John the ripper kali linux как пользоваться

How to effectively deal with bots on your site? The best protection against click fraud.

В Kali Linux предустановлен John the Ripper, поэтому ничего устанавливать не нужно! Просто возьмите пакет и возьмите его на прогулку.

Сценарий № 1: вы только что получили хэш пароля

Итак, давайте предположим, что вам только что передали хэш, точнее, хеш MD5. В реальных ситуациях вы бы получили их, очистив компьютер. В моем случае я буду использовать слово password123:

эхо 482c811da5d5b4bc6d497ffa98491e38 > хэш.txt

Чтобы решить пароль, вы должны использовать самый простой код Джона Потрошителя:

Как правило, John the Ripper автоматически определяет тип хеша. Но вы можете увеличить это столько, сколько хотите! Итак, допустим, вы хотите добавить свой собственный список слов и указать формат, тогда вы должны написать:

Джон —список слов =

/ Загрузки / список паролей —формат = Raw-MD5 hash.txt

Таким образом, при первом запуске последнего он покажет пароль на экране, после чего сохранит его в файл с именем john.pot. В моем случае папка john.pot находилась в /home/kali/.john/john.pot.

Сценарий № 2: Защищенный паролем ZIP-файл

Теперь давайте представим, что есть Zip-файл с блокировкой паролем. Итак, в какой-то момент ранее вы создали zip-файл, защищенный паролем. Для этого вам нужно установить zip:

судо подходящий установить молния

Затем, чтобы создать zip-файл:

Бывший: молния —пароль пароль123 linuxhint.zip

(Здесь слово password123 является фактическим паролем, защищающим zip-файл.)

Теперь, 6 месяцев спустя, вы забыли пароль. Что ты можешь сделать? Что ж, используйте John the Ripper, но прежде чем мы сможем это сделать, нам сначала нужно преобразовать zip в john.

Для этого воспользуемся командой zip2john:

zip2john linuxhint.zip > linuxhint_password.txt

Сам хэш расположен между двумя знаками доллара.

Джон Потрошитель может получить пароль одним из двух способов: атакой по словарю или атакой полным перебором. Файл со списком потенциальных паролей сравнивается с имеющимся хешем при атаке по словарю. Если совпадение найдено, оно будет выброшено. С другой стороны, если пароль не найден, вы можете использовать другой файл паролей или другой метод.

Далее мы напишем:

Джон —список слов =

/ Загрузки / список паролей linuxhint_password.txt

Здесь мы взломали zip-файл, но это не обязательно должен быть zip-файл! Это может быть почти что угодно. Просто помните, что в таких случаях вы должны использовать 2john. Например, если бы вы взламывали Wi-Fi, вы бы использовали Aircrack-ng и получили файл с крышкой. После того, как вы получили файл шапки, вам нужно будет преобразовать файл кепки в файл hccap. Когда у вас есть файл hccap, используйте hccap2john, чтобы преобразовать его в формат john, который даст результаты на John the Ripper.

Вы можете найти больше команд 2john, используя:

Сценарий № 3: Инкрементный стиль или грубая сила

Самым мощным из всех доступных методов является метод грубой силы, потому что он проверяет все возможные комбинации! Но это также означает, что он вряд ли когда-нибудь закончится, если пароли не будут достаточно простыми.

Например, я выберу трехсимвольный пароль в формате MD5: abc. Я делаю это, чтобы мне не приходилось часами ждать, пока он его обнаружит.

эхо 900150983cd24fb0d6963f7d28e17f72 > инкрементный.txt

Самый простой способ сделать это — набрать:

Джон —формат = Сырой-MD5 —инкрементный инкрементный.txt

В качестве альтернативы вы могли бы также написать:

Джон —формат = Сырой-MD5 -я инкрементный.txt

Как видите, я нашел его менее чем за секунду, и мне даже не пришлось снабжать его словарем.

Далее мы собираемся возиться с файлом конфигурации, расположенным по адресу /etc/john/john.conf.

В файле /etc/john/john.conf вы найдете раздел об инкрементных режимах. Здесь вы можете добавить больше, если хотите, но сначала давайте попробуем использовать один из них.

