I was trying the following commands

john --format=LM xpPassword.txt
john xpPassword.txt

to crack the following hash:



So after cracking process, JTR gave me this result:

Loaded 2 password hashes with no different salts (LM [DES 64/64])
Press 'q' or Ctrl-C to abort, almost any other key for status
2g 0:00:00:00 100% 2/3 6.451g/s 1141p/s 1141c/s 2283C/s 123456..MAGIC
Use the "--show" option to display all of the cracked passwords reliably
Session completed

But when I tried to see the password by using --show parameter as follows

john --show xpPassword.txt

JTR gave me just the hashes, not passwords, as can be seen in the following output.


2 password hashes cracked, 0 left

Although "2 password hashes cracked" is said, there is no any cracked password. What is the problem? Where is my fault?


2 Answers 2


It appears that John has cracked the Lan Manager (LM) hashes (the first parts) rather than the NT hashes (the second parts). As they are null in this case, there is nothing to crack and John has returned saying they are cracked.

You need to pass the --format=nt or --format=nt2 argument in order to crack the NT hashes.

  • You are rigth. I missed putting a password to the pentest user on XP machine. :S Thank you. Thereby, I learnt that if JTR gives aad3b435b51404eeaad3b435b51404ee as a output, that means there is no password for this account. Thank you again.
    – Hasan
    Feb 19, 2016 at 20:18
  • But the --format=nt part of this answer is not related with my question.
    – Hasan
    Feb 19, 2016 at 20:20
  • @has It is because if you cracked the NT hash you would have found it. Feb 20, 2016 at 0:02

I realized that I missed to put password for pentest user on XP machine. When I put, everything has been OK.

New Output:


Notice that pentest user's password was found as PENTEST above. The other accounts have no any password. Because of this, they return a hash which means NULL.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .