Crack5 and password Length

[Belinda Dermody]

I am running crack5 under HP-UX 10.20 with a trusted system. I have written scripts to parse the files and make a working password file for crack. I notice on this months run that crack will only process the first 8 characters of the password. I have 12 characters set as the maximun. I questioned one of my users that we caught again and the user stated that the password was 10 characters in length. I am wondering now is crack only working on the first 8 or is the Reporter only printing the first 8 of the crack password. Is there a file I need to modify and then rebuild crack.

[Brian M. Fisher]

This is the normal behavior of Crack. The password cracking program I use is John the Ripper. It is able to break up a password longer than 8 characters and solve them independently. Check out the following URL for the program.
http://www.openwall.com/john/

Brian
<*(((>< er

[Belinda Dermody]

Well I downloaded John the Ripper and changed the MaxLen to 12 and CHARSET_LENGTH to 12 and I am still having problems cracking the full password pass the first 8 characters. I get the following results from John
munchies (jforde:1)
jforde:munchies????????:809:215:Jessica Forde,VA-20/Admin Asst,,:/users/jforde

So any additonal help/assistance would be appreciated. What does the :1 after the userid indicate.

[Alexander Peslyak]

James,

Your system uses "enhanced"
password hashing function,
which attempts to solve the
8-character limit. In reality,
plaintext passwords are split
into 8-character long pieces and separate "traditional" hashes are generated. Thus, a
password cracker is able to
crack the pieces separately,
which allows for certain optimizations. See this thread which was on Bugtraq:

http://marc.theaimsgroup.com/?t=92101593400002

You shouldn't have changed the
MaxLen and CHARSET_LENGTH settings as the pieces "John"
will try are still within the
8-character limit.

As for it not succeeding in cracking second half of a password, let it run for some longer or make it try different candidate passwords (perhaps shorter ones) and it'll get it.