В /etc/john/john.conf есть такой:

Файл = $ДЖОН / цифры.хр
МинДлен = 1
МаксДлен = 20
Количество символов = 10

Здесь давайте воссоздадим хэш MD5 для пароля 123456.

эхо e10adc3949ba59abbe56e057f20f883e > пароль_цифры.txt

Теперь давайте воспользуемся инкрементным режимом:

Джон —формат = Сырой-MD5 —инкрементный =цифры password_digits.txt

Последний будет искать все возможные комбинации цифр. А поскольку это был всего лишь 6-значный пароль, он взломал его менее чем за одну секунду.

Однако вы можете добавлять туда свои собственные файлы и создавать свои собственные инкрементные файлы. Вы можете создавать правила и т. д. Это тяжело!

Джонни: версия графического интерфейса

Теперь для тех, кто предпочитает версию с графическим интерфейсом версии с интерфейсом командной строки, есть Johnny. Чтобы установить Джонни:

судо способный получить установить Джонни

На вкладке «Файл» вы должны найти две опции: открыть файл паролей или открыть файл другого формата. Для демонстрационных целей мы будем использовать первый — открытый файл паролей. Я открою файл hash.txt, содержащий пароль в MD5.

В разделе параметров вы можете выбрать нужный режим атаки. Я выберу список слов и тип хеша (вверху). Затем я дам ему файл паролей.

Затем нажмите «Начать новую атаку».

Просто и легко! Точно так же вы можете выбрать режим атаки. Так что, если вам нужен инкрементный режим, настройте его и посмотрите, как он делает свое дело.

Джон Потрошитель — очень мощный инструмент. На самом деле, он очень широко используется, настолько, что он предустановлен в Kali Linux! Джон Потрошитель в основном используется для восстановления паролей, но всегда можно проверить, безопасны ли выбранные вами пароли или нет, попробовав их взломать. В целом, это фантастический инструмент, который требует времени для изучения и освоения, но он определенно стоит затраченных усилий.

Comprehensive Guide to John the Ripper. Part 1: Introducing and Installing John the Ripper

John the Ripper is a popular password cracker that is capable of brute-force using both the CPU and the video card and supports many algorithms. To be more precise, this is an offline brute-forcer (online brute-forcers perform the attack by connecting to network services, and offline crackers work with captured hashes (files) to which they guess a password).

Even if you are already familiar with Hashcat (and even more so if you are NOT familiar with Hashcat), you need to learn how John the Ripper works, since they are different.

How John the Ripper and Hashcat differ

Hashcat can use a video card, CPU, or both for brute-force.

John the Ripper can use one thing: either the video card, or the video core of the CPU, or only the CPU.

Hashcat can use the graphics card to crack any supported algorithms.

John the Ripper for GPU Cracking supports only certain kinds of algorithms.

If you have several video cards, Hashcat out of the box supports working with multiple devices at once and by default splits the task into the required number of threads and the size of each task is tied to the performance of the video card.

John the Ripper can work with multiple graphics cards, but by default, splitting a task across multiple graphics cards is only supported for one algorithm.

It doesn't matter to Hashcat how you installed it: built from source or downloaded a binary file.

It is very important for John the Ripper to compile the binary himself, as the compilation takes into account the specifics of your system. As a result, during compilation, the instruction sets supported by the processor will be indicated, for example, AVX2 instead of the default AVX, which will have a very significant impact on performance – for some algorithms, this will speed up brute-forcing by 2 times! Alternatively, John's binaries compiled on newer hardware may not work on some computers.

For Hashcat, you must specify the hash type.

John the Ripper determines the hash itself, or you can explicitly specify the hash format.

The syntax for commands and options varies greatly.

About cracking a password in John the Ripper on a video card, you need to know that brute-force on a graphics card takes a long time to launch – this is noticeable even in the benchmark. Therefore, if you need to execute many short sessions, then sometimes it is more rational to use the CPU, on which the brute-force is launched immediately.

