john the ripper output

[Hari Sekhon]

Hi,
I want to leave jtr running do crack a whole bunch of passwords and
I'm having trouble with how to do the output. I'm trying to do:

./john passwordfile > john.progress 2>&1 &

but this outputs nothing to the file john.progress while it's running
and only dumps all it's output to the file when the program finished
which isn't so useful if I'm gonna leave it running for days and wanna
tail that file once in a while....

I believe this must be a john thing since this works for other programs...

Can anybody tell me how to do this?

[John Smith]

Post by Hari Sekhon
Can anybody tell me how to do this?

I find the command "nohup" (man nohup) useful. It detaches the process
from the terminal and logs everything to a default file of nohup.out.

-J.S.

[Hari Sekhon]

I've tried that but the same problem occurs which is why I stopped using
nohup.

The output file nohup.out is also empty until john the ripper finishes at
which time it fills up with the output of what it cracked. But this defeats
the purpose, if it's cracking tonnes of passwords, I don't want to have to
wait days or weeks to actually see the results of the ones it's already
cracked.

Post by John Smith

Post by Hari Sekhon
Can anybody tell me how to do this?

I find the command "nohup" (man nohup) useful. It detaches the process
from the terminal and logs everything to a default file of nohup.out.
-J.S.
--
to the automated confirmation request that will be sent to you.

[r***@public.gmane.org]

Post by Hari Sekhon
the purpose, if it's cracking tonnes of passwords, I don't want to have to
wait days or weeks to actually see the results of the ones it's already
cracked.

Run it in a screen and then press ENTER...

godfather $ john --restore
Loaded 21 password hashes with 21 different salts (FreeBSD MD5 [32/64 X2])
guesses: 0 time: 46:05:35:51 c/s: 3824 trying: sorland - sorlan1

If it found some passwords open another screen and do a john --show &file.
Feel free to press enter as offen as you wanna know if there are new
Passwords. :-)

Kind regards,
Rembrandt

p.s.
I noticed the behavior with nohup and co too.. :-)

[Hendrik May]

Post by Hari Sekhon
I've tried that but the same problem occurs which is why I stopped using
nohup.
The output file nohup.out is also empty until john the ripper finishes at
which time it fills up with the output of what it cracked. But this defeats
the purpose, if it's cracking tonnes of passwords, I don't want to have to
wait days or weeks to actually see the results of the ones it's already
cracked.

Post by John Smith

Post by Hari Sekhon
Can anybody tell me how to do this?

I find the command "nohup" (man nohup) useful. It detaches the process
from the terminal and logs everything to a default file of nohup.out.
-J.S.
--
to the automated confirmation request that will be sent to you.

iŽm not really sure if john writes the john.pot while its running, but
you could try running another instance of john with the option -show.
like this:
john -show passfile

[Frank Dittrich]

Post by Hendrik May
not really sure if john writes the john.pot while its running,

Of course, john is savin the passwords in john.pot while running.
(IIRC, every 10 minutes.)
John also stores the current state in the .rec file and logs the
progress in the .log file. (john.rec and john.log being the default,
unless you use --session=session_name.)

just tail -f the log file and john.pot for progress info, or
use john --show pwfile or john --status [ --session=session_name ]

If you want to see the current status, and not one which is
up to 10 minutes old, use kill -s 1 pid_of_john_session
before using john --show pwfile.

Regards, Frank

[Frank Dittrich]

Post by Frank Dittrich
use john --show pwfile or john --status [ --session=session_name ]

I even got this simple example wrong. (it is --status=NAME)
Just use john without any parameters,
and/or read the documentation to find out correct usage examples.
(What about converting the files in the doc subdirectory
into a man page?)

Frank

[Hari Sekhon]

I find that john --show passwdfile works best. The john.pot and john.log
don't give useful information pairings of username/passwords. john.pot
holds passwords and hashes, which is fine to look at if the username is
the same as the password but a bit of a guessing game otherwise...

Thanks for the help guys...

Ps. It would be better if john sent it's output as it's going along the
same way that most unix programs do so that I could do

./john passwdfile > john.progressfile 2>&1 &

and then just tail -f the john.progressfile. Or even better to nohup
john and then you could log off/close ssh session etc and ssh back into
it some time/days later and do the tail -f...

