odd password counts with john

[nbaronian at gmail.com (Nick Baronian)]

Each hash has the LM and NTLM, even if the LM is disabled it is still
in the hash. 37*2

On Sun, Jan 17, 2010 at 10:54 AM, Robin Wood <dninja at gmail.com> wrote:
> Hi
> I'm trying to crack a file of windows cache passwords grabbed with
> fgdump using john and getting odd counts:
>
> $ wc -l /tmp/cache/sorted_dump
> 37 /tmp/cache/sorted_dump
>
> $ ~/src/john-1.7.3.4/run/john --wordlist=all_combined.txt /tmp/cache/sorted_dump
> Loaded 70 password hashes with no different salts (LM DES [128/128 BS SSE2-16])
> guesses: 0 ?time: 0:00:00:00 100% ?c/s: 261994K ?trying: ZYZ - ZZZZZZZ
>
> $ ~/src/john-1.7.3.4/run/john --show /tmp/cache/sorted_dump
> 0 password hashes cracked, 74 left
>
> wc says there are 37 entries in the file
> john loads and says it is cracking 70 passwords
> john show says there are 74 left to crack.
>
> Any idea what is going on?
>
> Robin
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom at mail.pauldotcom.com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com