odd password counts with john

[jim.halfpenny at gmail.com (Jim Halfpenny)]

Do you have multiple hashes of the same password in the dump? You could have
37 accounts and 74 hashes if you have lanman and NTLM hashes.

Jim

2010/1/17 Robin Wood <dninja at gmail.com>

> Hi
> I'm trying to crack a file of windows cache passwords grabbed with
> fgdump using john and getting odd counts:
>
> $ wc -l /tmp/cache/sorted_dump
> 37 /tmp/cache/sorted_dump
>
> $ ~/src/john-1.7.3.4/run/john --wordlist=all_combined.txt
> /tmp/cache/sorted_dump
> Loaded 70 password hashes with no different salts (LM DES [128/128 BS
> SSE2-16])
> guesses: 0  time: 0:00:00:00 100%  c/s: 261994K  trying: ZYZ - ZZZZZZZ
>
> $ ~/src/john-1.7.3.4/run/john --show /tmp/cache/sorted_dump
> 0 password hashes cracked, 74 left
>
> wc says there are 37 entries in the file
> john loads and says it is cracking 70 passwords
> john show says there are 74 left to crack.
>
> Any idea what is going on?
>
> Robin
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom at mail.pauldotcom.com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.pauldotcom.com/pipermail/pauldotcom/attachments/20100117/f90356ef/attachment.htm