I think this would improve the ability to run jtr. I'll make it a
feature request to SolarDesigner...

Post by Frank Dittrich

Post by Frank Dittrich
use john --show pwfile or john --status [ --session=session_name ]

I even got this simple example wrong. (it is --status=NAME)
Just use john without any parameters,
and/or read the documentation to find out correct usage examples.
(What about converting the files in the doc subdirectory
into a man page?)
Frank

[Solar Designer]

Post by Hari Sekhon
I find that john --show passwdfile works best.

This is what you're supposed to be using. In fact, it's the only
documented way to obtain the cracked passwords.

Post by Hari Sekhon
The john.pot and john.log
don't give useful information pairings of username/passwords. john.pot
holds passwords and hashes, which is fine to look at if the username is
the same as the password but a bit of a guessing game otherwise...

john.pot is a file that John uses internally. It is machine-friendly,
not human-friendly. "john --show" may also display more cracked users
(e.g., if the same password hash is shared for several users, john.pot
may have it listed only once, but "john --show" will display the
password for all of the affected users) and it will combine any partial
hashes (those are stored in john.pot on separate lines).

The output of John while it is running may also not include all of the
cracked passwords, so you should not be relying on it for that. In
particular, this may happen when the same password hash is shared for
multiple users and you're running John in other than "single crack" or
batch modes. In those cases, John would simply not load the duplicate
instances of the hash for cracking - yet a subsequent "john --show" run
would correctly display all of the users whose passwords get cracked.

Post by Hari Sekhon
Ps. It would be better if john sent it's output as it's going along the
same way that most unix programs do

Actually, John works _exactly_ the same way that most other Unix
programs do. This buffering of program output is performed by most C
libraries, and programs have to explicitly ask the library to not buffer
their output or to line-buffer it (instead of buffering fixed amounts of
data) if they want to. Most programs don't change the default.

Maybe John should be explicitly line-buffering its standard output,
although that would slow things down in those special cases when John
produces a lot of output (successfully cracking thousands of passwords
per second).

Post by Hari Sekhon
so that I could do
./john passwdfile > john.progressfile 2>&1 &
and then just tail -f the john.progressfile. Or even better to nohup
john and then you could log off/close ssh session etc and ssh back into
it some time/days later and do the tail -f...

This has already been suggested: use GNU screen.

You do need to use "john --show" to get at the actual cracked passwords
anyway.
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments

Was I helpful? Please give your feedback here: http://rate.affero.net/solar

[Hari Sekhon]

When running nohup ./john passwdfile &, how can I found out the speed of
the cracking the way you can when you just run ./john passwdfile and
press enter to see what it is trying and how many combinations a second
is is doing..?

I'm interested because I'm running hashes on two machines, a lame Via
1Ghz and my own Athlon XP 2200.

Post by Solar Designer

Post by Hari Sekhon
I find that john --show passwdfile works best.

This is what you're supposed to be using. In fact, it's the only
documented way to obtain the cracked passwords.

Post by Hari Sekhon
The john.pot and john.log
don't give useful information pairings of username/passwords. john.pot
holds passwords and hashes, which is fine to look at if the username is
the same as the password but a bit of a guessing game otherwise...

john.pot is a file that John uses internally. It is machine-friendly,
not human-friendly. "john --show" may also display more cracked users
(e.g., if the same password hash is shared for several users, john.pot
may have it listed only once, but "john --show" will display the
password for all of the affected users) and it will combine any partial
hashes (those are stored in john.pot on separate lines).
The output of John while it is running may also not include all of the
cracked passwords, so you should not be relying on it for that. In
particular, this may happen when the same password hash is shared for
multiple users and you're running John in other than "single crack" or
batch modes. In those cases, John would simply not load the duplicate
instances of the hash for cracking - yet a subsequent "john --show" run
would correctly display all of the users whose passwords get cracked.

Post by Hari Sekhon
Ps. It would be better if john sent it's output as it's going along the
same way that most unix programs do

Actually, John works _exactly_ the same way that most other Unix
programs do. This buffering of program output is performed by most C
libraries, and programs have to explicitly ask the library to not buffer
their output or to line-buffer it (instead of buffering fixed amounts of
data) if they want to. Most programs don't change the default.
Maybe John should be explicitly line-buffering its standard output,
although that would slow things down in those special cases when John
produces a lot of output (successfully cracking thousands of passwords
per second).

