2010/1/17 Nick Baronian <[email protected]>: > Each hash has the LM and NTLM, even if the LM is disabled it is still > in the hash. 37*2
And 2 of them probably don't have hashes so that is why when trying to crack it only says it loaded 70. All makes sense now, thanks Robin > On Sun, Jan 17, 2010 at 10:54 AM, Robin Wood <[email protected]> wrote: >> Hi >> I'm trying to crack a file of windows cache passwords grabbed with >> fgdump using john and getting odd counts: >> >> $ wc -l /tmp/cache/sorted_dump >> 37 /tmp/cache/sorted_dump >> >> $ ~/src/john-1.7.3.4/run/john --wordlist=all_combined.txt >> /tmp/cache/sorted_dump >> Loaded 70 password hashes with no different salts (LM DES [128/128 BS >> SSE2-16]) >> guesses: 0 time: 0:00:00:00 100% c/s: 261994K trying: ZYZ - ZZZZZZZ >> >> $ ~/src/john-1.7.3.4/run/john --show /tmp/cache/sorted_dump >> 0 password hashes cracked, 74 left >> >> wc says there are 37 entries in the file >> john loads and says it is cracking 70 passwords >> john show says there are 74 left to crack. >> >> Any idea what is going on? >> >> Robin >> _______________________________________________ >> Pauldotcom mailing list >> [email protected] >> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom >> Main Web Site: http://pauldotcom.com >> > _______________________________________________ > Pauldotcom mailing list > [email protected] > http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom > Main Web Site: http://pauldotcom.com > _______________________________________________ Pauldotcom mailing list [email protected] http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom Main Web Site: http://pauldotcom.com
