CEL: cracking elapsed log

Here's a summary and introduction to the work I've done on john.

The first thing you wanted was a system that uses john to determine how quickly simple passwords can be cracked. The second was a system for quickly and easily cracking NTLM passwords based on the results of an LM crack. These two goals are achieved together through a patch to john and a perl script.

The patch to john that adds the functionality of recording more detail about how long it takes to crack passwords. An additional log file is created, with the file extension .cel, which records the following information in tab-separated fields:

A key observation about this file is that it records an amount of time elapsed for every password decrypted and can therefore be reused (like the .pot file) for future cracks. The third field is unnecessary, since it can be calculated from any .pwdump file (perhaps it should be removed.)

So, by using this file, in order to calculate the time to crack an arbitrary password, an external script can consult this file. That way, john doesn't need to crack passwords over and over again, but can instead just "remember" how long it took to crack them the first time.

This patch is available in the file john-cel-v01.diff. Apply the patch with patch < john.cel.v01.diff in the john-1.6.37/src directory.

The script that processes the .cel file and produces timing information for cracked passwords is in the file analyze_cel.pl. This script also accomplishes the second goal: it prepares input for cracking NTLM hashes based on the cracked LM components.

Consider a user who has an NTLM password "spArkLepAss". It might take a while (a long while) for an NTLM incremental mode crack to guess this one, but if the same password is in LM format it will be quickly cracked ("sparkle"/"pass"). So this script, given a .pwdump file, uses the .cel file to concatenate the first and second parts of the LM password for each user where these parts are available and the NTLM password is not cracked. The script then creates a temporary input wordlist for an NTLM wordlist crack that consists of all case variants of the concatenated password, and invokes john on this .pwdump file with this wordlist, in NT mode.

sparklepass
sparklepasS
sparklepaSs
sparklepaSS
sparklepAss
...

The NT wordlist crack will take a second or two at most, so the script waits for the result. The script also produces a report which includes the user name, the cracked LM and NTLM passwords, and the elapsed time to crack these passwords:

User	LM pass	NT pass	Elapsed
aaadqz	JEFFMARY	jeffmary	0:00:00:46
aaadra	AKITAPUP	akitapup	0:00:00:06
aaadrb	CLINIC	clinic	0:00:00:05
aaadrc	WUBI7392	wubi7392	0:12:43:33
aaadrd	FEB1999	feb1999	0:00:00:04
aaadre	(-:R5)	N/C
aaadrf	Z34TOMGT	z34tomgt	0:00:00:06

Note that the password for aadrc took over twelve hours to crack, and that the password for aaadre is still not cracked (only the second component of the LM password, "R5" was cracked).

It's OK to run two instances of john that share the same .cel and .pot files on a system that supports flock(). The NTLM patch and the CEL patch can be applied together.

An additional convenience script is provided, called getnotdone.pl, that given an argument of a pwdump file, produces a subset pwdump file which consists of lines which have passwords not completely cracked in the .pot file.