Post by Hari Sekhon
so that I could do
./john passwdfile > john.progressfile 2>&1 &
and then just tail -f the john.progressfile. Or even better to nohup
john and then you could log off/close ssh session etc and ssh back into
it some time/days later and do the tail -f...

This has already been suggested: use GNU screen.
You do need to use "john --show" to get at the actual cracked passwords
anyway.

[Simon Marechal]

Post by Hari Sekhon
When running nohup ./john passwdfile &, how can I found out the speed of
the cracking the way you can when you just run ./john passwdfile and
press enter to see what it is trying and how many combinations a second
is is doing..?

as explained previously it's easier to use a "screen". If you want to do
this, you'll have to alter signal.c and register a new signal handler
that will do:

event_status = event_pending = 1;

or something like that :)

[Simon Marechal]

Post by Simon Marechal

Post by Hari Sekhon
When running nohup ./john passwdfile &, how can I found out the speed of
the cracking the way you can when you just run ./john passwdfile and
press enter to see what it is trying and how many combinations a second
is is doing..?

as explained previously it's easier to use a "screen". If you want to do
this, you'll have to alter signal.c and register a new signal handler
event_status = event_pending = 1;
or something like that :)

... and send the proper signal to the john process. This will not be a
keystroke!

[Hari Sekhon]

ok, I haven't used GNU Screen before so I guess I'd better give it a try...

thanks!

Post by Simon Marechal

Post by Hari Sekhon
When running nohup ./john passwdfile &, how can I found out the speed of
the cracking the way you can when you just run ./john passwdfile and
press enter to see what it is trying and how many combinations a second
is is doing..?

as explained previously it's easier to use a "screen". If you want to do
this, you'll have to alter signal.c and register a new signal handler
event_status = event_pending = 1;
or something like that :)

[Solar Designer]

Post by Hari Sekhon
When running nohup ./john passwdfile &, how can I found out the speed of
the cracking the way you can when you just run ./john passwdfile and
press enter to see what it is trying and how many combinations a second
is is doing..?

Use "john --status". This will give you the combinations per second,
but not the particular candidate passwords being tried.

To get the most up to date information out of the running John, send it
a SIGHUP (e.g., with "killall -HUP john") right before you request the
status.
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments

Was I helpful? Please give your feedback here: http://rate.affero.net/solar

[Hari Sekhon]

thank you very much :-)

Post by Solar Designer

Post by Hari Sekhon
When running nohup ./john passwdfile &, how can I found out the speed of
the cracking the way you can when you just run ./john passwdfile and
press enter to see what it is trying and how many combinations a second
is is doing..?

Use "john --status". This will give you the combinations per second,
but not the particular candidate passwords being tried.
To get the most up to date information out of the running John, send it
a SIGHUP (e.g., with "killall -HUP john") right before you request the
status.

[Solar Designer]

Post by Frank Dittrich
(What about converting the files in the doc subdirectory
into a man page?)

Yes, I've been meaning to do it for 1.7, but didn't find the time. I
don't think everything should be rolled into the man page, but at least
the command-line options should be there.

Debian have a man page for John originally based on 1.6 docs, so it's
not great.
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments

Was I helpful? Please give your feedback here: http://rate.affero.net/solar

[Hari Sekhon]

special thanks to Hendrik for the solution... this turns out to be the
best way of mimicking the tail -f standard unix way of doing it...

Post by Hari Sekhon
I've tried that but the same problem occurs which is why I stopped using
nohup.
The output file nohup.out is also empty until john the ripper
finishes at
which time it fills up with the output of what it cracked. But this defeats
the purpose, if it's cracking tonnes of passwords, I don't want to have to
wait days or weeks to actually see the results of the ones it's already
cracked.

Post by John Smith

Post by Hari Sekhon
Can anybody tell me how to do this?