Advantages of John the Ripper:

1. John the Ripper work with hashes more flexible — even if the file with hashes contains hashes of other types, John does not exit with an error, but simply uses the hashes of the type specified in the start command. In addition, hash computation utilities often add strings that can cause an “invalid hash” error in Hashcat. John the Ripper works fine with this form of notation.
2. More flexible Rule-based attack. John the Ripper and Hashcat have an implementation of Rule-based attack and the syntax for writing the rules has a lot in common. But in John the Ripper, this attack is more powerful because it has more rules and also allows character sets to be used in the rule entry.
3. Support for non-standard hashes. Hashcat can only work with hashes provided by the developers of this program. And John the Ripper has a Dynamic mode that allows you to specify the formula by which the hash was calculated. That is, arbitrary types of hashes can be cracked.

How to install video card drivers for John the Ripper

If you want to use the GPU to crack passwords (which is many times faster than on the central processor), then you need to install the video driver.

For brute-force can be used:

• CPU
• video core of CPU
• GPU

You need to choose one of these – the fastest option is a video card.

Of course, the specific configurations of computers may vary: some do not have a discrete graphics card, some do not have a video core on a CPU – I hope you can check this yourself.

Installing video drivers in Windows

In this OS, everything is simple – most likely, the video drivers for your graphics card are already installed. If not, go to the manufacturer's website, download and install the driver.

In order to use the CPU as an OpenCL device, you need to install “OpenCL Runtime for Intel Core and Intel Xeon Processors”. You can find the links in this article on Hashcat, which also uses this software.

Installing video drivers on Linux

On Kali Linux

Upgrade and reboot your Kali installation:

Installing video drivers for NVIDIA on Linux

Enabling OpenCL for Intel

If your CPU supports OpenCL, then install the following packages:

On Arch Linux, BlackArch

Enabling OpenCL for NVIDIA

Remove xf86-video-nouveau there it is:

Install proprietary NVIDIA driver, CUDA and other required packages:

Enabling OpenCL for Intel

Friends, I need your help – if you have a different distribution kit or AMD video card, write in the comments how you installed the video driver – I will add this information here.

How to compile John the Ripper on Linux from source code

As already mentioned, it is important to build John the Ripper yourself so that it uses all the features of your processor. Another advantage of this approach is that we get the most recent version of John the Ripper.

Installing the required dependencies in Kali Linux:

Installing required dependencies on Arch Linux, BlackArch:

The following is the same in any distribution:

Please note that in the last command you can use the -j option after which specify the number of (logical) cores of your processor, for example, I have 12 logical cores, then I use:

Now go to the run folder:

And run the test:

You don't need to install John the Ripper at the system level – move the run folder to a location convenient to you and run John from there. In addition to the John the Ripper executable, the run folder contains many scripts for extracting hashes – we will talk about them later.

Remember that if you type in the terminal

then the version preinstalled on the system will run, not the one you compiled.

Installing John the Ripper on Debian, Linux Mint, Ubuntu

The installation should be performed exactly the same as in Kali Linux. So refer to the Installing John the Ripper on Kali Linux section. If something did not work out for you, then write here in the comments indicating your distribution kit and error.

How to install John the Ripper on Windows

We'll look at compiling John the Ripper from source on Windows sometime later. Let's use the official binary file.

Install Cygwin first – just go to the official website https://www.cygwin.com/, download the setup-x86_64.exe file and install. If something is not clear about Cygwin, then all the details can be found in the article “How to get started with Linux commands on Windows: Cygwin”.

In Cygwin, you need to install the libOpenCL1 package, which is not available by default. The installation can be performed by running the setup-x86_64.exe file (which installed Cygwin) again, at the stage of selecting packages in the “Search” field, enter “libOpenCL1”, in the “View” drop-down list, switch to “Not Installed”, double-click the word “Skip”.

This will show the version of the package to install, click Next and complete the package installation.

You might like another way better: move the setup-x86_64.exe installation file to the C:\cygwin64\ folder and then open a Windows Terminal (PowerShell) and just run the command:

Unzip the contents of this archive into the C:\cygwin64\home\<USERNAME> folder, for example, my username is MiAl, so I unpack it to C:\cygwin64\home\MiAl\. Please note that you need to create a folder and copy files into it on behalf of a regular user, because during its work John the Ripper will try to write data to a .pot file in the same folder where the program is running. If you copied the JtR folder in the file manager with elevated rights, then this folder will belong to the Administrator and it is impossible to write anything into it or change the rights to it.

