Each hash has the LM and NTLM, even if the LM is disabled it is still in the hash. 37*2
On Sun, Jan 17, 2010 at 10:54 AM, Robin Wood <[email protected]> wrote: > Hi > I'm trying to crack a file of windows cache passwords grabbed with > fgdump using john and getting odd counts: > > $ wc -l /tmp/cache/sorted_dump > 37 /tmp/cache/sorted_dump > > $ ~/src/john-1.7.3.4/run/john --wordlist=all_combined.txt > /tmp/cache/sorted_dump > Loaded 70 password hashes with no different salts (LM DES [128/128 BS > SSE2-16]) > guesses: 0 time: 0:00:00:00 100% c/s: 261994K trying: ZYZ - ZZZZZZZ > > $ ~/src/john-1.7.3.4/run/john --show /tmp/cache/sorted_dump > 0 password hashes cracked, 74 left > > wc says there are 37 entries in the file > john loads and says it is cracking 70 passwords > john show says there are 74 left to crack. > > Any idea what is going on? > > Robin > _______________________________________________ > Pauldotcom mailing list > [email protected] > http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom > Main Web Site: http://pauldotcom.com > _______________________________________________ Pauldotcom mailing list [email protected] http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom Main Web Site: http://pauldotcom.com
