This thing really really doesn't like windows (no matter what I do, the "..hashes loaded" problem appears)..I don't think I can get any further with it :/
Comment has been collapsed.
Curious if another windows user managed anything with John..
Comment has been collapsed.
I'm baffled.. Used latest build and keep getting "No password hashes loaded <see FAQ>" in Win7 but I don't think it matters. Plain command, not even switches. Worked fine on another file I tried. I'll probably give up, nothing else to try.
Comment has been collapsed.
...nevermind.. found the way.. It was way too obvious after all, I was doing one step fundamentaly wrong..
Comment has been collapsed.
That's the error I'm getting too. I did this:
Comment has been collapsed.
I can't help you with GUI, I only use command line..
Comment has been collapsed.
yes powershell, though i tried with powershell and command prompt (after a few trial and errors), but in the end it only says that the app "can't execute on my PC" (i used john-1.9.0-jumbo-1-win64) in a big orange windows. So i guess thats it x) might be some things to tweak here and there, but since my compter is running well, i won't try anything that can modify it for now. Though I do wish good luck for all the one that are still trying to get this code !
Comment has been collapsed.
well, you can guess it but it would probably take a long time. if you come up with the right algorithm based on hints for any brute force tool, it won't take long as number password can be broken in short amount of time. (if you have enough power)
it took few hours for john to crack this (without hints except length) but I have a weak cpu and gpu cracking for amd gpu on Linux is hard to set up (i haven't done it obviuosly)
Comment has been collapsed.
This is great idea:) I am gonna pass that one since brute force with mask would take a long time but cheers mate:)
Comment has been collapsed.
Ah - I used https://rarpasswordcracker.com/ , which has a rate of approx. 700 passwords per second (on my crappy 2007 low-end PC). With only the first two hints (12 characters, numbers only) it would take 45 years.
I also downloaded a "jumbo" version of JTR which supposedly also can handle rar archives, and a GUI for it (Johnny). Just didn't get it to work yet.
Comment has been collapsed.
10^12 = 1,000,000,000,000 different passwords
700 passwords per second = 1,428,571,428 seconds => 16,534 days => 45.3 years
Comment has been collapsed.
The problem here are the 700 attempts per second. My old 486DX 33 should be able to do better than that.
Comment has been collapsed.
I am not sure how to set additional custom rules in JTR (like only 2 numbers can be repeated in a sequence)
Even setting the min and max char to 12 and using 0-8, it will take 7 years on an i5-9300H running on 8 threads.
I think you set the password length too high :| I am using incremental=digits mode
Great challenge tho!
Comment has been collapsed.
IMHO, the main problem here is the advanced options for JtR are very difficult to understand by noobs. It is a program for security experts, cryptographers and hackers, not a friendly tool.
With "advanced options" I mean to understand the different hints you provided and "convert" them to masks/parameters/whatever, translated to its command line syntax.
Comment has been collapsed.
Here's my thinking so far on how to interpret the hints:
Some quick Python to code the above:
from itertools import combinations
arr = [0,1,2,3,4,5,6,7]
res = [x+x+(8,)+tuple(set(arr)-set(x)) for x in combinations(arr, 3)]
for r in res:
print r
We get 56 lines.
Obviously for each line the order of elements is still not accounted for, so we need to generate all permutations for each line (unrestricted there are 12! factorial per line). Fortunately we still have the following two hints to further restrict the valid permutations:
I haven't coded this part, but I estimate now the upper limit of number of passwords to generate is something like factorial(11)*56
, or rounded down let's say 1 billion passwords. If you can check 1000 passwords/sec, that would still take over a week to crack :(
Assuming I made no mistakes, maybe someone else might improve it further, I give up š¤·
More hints added which cut down the possibilities significantly.
I adjusted my code and generated all possible passwords in a ~300MB file with about 25 million passwords. At a rate of 1k pass/sec, that'll take like 7 hours to crack, much better but still a bit too much brute forcing for me...
Maybe another hint or two and it'll be within reach ;)
Comment has been collapsed.
I am using C#, that may be slower (?).
Even if I got it, it just saves all possibilities to txt file and I don't even know how to start with multiple passwords on one archive.
Anyway, thank you for this challenge, it entertained me for some time :D
Comment has been collapsed.
With the additional 2 hints you can reduce it even further (like 1/20th)
I only got 200000 possible combinations, but none worked, so Iām apparently too strict.
Comment has been collapsed.
I actually cracked it by incorporating all the new hints, but obviously didn't update my post here so not to completely give away the solution ;)
I managed to cut it down to something like 200K possible passwords before brute-forcing to get the final answer.
Comment has been collapsed.
Just a question, if you can answer:
- if you are using crunch, then 2@ (123456 is good, 123345 is good, 123334 is not good)
- only one pair of digits (e.g. 99456)
- password starts with 11
Given that last hint, is it safe to assume that there are no other pairs in the password? (meaning that the first hint becomes 1@)
or is it "one pair other than the one I gave you"?
Comment has been collapsed.
That's right, the initial 11 is the only consecutive pair of digits in the password.
EDIT: Too slow, way too slow...
Comment has been collapsed.
Tried crunch, never used anything like it before....the file was going to be about 4gb but it stopped after a few seconds :/
No idea how to do >5 or <5 though....also isn't 2@ wrong? ^^
Comment has been collapsed.
Without giving too much away @ should be lowercase letters not numbers, from what I read ^^
Comment has been collapsed.
Used all the hints I know how to use (so except the > < and the 3 digits appear more than once hint)
The wordlist has 630MB and with my i7 3770k, a 8 year old CPU, it takes 21h to crack the PW....aargh.
Comment has been collapsed.
Managed to actually lower it to 60MB, it still takes 3:30h, still quite slow with only 660p/s but it's a lot better already and I can have it running while I sleep and still do something tomorrow xD
Edit: Somehow it didn't find any password that fits, so I gotta change the wordlist.
Comment has been collapsed.
I did, yeah but I didn't know about it but I wouldn't be able to use it anyway it uses CUDA and I have an AMD GPU.
Comment has been collapsed.
1,829 Comments - Last post 11 minutes ago by Thexder
86 Comments - Last post 45 minutes ago by Glas
386 Comments - Last post 1 hour ago by adam1224
31 Comments - Last post 1 hour ago by OneManArmyStar
12 Comments - Last post 2 hours ago by Foxhack
207 Comments - Last post 3 hours ago by sensualshakti
8 Comments - Last post 4 hours ago by lostsoul67
60 Comments - Last post 1 minute ago by eeev
2 Comments - Last post 3 minutes ago by pingu23
1,602 Comments - Last post 18 minutes ago by Fluffster
205 Comments - Last post 33 minutes ago by erom96
100 Comments - Last post 46 minutes ago by yugimax
731 Comments - Last post 1 hour ago by JMM72
158 Comments - Last post 1 hour ago by yugimax
Hi. Let's do another
puzzlegiveaway, shall we?Giveaway code is in this archive: https://drive.google.com/file/d/1aOLuB4UjaNMU146ag7SdBl5NWCgBK2GK
this is the hash for those who struggle with *2john functions:
End date: 19.04.2020 12:00 AM UTC+3
Level: 2
Hints **:
Hints will be updated over time if there are not enough solvers. **
You can share other hints if you want or need help but as always - more hints usually means less chance to win.
Mood Music
John the Ripper
Answer: 114532826037
Comment has been collapsed.