# WIN LM Password Hashes (using John the ripper) [closed]

In a problem set, we've been asked to use John The Ripper to crack a list of Win LANMAN passwords.

They are of the following form: 953A55E36AB85C0B9DA92C18555E42E1:0169295E0A6A6B35B2DD9932D10C1978

From my understanding LM Hash passwords are limited to 14 characters (if they are shorter padding bits are added) and that the characters must come from the set of 95 printable ASCII characters. Also that all characters are forced to uppercase.

A Question: Why are is the password so long? why is it split into two halves? When I try to run ./john passwrds it says it's attempting to crack 6 hashed passwords instead of three (splitting up each password by the ':').

Also is it a good approach to use either of these (found in john.conf)

 [Incremental:ASCII]
File = $JOHN/ascii.chr MinLen = 0 MaxLen = 13 CharCount = 95 [Incremental:LM_ASCII] File =$JOHN/lm_ascii.chr
MinLen = 0
MaxLen = 7
CharCount = 69


If this question is more appropriate for the security stack exchange website please flag for migration.

Thank you.

-

## closed as off-topic by e-sushi, rath, Gilles, B-Con, MaeherOct 9 '13 at 17:57

This question appears to be off-topic. The users who voted to close gave this specific reason:

• "Requests for analyzing or deciphering a block of data are off-topic here, as the results are rarely useful to anyone else." – e-sushi, rath, Maeher
If this question can be reworded to fit the rules in the help center, please edit the question.

Questions about analyzing or decyphering a block of data are off-topic at Crypto.SE. And since you indicate a potential migration request: Security.SE regards questions to be off-topic as soon as they are related to breaking the security of a specific system. Personally, I don't see this question (in it's current state) being on-topic in either of those two SE corners. –  e-sushi Oct 8 '13 at 5:41
@e-sushi This isn't a question “asking us to break the security of a specific system for you”, it's a question about certain Windows authentication methods. It would be ok for Information Security. –  Gilles Oct 8 '13 at 23:00
This question is off-topic because it is about the peculiarities of the way some cryptography is used in a particular system. It would be on-topic on Information Security. –  Gilles Oct 8 '13 at 23:01
@Gilles The reason why I think this might be asking to break security is, that using "John The Ripper to crack a list of Win LANMAN passwords" is not exactly white-hat material. I mean, who (except hackers and maybe students with dazed and confused professors) would be asked to crack LANMAN passwords? –  e-sushi Oct 8 '13 at 23:03
@e-sushi Breaking security isn't off-topic on Information Security. What's off-topic is script kiddie questions like “how do i hack www.example.com plzsendtehscritpz” or help-I'm-locked-out password recovery questions. A question like this one is the sort of stuff that can arise during pentesting, it's perfectly on-topic for Information Security. –  Gilles Oct 8 '13 at 23:05

If this is a problem set, you likely shouldn't be asking people here to solve it for you, and it would likely be inappropriate for us to solve it for you.

• Do you know what it means to crack a password hash?

• How does the Windows LanMan hash work? What is the length of its input (in bytes)? What is the length of its output (in bytes)?

• What is the length (in bytes) of each of the values (separated by a colon) in the string given to you? (e.g., the value 953A55E36AB85C0B9DA92C18555E42E1)

• Do your answers to the prior questions suggest any plausible hypothesis to what the value 953A55E36AB85C0B9DA92C18555E42E1 might represent or where it might have come from?

• Do you know of any tools for cracking LanMan hashes?

• What is the length of the NTLM hash? What is the length of its input, and its output? Does this suggest any additional candidate hypotheses that you could try?

-