It is actually possible to run John the Ripper on Windows even without Cygwin, but in this case it will not be able to use OpenCL (video cores) for brute-force.

Now in the folder C:\cygwin64\home\<USERNAME>\JtR\run\ find cygOpenCL-1.dll file and rename it to cygOpenCL-1.dll.bac.

Then in the c:\Windows\System32 folder find the OpenCL.dll file and copy it to the C:\cygwin64\home\<USERNAME>\JtR\run\ folder.

Then, in the C:\cygwin64\home\<USERNAME>\JtR\run\ folder, rename the OpenCL.dll file to cygOpenCL-1.dll.

Then the same procedure must be repeated for the file in the C:\cygwin64\bin\ folder. That is, in the C:\cygwin64\bin\ folder, find cygOpenCL-1.dll and rename it to cygOpenCL-1.dll.bac. Then find the OpenCL.dll file in the c:\Windows\System32 folder and copy it to the C:\cygwin64\bin\ folder. Finally, in the C:\cygwin64\bin\ folder, rename the OpenCL.dll file to cygOpenCL-1.dll.

So that you understand why we are doing all this, take a look at the cracking speed on the central processor:

And on the speed of hacking on the video card, which became available thanks to the actions shown above with the substitution of files:

The file swap trick may not work for all systems – but either way, you can use the CPU or integrated graphics to hack.

Open Cygwin console to execute commands.

Run your system benchmark:

Still, JtR is one of those programs that primarily targets Linux. Further you will see that we will run scripts to generate (extract) hashes from files and, for example, some of the auxiliary programs/scripts need, for example, an installed Python environment, which is present in Linux by default.

John the Ripper check

In this section, we will check what devices John the Ripper sees for use during brute force.

The options are the same on any system, but remember that on Windows, to run John the Ripper, you need to open Cygwin and specify

/JtR/run/john as the executable file.

If you run a file installed from the standard repositories in Linux, then it is enough to write simply

If you run a file compiled from the source code, then go to the directory with the executable file (in the program folder this is the run directory) and specify as the executable file

As you can see, I have three devices:

1 – video core of the central processor:

2 – discrete video card

Likewise on Windows:

As already mentioned, John the Ripper cannot just work with any supported algorithms using OpenCL – a module must be created for them. Therefore, some algorithms can only be cracked on a CPU, while some algorithms can be cracked on a GPU or on a CPU.

The list of algorithms may vary by OS and by installed dependencies.

To see the list of supported algorithms:

The list is too big for one screen:

To see a list of algorithms for cracking on OpenCL:

Much smaller, but Wi-Fi is there.

How to use a graphics card to brute-force in John the Ripper

By default, JtR uses the CPU even if all the required OpenCL drivers are installed.

To enable the graphics card, you need to use the —format option and explicitly specify the algorithm that OpenCL supports.

For example, to benchmark the wpapsk algorithm on a video card:

To hack wpapsk on the central processor, you need to run something like this:

As you can see in the screenshots: 114975/17385 = 6.61, that is, the speed of brute-forcing passwords has increased more than 6 times.

How to use a video CPU core in JtR

In this section, we will dwell in more detail on what devices JtR can use to perform computations and how exactly the program chooses between them when there is an alternative.

JtR can perform computation on:

• regular CPU cores
• OpenCL devices

The list of OpenCL devices may include:

• video card
• integrated CPU graphics
• regular CPU cores

As you can see, even without the OpenCL Runtime and video drivers installed, JtR is capable of cracking passwords.

Algorithms that do not have the “-opencl” string in their names, such as wpapsk, can only be brute forced on regular CPU cores.

Algorithms with the string “-opencl” in the name, for example wpapsk-opencl, can be brute forced on:

• video card
• integrated CPU graphics
• regular CPU cores

To see a list of available OpenCL devices, run the command:

Take a look at the following screenshots:

Number one is integrated graphics in the CPU.

Number two is the video card.

Number three are the regular CPU cores that JtR will handle as an OpenCL device.

By default (without a -dev option), JtR uses one OpenCL device that it thinks is likely the fastest.