I find the command "nohup" (man nohup) useful. It detaches the process
from the terminal and logs everything to a default file of nohup.out.
-J.S.
--
reply
to the automated confirmation request that will be sent to you.

i´m not really sure if john writes the john.pot while its running, but
you could try running another instance of john with the option -show.
john -show passfile

[Realin]

guyzz.. i am a new user to list, so a big hi to all.. i have been reading
all the mails since long. well guyz need to ask u something.. I have got a
SAM file with me.. and i wanna crack pass outta that..

i know it is a noobie woobie question for u, but for me that would be an
achievment.. i have download the binary pack from www.openwall.com and
extracted it, there by i got two folders RUN and DOC, ofcourse i went to
command line and tried using switches with the john-386.exe but was not able
to get anythin useful..

Simply guide me what do i do with this JOHN if i want to get the pass outta
this SAM file.. it includes syskey hashes also as i got that SAM file from
some service pack2 machine..

thanks & regards
Realin !

[r***@public.gmane.org]

Post by Realin
guyzz.. i am a new user to list, so a big hi to all.. i have been reading
all the mails since long. well guyz need to ask u something.. I have got a
SAM file with me.. and i wanna crack pass outta that..
i know it is a noobie woobie question for u, but for me that would be an
achievment.. i have download the binary pack from www.openwall.com and
extracted it, there by i got two folders RUN and DOC, ofcourse i went to
command line and tried using switches with the john-386.exe but was not able
to get anythin useful..
Simply guide me what do i do with this JOHN if i want to get the pass outta
this SAM file.. it includes syskey hashes also as i got that SAM file from
some service pack2 machine..
thanks & regards
Realin !

To break the syskey you need the "syskey".
Windows stores it (per default) in a file called "system".

You`ll be able to decrypt the syskey with these lines (wich are a bad hack
imho but it works):

*attached*

I thought about "recoding" it to improve the quality and submit a "unsam"
tool for john (like unshadow) but I didn`t had the time yet.

You may need to modify it (depends to ya gcc version).


If you decrypted the SAM file (removing the syskey) you should be able to
dump the passwords easily with pwdump2 or something like this.
I thought about including this function also in the "unsam"-tool but as I
said: I had no time yet :-/


Kind regards,
Rembrandt

[Realin]

help is appreciated, but i m on winxp :(

isnt there any tool for XP

[r***@public.gmane.org]

Post by Realin
help is appreciated, but i m on winxp :(
isnt there any tool for XP

In fact there is NO tool wich does what the code I (had) attached would do..
you may wanna install cygwin and try if it compiles.. have fun. :-D


Kind regards,
Rembrandt

[Solar Designer]

I've been asking this before, but I'll repeat:

Whenever you post something on a new topic, please be sure to post it as
an entirely new message - _not_ by hitting "Reply" on someone else's
posting. Please also make sure to set a descriptive message Subject.

If you see that someone else has not followed this procedure, but you'd
like to comment on their message, please change the Subject (like I did
now), but do not break the existing thread (so "Reply" to the message).

Post by Realin
guyzz.. i am a new user to list, so a big hi to all.. i have been reading
all the mails since long. well guyz need to ask u something.. I have got a
SAM file with me.. and i wanna crack pass outta that..
i know it is a noobie woobie question for u, but for me that would be an
achievment.. i have download the binary pack from www.openwall.com and
extracted it, there by i got two folders RUN and DOC, ofcourse i went to
command line and tried using switches with the john-386.exe but was not able
to get anythin useful..

This is irrelevant to your question, but you should not be using
john-386.exe on modern systems. It is for ancient ones.

Use john-mmx.exe instead.

Post by Realin
Simply guide me what do i do with this JOHN if i want to get the pass outta
this SAM file.. it includes syskey hashes also as i got that SAM file from
some service pack2 machine..

There's a collection of tools which you can use here:

ftp://ftp.openwall.com/pub/projects/john/contrib/win32/pwdump/

This includes programs to dump SAM files in PWDUMP format and to undo
the effect of SYSKEY.

Please let us all know which one(s) of these have worked better for you.

I don't "do" Windows myself, so I can't recommend a specific procedure
for you to follow.
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments

Was I helpful? Please give your feedback here: http://rate.affero.net/solar

[Realin]

Sorry to reply you late guyz.. i was outta town. juz wanted to tell u the
tools I tried on FTP but none of them is able to remove syskey outta my SAM
file.

They are different versions of pwdump. but i have no acccess to admin
account at my college, so cant use pwdump to extract Hash files through
lssas.exe

help me

thanks and regards!

