1

I was trying the following commands

john --format=LM xpPassword.txt
john xpPassword.txt

to crack the following hash:

xpPassword.txt

Administrator:500:aad3b435b51404eeaad3b435b51404ee:15feae27e637cb98ffacdf0a840eeb4b:::
pentest:1003:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

So after cracking process, JTR gave me this result:

Loaded 2 password hashes with no different salts (LM [DES 64/64])
Press 'q' or Ctrl-C to abort, almost any other key for status
                 (pentest)
                 (Administrator)
2g 0:00:00:00 100% 2/3 6.451g/s 1141p/s 1141c/s 2283C/s 123456..MAGIC
Use the "--show" option to display all of the cracked passwords reliably
Session completed

But when I tried to see the password by using --show parameter as follows

john --show xpPassword.txt

JTR gave me just the hashes, not passwords, as can be seen in the following output.

Administrator::500:aad3b435b51404eeaad3b435b51404ee:15feae27e637cb98ffacdf0a840eeb4b:::
pentest::1003:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

2 password hashes cracked, 0 left

Although "2 password hashes cracked" is said, there is no any cracked password. What is the problem? Where is my fault?

1

It appears that John has cracked the Lan Manager (LM) hashes (the first parts) rather than the NT hashes (the second parts). As they are null in this case, there is nothing to crack and John has returned saying they are cracked.

You need to pass the --format=nt or --format=nt2 argument in order to crack the NT hashes.

|improve this answer|||||
  • You are rigth. I missed putting a password to the pentest user on XP machine. :S Thank you. Thereby, I learnt that if JTR gives aad3b435b51404eeaad3b435b51404ee as a output, that means there is no password for this account. Thank you again. – Hasan Feb 19 '16 at 20:18
  • But the --format=nt part of this answer is not related with my question. – Hasan Feb 19 '16 at 20:20
  • @has It is because if you cracked the NT hash you would have found it. – SilverlightFox Feb 20 '16 at 0:02
0

I realized that I missed to put password for pentest user on XP machine. When I put, everything has been OK.

New Output:

Administrator::500:aad3b435b51404eeaad3b435b51404ee:15feae27e637cb98ffacdf0a840eeb4b:::
Guest::501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
HelpAssistant::1000:aad3b435b51404eeaad3b435b51404ee:f638888c72f5c4e1a8f1e1270aaa6b85:::
IUSR_PENTEST-WINXP::1004:aad3b435b51404eeaad3b435b51404ee:f0a4854a729d96d5f8fddb3d144a9ee0:::
IWAM_PENTEST-WINXP::1005:aad3b435b51404eeaad3b435b51404ee:e4d4fc3f4174655f7884a06c27872477:::
pentest:PENTEST:1003:1e99d771a164613aaad3b435b51404ee:15feae27e637cb98ffacdf0a840eeb4b:::
SUPPORT_388945a0::1002:aad3b435b51404eeaad3b435b51404ee:4ad41e3eb3179b33e072f0c53e07d0db:::

Notice that pentest user's password was found as PENTEST above. The other accounts have no any password. Because of this, they return a hash which means NULL.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.