 
To unsubscribe, e-mail
john-users-unsubscribe@... and reply
to the automated confirmation request that will be sent to you.

Group

gmane.comp.security.openwall.john.user.

Project Web Page

John the Ripper password cracker users

Search Archive

Page

1 | 2 | 3 | 4 | 5

Articles in period: 41

October 2005

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

disabling retrieval of cracked passwords (23 May 2013)
Fuzzing with regular expressions (22 May 2013)
JtR OpenCL - AMD GPU not listed (22 May 2013)
Random passwords with modulo bias (21 May 2013)
How to limit the number of guesses? (20 May 2013)
md5(md5$pass).$salt) (19 May 2013)
invitation to john-users team for PHDays Hash Runner contest 23-24 May (19 May 2013)
Make issues with make clean macosx-x86-64-native (17 May 2013)
Cracking "Correct Horse Battery Staple" in JtR (9 May 2013)
JtR and SSH keys (4 May 2013)
issues with mpirun (2 May 2013)
Fwd: 'close' to getting opencl working (27 Apr 2013)
ssha cpu format (19 Apr 2013)
l33t rules improvement (16 Apr 2013)
Cisco ACS username: hash or crypt or.... and de-encoding? (12 Apr 2013)
Problem with keepass2john and KeePass 2.x kdbx (12 Apr 2013)
What am I doing wrong? (6 Apr 2013)
1Password agilekc2john.py (3 Apr 2013)
1Password agilekc2john.py (3 Apr 2013)
De-duping NT ruleset (31 Mar 2013)
Pipe/Stdin rule to append/prefix (27 Mar 2013)

Archives

66	May 2013
72	April 2013
63	March 2013
146	February 2013
104	January 2013
138	December 2012
177	November 2012
78	October 2012
109	September 2012
168	August 2012
177	July 2012
175	June 2012
103	May 2012
150	April 2012
106	March 2012
87	February 2012
122	January 2012
90	December 2011
74	November 2011
47	October 2011
119	September 2011
186	August 2011
121	July 2011
56	June 2011
90	May 2011
53	April 2011
112	March 2011
129	February 2011
58	January 2011
50	December 2010
51	November 2010
53	October 2010
98	September 2010
94	August 2010
52	July 2010
47	June 2010
26	May 2010
39	April 2010
160	March 2010
99	February 2010
29	January 2010
70	December 2009
20	November 2009
38	October 2009
75	September 2009
52	August 2009
114	July 2009
49	June 2009
10	May 2009
14	April 2009
13	March 2009
43	February 2009
37	January 2009
19	December 2008
21	November 2008
54	October 2008
34	September 2008
36	August 2008
42	July 2008
46	June 2008
22	May 2008
37	April 2008
31	March 2008
51	February 2008
68	January 2008
10	December 2007
35	November 2007
10	October 2007
47	September 2007
10	August 2007
25	July 2007
19	June 2007
30	May 2007
39	April 2007
65	March 2007
38	February 2007
56	January 2007
47	December 2006
10	November 2006
55	October 2006
34	September 2006
40	August 2006
40	July 2006
82	June 2006
125	May 2006
148	April 2006
76	March 2006
80	February 2006
56	January 2006
52	December 2005
38	November 2005
41	October 2005
46	September 2005
42	August 2005
11	July 2005
47	June 2005
36	May 2005
2	January 2005
1	September 2004

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template