Using the -dev option, you can select a specific OpenCL device, the device number is in parentheses, on lines starting with “Device #0”, for example:

So, to run JtR on regular CPU cores, use the algorithm name without the “-opencl” string:

To start cracking the password on the first OpenCL device (in my case it is integrated CPU graphics, test failed):

To start cracking the password on a second OpenCL device in my case it is a discrete graphics card):

To start cracking a password on a third OpenCL device (in my case it is regular cores of the central processor):

You can also use the -dev option like this:

• -dev=gpu
• -dev=cpu

These tell JtR, when it uses OpenCL, to use only GPU device(s) or only CPU device(s).

How to run John the Ripper benchmark

To check the speed of brute-force passwords in JtR, use the —test option.

This option can be used with a number – the number of seconds that the test will run.

If you want to check the speed of only a certain algorithm, then use the —format option.

An example of a test of the speed of cracking a Wi-Fi password by a central processor:

An example of a test of the speed of cracking a Wi-Fi password with a discrete video card:

If you only need to check the operation of cracking of various algorithms without running a benchmark, then specify 0 as the value of the —test option:

How to set up John the Ripper

John the Ripper has a settings file with a lot of options. This file is called john.conf and is located in the same folder as the john executable.

Provide good cooling; watch the temperature. If the OpenCL runtime supports this, the GPU temperature will be monitored and displayed in the status bars, and there is a user-configurable limit in john.conf that will shutdown at 95 ° C.

This setting is set by the directive:

The temperature is indicated in degrees Celsius — °C.

Instead of interrupting, you can stop the program for this number of seconds to cool down the GPU when the temperature reaches the AbortTemperature value, then the program will re-check the temperature and either continue or pause. Set to 0 to just quit.

If SleepOnTemperature = 1 (one second) is specified, then no pause/resume messages will be displayed, since such a short value is interpreted as a desire to keep the temperature of the video card near the extreme value. Default directive value:

Compilation difference with AVX2 and AVX for John the Ripper

To view build parameters use the —list=build-info option:

Benchmark of two versions of programs:

1 . This half of the screenshot is a benchmark for the latest version of JtR that I compiled from source. Since my CPU supports AVX2, John the Ripper supports that as well.

2 . And I installed this one from the standard repository of my distribution – it is compiled with AVX.

The difference is significant.

Result for the first part

So, this is the first part on John the Ripper – a popular offline brute force. In it, we learned the tricks for installing JtR, and also learned how to test the speed of brute-forcing passwords, turn on the video card for use and control actions when overheating.

When running such programs (John the Ripper and Hashcat), you need to take care of proper cooling. If your computer/laptop overheats, then the brute-force speed will drop very significantly.

The next parts will be even more interesting! We'll learn how to extract password hashes and launch dictionary and mask attacks, and much more!

How to Crack Passwords using John The Ripper – Pentesting Tutorial

Manish Shivanandhan

If you are a pen-tester, cracking passwords is something you will be doing on a daily basis. This can include login passwords, file passwords, and almost anything that is protected using a password.

John the Ripper (JtR) is a popular password-cracking tool. John supports many encryption technologies for Windows and Unix systems (Mac included).

One remarkable feature of John is that it can autodetect the encryption for common formats. This will save you a lot of time in researching the hash formats and finding the correct tool to crack them.

John is also a dictionary-based tool. This means that it works with a dictionary of common passwords to compare it with the hash in hand. Here is a common password list called rockyou.txt.

While you can use popular wordlists like RockYou, John also has its own set of wordlists with thousands of common passwords. This makes John very effective when cracking systems with weak passwords.

This is how John works by default:

• recognize the hash type of the current hash
• generate hashes on the fly for all the passwords in the dictionary
• stop when a generated hash matches the current hash.

This is not the only way John finds a password. You can also customize John based on your requirements. For example, you can specify the password format using the — — format flag.

In this article, we will first install John followed by a walkthrough of the different modes you can use. We will then use John to crack passwords for three different use cases — a Windows password, a Linux password, and a zip file password.

A quick disclaimer before we get started: do not use this tool for nefarious purposes. This is meant to be an educational tutorial to help you protect yourself and your clients or team from password attacks. Use this information responsibly and safely!

Let’s get cracking.

How to Install John the Ripper

If you are using Kali Linux, John is pre-installed. You can use John by typing the following command:

For Ubuntu/Debian, you can get John from the apt source. Here is the command to install John in Ubuntu:

In Mac, you can find John in Homebrew:

For windows and other operating systems, you can find the binaries here.

