odd password counts with john

[dninja at gmail.com (Robin Wood)]

2010/1/17 Nick Baronian <nbaronian at gmail.com>:
> Each hash has the LM and NTLM, even if the LM is disabled it is still
> in the hash. 37*2

And 2 of them probably don't have hashes so that is why when trying to
crack it only says it loaded 70.

All makes sense now, thanks

Robin

> On Sun, Jan 17, 2010 at 10:54 AM, Robin Wood <dninja at gmail.com> wrote:
> > Hi
> > I'm trying to crack a file of windows cache passwords grabbed with
> > fgdump using john and getting odd counts:
> >
> > $ wc -l /tmp/cache/sorted_dump
> > 37 /tmp/cache/sorted_dump
> >
> > $ ~/src/john-1.7.3.4/run/john --wordlist=all_combined.txt /tmp/cache/sorted_dump
> > Loaded 70 password hashes with no different salts (LM DES [128/128 BS SSE2-16])
> > guesses: 0 ?time: 0:00:00:00 100% ?c/s: 261994K ?trying: ZYZ - ZZZZZZZ
> >
> > $ ~/src/john-1.7.3.4/run/john --show /tmp/cache/sorted_dump
> > 0 password hashes cracked, 74 left
> >
> > wc says there are 37 entries in the file
> > john loads and says it is cracking 70 passwords
> > john show says there are 74 left to crack.
> >
> > Any idea what is going on?
> >
> > Robin
> > _______________________________________________
> > Pauldotcom mailing list
> > Pauldotcom at mail.pauldotcom.com
> > http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> > Main Web Site: http://pauldotcom.com
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom at mail.pauldotcom.com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com