Multiforcer LM not working [Windows]

Problems with the hash cracking system? Suggestions?
  • Ads

Multiforcer LM not working [Windows]

Postby LMprobs » Mon Jun 04, 2012 9:37 pm

Hi, I'm having some trouble with the LM hashes in multiforcer. It doesn't seem to actually do anything when it hits the right combination.

I'm using hashes where I know the correct password to some of them. I've already removed the SYSKEY layer, and am using hashes from the PWDUMP in the manner described in the wiki (one LM hash per line, nothing else). Multiforcer recognizes them as pairs of half-hashes, so I'm pretty sure I entered them right.

I ran the program suspecting that all were alphanumeric (knowing some are) and returned no results after running through the entire character space. I tried again, with a single known hash, and ran it with only the charset that is actually used in the password. Ran all the way through, and exited.

I'm running the following line: CryptoHaze-Multiforcer.exe -h LM -c charsets/charsetMicrosoft -f input.txt -o output.txt -l

I also confirmed the hashes are correct by testing the known passwords against them in Cain, they do show up as LM hashes and the passwords do result in solutions.
LMprobs
 
Posts: 6
Joined: Mon Jun 04, 2012 9:29 pm

Re: Multiforcer LM not working [Windows]

Postby Bitweasil » Mon Jun 04, 2012 10:43 pm

Interesting...

Can you post some sample hashes that are not being found, and the specific command lines you're using?

Also, what version of the Multiforcer are you using? The latest build, 1.31a?

I'm not aware of any current issues with LM, but it should be finding stuff... happy to help debug this!
Bitweasil
Site Admin
 
Posts: 912
Joined: Tue Jan 20, 2009 4:26 pm

Re: Multiforcer LM not working [Windows]

Postby LMprobs » Tue Jun 05, 2012 12:08 am

Wow, thanks for the quick reply! Sure, here's more information. I'm on Windows 7 x64, Corei7, Nvidia 560m. I used the hashes individually. I just pasted the hashes straight into the file and made sure to have a new line after them in the file, nothing else.

8BAB2569858D98106DBBD71D1147AB13 is the hash I was trying to check.

F88D1461646DFE08F7E62F36F8DB5AE6 is one of the known hashes. This one is all uppercase alpha, 8 letters

The line was entered exactly like this: CryptoHaze-Multiforcer.exe -h LM -c charsets/charsetuppernumeric -f input.txt -o output.txt -l

Edit: I am using 1.31, downloaded today.
Last edited by LMprobs on Tue Jun 05, 2012 1:53 pm, edited 1 time in total.
LMprobs
 
Posts: 6
Joined: Mon Jun 04, 2012 9:29 pm

Re: Multiforcer LM not working [Windows]

Postby LMprobs » Tue Jun 05, 2012 1:43 am

Update to say that sometimes, certain lines work if I use multiple lines in the file. Sometimes it recognizes the hashes, sometimes not. I got it to crack one known hash by adding more hashes on lines before it.

Part of the problem may also be on my end, though my known good one should still decode right? It seems like SOME of the hashes in the hive file decode properly with the syskey and SOME don't. I have no idea what that is about.

For instance one of my known alphanumeric passwords dumps as D35DFA49F382794BDB70578BFDA1DF9E but if I use http://buchananweb.co.uk/security50.aspx to convert it forwards I get 08E20966D9EF9C8536077A718CCDF409

I really have no idea how this could even happen, as these are all in the same file on the same system, and the passwords were tested to work before the file was dumped.
LMprobs
 
Posts: 6
Joined: Mon Jun 04, 2012 9:29 pm

Re: Multiforcer LM not working [Windows]

Postby LMprobs » Tue Jun 05, 2012 2:52 pm

The issue turned out to be an error in my hash dumping program. It dumped wrong LM (and NTLM oddly enough) hashes for NTLM only passwords. Sorry!
LMprobs
 
Posts: 6
Joined: Mon Jun 04, 2012 9:29 pm

Re: Multiforcer LM not working [Windows]

Postby Bitweasil » Tue Jun 05, 2012 6:55 pm

LMprobs wrote:The issue turned out to be an error in my hash dumping program. It dumped wrong LM (and NTLM oddly enough) hashes for NTLM only passwords. Sorry!


Is it working reliably now with one hash, or do you still have an issue with not finding all the known hashes?
Bitweasil
Site Admin
 
Posts: 912
Joined: Tue Jan 20, 2009 4:26 pm

Re: Multiforcer LM not working [Windows]

Postby LMprobs » Tue Jun 05, 2012 7:44 pm

It's working now that I have stopped using that program and entered them manually.

All of them including the individual hashes were dumped with it, and I may have assumed consistency where there was none since I have no idea what the problem with that program is. It's therefore possible input.txt had something different than what I posted here, which works now.
LMprobs
 
Posts: 6
Joined: Mon Jun 04, 2012 9:29 pm

Re: Multiforcer LM not working [Windows]

Postby Bitweasil » Tue Jun 05, 2012 8:51 pm

Good to know. Thanks! Glad it wasn't an issue with my code - I've had some random issues with LM in the past.
Bitweasil
Site Admin
 
Posts: 912
Joined: Tue Jan 20, 2009 4:26 pm


Return to Hash cracking

Who is online

Users browsing this forum: No registered users and 1 guest

cron