Once you have installed John, try the help command to make sure your installation is working. The help command can also be used as a reference when working with John.

Here is the output of the help command:

John help command

How to Use John the Ripper

Now that we know what John is, let’s look at the three modes it offers you. You will be using one of these three for most of your use cases.

• Single crack mode
• Wordlist mode
• Incremental mode

Let’s look at each one of them in detail.

What is Single Crack Mode?

In single-crack mode, John takes a string and generates variations of that string in order to generate a set of passwords.

For example, if our username is “stealth” and the password is “StEaLtH”, we can use the single mode of John to generate password variations (STEALTH, Stealth, STealth, and so on).

We use the “format” flag to specify the hash type and the “single” flag to let John know we want to use the single crack mode. We will also create a crack.txt file which will contain the username and the hash value of the password.

Now we can use the following command to use John’s single crack mode:

And here is the result. You can see that John has successfully found the correct password “StEaLtH”.

John single crack mode

That was fun, wasn’t it? Now let’s look at the dictionary mode to crack more complicated passwords.

What is Dictionary Mode?

In dictionary mode, we will provide John with a list of passwords. John will generate hashes for these on the fly and compare them with our password hash.

For this example, we will use the RockYou wordlist. If you are using Kali, you can find it at /usr/share/wordlists/rockyou.txt. We will also have a crack.txt file with just the password hash.

Here is the command to run John in dictionary mode using the wordlist.

And John finds the password pretty quickly.

John wordlist mode

The weaker the password is, the quicker John can figure it out. This is why it is always recommended to have strong passwords.

What is Incremental Mode?

Incremental mode is the most powerful mode provided by John. It tries all possible character combinations as passwords.

This sounds great, but there is a problem. The cracking can go on for a long time if the password is too long or if it’s a combination of alphanumeric characters and symbols.

You will rarely use this mode unless you have no other option. In typical cases, a combination of Social Engineering attacks and wordlist mode will help you crack most of the hashes.

If you would like to try the incremental mode, here is the syntax.

Here, the -i flag tells John that we want to use the increment mode. The “digits” placeholder can be used to set the maximum number of digits in the password.

You can also add the “format” option to make it easier for John to start cracking.

Use Cases for John the Ripper

Now that you understand the different modes of John, let’s look at a few use cases.

We will use John to crack three types of hashes: a windows NTLM password, a Linux shadow password, and the password for a zip file.

How to Crack a Windows Password

Let’s start with Windows. In Windows, the password hashes are stored in the SAM database. SAM uses the LM/NTLM hash format for passwords, so we will be using John to crack one.

Getting passwords from the SAM database is out of scope for this article, but let’s assume you have acquired a password hash for a Windows user.

Here is the command to crack it:

The crack.txt will contain the password hash. If John is unable to crack the password using its default wordlist, you can use the RockYou wordlist using the — — wordlist flag.

How to Crack a Linux Password

Now, let’s crack a Linux password. In Linux, there are two important files saved in the /etc folder: passwd and shadow.

• /etc/passwd -> stores information like username, user id, login shell, and so on.
• /etc/shadow -> contains password hash, password expiry, and so on.

In addition to the “john” command, John comes with a few other utilities. One of them is called “unshadow”.

The unshadow command combines the passwd and shadow files together into a single file. This can then be used by John to crack passwords.

Here is how we use the unshadow command:

This command will combine the files together and create an output.db file. We can now crack the output.db file using John.

John tries to find the password for all the users in the passwd file and generates the output with the list of cracked passwords. Again, you can use custom wordlists via the — — wordlist flag.

How to Crack a Zip File Password

Finally, let’s crack a zip file password. To do that, we first have to get the hash of the zip file’s password.

Like unshadow, John has another utility called zip2john. zip2john helps us to get the hash from zip files. If you are cracking a .rar file, you can use the rar2john utility.

Here is the syntax to get the password hash of a zip file:

The above command will get the hash from the zip file and store it in the zip.hashes file. You can then use John to crack the hash.

John also has several other functionalities that will help you crack a variety of passwords. You can find the complete documentation for John here.

