I have the shadow file from an embedded device running linux. Trying to use John to crack it. There is only the 'root' hash in the shadow file.

12 seconds in, John finds the password for 'root', but the program hasn't stopped trying.

JohnFAQ says

"The four speed metrics are as follows: g/s is successful guesses per second (so it'll stay at 0 until at least one password is cracked)"

g/s is 0.07782@12 seconds. Does this mean the password has been cracked? If yes, why is it still trying?

<you don't need to know>:$ john --fork=4   shadow 
Created directory: <you don't need to know>.john
Loaded 1 password hash (md5crypt [MD5 32/64 X2])
Node numbers 1-4 of 4 (fork)
Press 'q' or Ctrl-C to abort, almost any other key for status
<root password>            (root)
4 1g 0:00:00:12 3/3 0.07770g/s 9250p/s 9250c/s 9250C/<you dont need to know>
3 0g 0:00:00:44 3/3 0g/s 13337p/s 13337c/s 13337C/s asdonn3..asdonta
1 0g 0:00:00:44 3/3 0g/s 9417p/s 9417c/s 9417C/s mammse..mamb23
2 0g 0:00:00:44 3/3 0g/s 9407p/s 9407c/s 9407C/s jojhe1..jojhoy
3 0g 0:00:00:46 3/3 0g/s 13414p/s 13414c/s 13414C/s jhoctri..jhoctre
1 0g 0:00:00:46 3/3 0g/s 9422p/s 9422c/s 9422C/s alazur..alazus
2 0g 0:00:00:46 3/3 0g/s 9412p/s 9412c/s 9412C/s 25075j..25074a
1 0g 0:00:00:48 3/3 0g/s 9426p/s 9426c/s 9426C/s jelola..jelold
2 0g 0:00:00:48 3/3 0g/s 9414p/s 9414c/s 9414C/s 12m_t..12m_1
3 0g 0:00:00:48 3/3 0g/s 13482p/s 13482c/s 13482C/s nhiro..nhiry
2 0g 0:00:00:49 3/3 0g/s 9416p/s 9416c/s 9416C/s clbeh..clbie
1 0g 0:00:00:49 3/3 0g/s 9427p/s 9427c/s 9427C/s cutt37..cutuxa
3 0g 0:00:00:49 3/3 0g/s 13511p/s 13511c/s 13511C/s staleesa..staleest
1 0g 0:00:00:53 3/3 0g/s 9433p/s 9433c/s 9433C/s tbj12..tbj14
Waiting for 3 children to terminate
3 0g 0:00:00:53 3/3 0g/s 13647p/s 13647c/s 13647C/s poott3..poott5
2 0g 0:00:00:53 3/3 0g/s 9421p/s 9421c/s 9421C/s mcala1..mcalas
Session aborted

From the documentation:

Similarly to "--node", there's almost no communication between the processes with "--fork". Hashes successfully cracked by one process continue being cracked by other processes. Just like with "--node", this is mostly OK for saltless hash types or when there's just one salt, but it is a serious drawback when many different salts are present and their number could potentially be decreasing as some hashes get cracked. To have the cracked hashes (and possibly salts) removed from all processes, you may interrupt and restore the session once in a while.

You started 4 processes based on your screen, the 4th one successfully cracked the hash, but the other 3 will continue. Note that the 4th process doesn't output anything anymore on your screen.

Processes 1-3 will most likely never find a match, since there would be no point to test the same passwords between different process, and a collision is highly unlikely.

  • 7
    Processes 1-3 will most likely never find a match, i mean, not in our lifetime, anyway. probably not in the lifetime of the components either, so you're probably correct. (btw nice reputation !) Jun 16 at 10:09
  • 1
    @user1067003 Too bad there's an egg in the middle of that leet.
    – Clockwork
    Jun 17 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.