Post by Solar Designer
Whenever you post something on a new topic, please be sure to post it as
an entirely new message - _not_ by hitting "Reply" on someone else's
posting. Please also make sure to set a descriptive message Subject.
If you see that someone else has not followed this procedure, but you'd
like to comment on their message, please change the Subject (like I did
now), but do not break the existing thread (so "Reply" to the message).

Post by Realin
guyzz.. i am a new user to list, so a big hi to all.. i have been

reading

Post by Realin
all the mails since long. well guyz need to ask u something.. I have got

a

Post by Realin
SAM file with me.. and i wanna crack pass outta that..
i know it is a noobie woobie question for u, but for me that would be an
achievment.. i have download the binary pack from www.openwall.com and
extracted it, there by i got two folders RUN and DOC, ofcourse i went to
command line and tried using switches with the john-386.exe but was not

able

Post by Realin
to get anythin useful..

This is irrelevant to your question, but you should not be using
john-386.exe on modern systems. It is for ancient ones.
Use john-mmx.exe instead.

Post by Realin
Simply guide me what do i do with this JOHN if i want to get the pass

outta

Post by Realin
this SAM file.. it includes syskey hashes also as i got that SAM file

from

Post by Realin
some service pack2 machine..

ftp://ftp.openwall.com/pub/projects/john/contrib/win32/pwdump/
This includes programs to dump SAM files in PWDUMP format and to undo
the effect of SYSKEY.
Please let us all know which one(s) of these have worked better for you.
I don't "do" Windows myself, so I can't recommend a specific procedure
for you to follow.
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments
http://rate.affero.net/solar
--
to the automated confirmation request that will be sent to you.

--
<< Realin Wuz Here >>

[r***@public.gmane.org]

Please read in the archives.
I attached some src wich is able to do this some days ago.

Post by Realin
Sorry to reply you late guyz.. i was outta town. juz wanted to tell u the
tools I tried on FTP but none of them is able to remove syskey outta my SAM
file.

Rembrandt

[Hari Sekhon]

naughty boy trying to break into college computers, eh?

I don't think jtr was designed for this.... pwdump certainly wasn't
since you need to have admin rights to do this in the first place.

Post by Realin
Sorry to reply you late guyz.. i was outta town. juz wanted to tell u the
tools I tried on FTP but none of them is able to remove syskey outta my SAM
file.
They are different versions of pwdump. but i have no acccess to admin
account at my college, so cant use pwdump to extract Hash files through
lssas.exe
help me
thanks and regards!

Post by Solar Designer
Whenever you post something on a new topic, please be sure to post it as
an entirely new message - _not_ by hitting "Reply" on someone else's
posting. Please also make sure to set a descriptive message Subject.
If you see that someone else has not followed this procedure, but you'd
like to comment on their message, please change the Subject (like I did
now), but do not break the existing thread (so "Reply" to the message).

Post by Realin
guyzz.. i am a new user to list, so a big hi to all.. i have been

reading

Post by Realin
all the mails since long. well guyz need to ask u something.. I have got

a

Post by Realin
SAM file with me.. and i wanna crack pass outta that..
i know it is a noobie woobie question for u, but for me that would be an
achievment.. i have download the binary pack from www.openwall.com and
extracted it, there by i got two folders RUN and DOC, ofcourse i went to
command line and tried using switches with the john-386.exe but was not

able

Post by Realin
to get anythin useful..

This is irrelevant to your question, but you should not be using
john-386.exe on modern systems. It is for ancient ones.
Use john-mmx.exe instead.

Post by Realin
Simply guide me what do i do with this JOHN if i want to get the pass

outta

Post by Realin
this SAM file.. it includes syskey hashes also as i got that SAM file

from

Post by Realin
some service pack2 machine..

ftp://ftp.openwall.com/pub/projects/john/contrib/win32/pwdump/
This includes programs to dump SAM files in PWDUMP format and to undo
the effect of SYSKEY.
Please let us all know which one(s) of these have worked better for you.
I don't "do" Windows myself, so I can't recommend a specific procedure
for you to follow.
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments
http://rate.affero.net/solar
--
to the automated confirmation request that will be sent to you.

--
<< Realin Wuz Here >>