How to Defend Against Password Attacks

So far we have seen how to crack passwords with John the Ripper. But how do we defend against these types of brute-force attacks?

The simplest way to defend against password attacks is to set a strong password. The stronger the password is, the harder it is to crack.

The second step is to stop using the same passwords for multiple sites. If one site gets hacked, your password will be exposed to the internet. A hacker can then use the email/password combination to test your credentials across other sites. You can check if your password is on the internet here.

The final step would be to generate random passwords and use a password manager. There are a variety of options including the Chrome built-in Google password manager. If you use a strong password for each site you use, it becomes extremely hard to crack your password.

Summary

John is a popular and powerful password-cracking tool. It is often used by both penetration testers and black hat hackers for its versatility and ease of use.

From automated hash discovery to dictionary-based attacks, John is a great tool to have in your pentesting toolkit.

Hope this article helped you to understand John the Ripper in detail. You can connect with me here or visit my blog here.

Name already in use

dvm-docs / OS / Security / john-the-ripper.md

• Go to file T
• Go to line L
• Copy path
• Copy permalink

• Open with Desktop
• View raw
• Copy raw contents Copy raw contents

Copy raw contents

Copy raw contents

John The Ripper

John The Ripper , John for the friends.

Table of Contents

john is a password cracker tool that make use of a wordlist or .

This document is based on following the THM room: https://tryhackme.com/room/johntheripper0

The installation of this software is pretty easy.

Probably your GNU/Linux distribution has packaged this for you. Search for john and install the required package. For example:

The graphical interface for john. See the johnny packages for this. Personally, I don’t like the interface so much and prefer the command line version. The GUI confuse me a lot.

John can make use of wordlist to make a dictionary attack.

Wordlists, like the name say it, is a list of words. Could be names, passwords, filenames and whatever. This goes beyond the scope of this documents and a dedicated documents has been made for this. See the dedicated document: wordlists

John has a build in hash identifier, but isn’t great at this job. So you can try this one:

Identifying the type of hash

Before you can start cracking, you need to know what you want to crack. You need to get to know what kind of «protection» is used.

See the dedicated document on how to identify the type of hash.

Cracking basic hashes

/.john/john.pot which contains previously cracked passwords. John does not show already created hashes/passwords. So bad and so strange. For this you need to use the show command and specify the hash or password file like following:

Cracking Windows Authentication Hashes

You can acquire NTHash/NTLM hashes by dumping the SAM database on a Windows machine, by using a tool like Mimikatz or from the Active Directory database: NTDS.dit. You may not have to crack the hash to continue privilege escalation- as you can often conduct a «pass the hash» attack instead, but sometimes hash cracking is a viable option if there is a weak password policy.

Cracking /etc/shadow Hashes

John can be very particular about the formats it needs data in to be able to work with it, for this reason- in order to crack /etc/shadow passwords, you must combine it with the /etc/passwd file in order for John to understand the data it’s being given. To do this, we use a tool built into the John suite of tools called unshadow. The basic syntax of unshadow is as follows:

Let’s break that down:

• unshadow — Invokes the unshadow tool
• [path to passwd] — The file that contains the copy of the /etc/passwd file you’ve taken from the target machine
• [path to shadow] — The file that contains the copy of the /etc/shadow file you’ve taken from the target machine

Note on the files

When using unshadow , you can either use the entire /etc/passwd and /etc/shadow file- if you have them available, or you can use the relevant line from each, for example:

FILE 1 — local_passwd

Contains the /etc/passwd line for the root user:

FILE 2 — local_shadow

Contains the /etc/shadow line for the root user:

We’re then able to feed the output from unshadow , in our example use case called unshadowed.txt directly into John. We should not need to specify a mode here as we have made the input specifically for John, however in some cases you will need to specify the format as we have done previously using: —format=sha512crypt

Single Crack Mode

So far we’ve been using John’s wordlist mode to deal with brute forcing simple., and not so simple hashes. But John also has another mode, called Single Crack mode. In this mode, John uses only the information provided in the username, to try and work out possible passwords heuristically, by slightly changing the letters and numbers contained within the username.

The best way to show what Single Crack mode is, and what word mangling is, is to actually go through an example:

If we take the username: Markus

Some possible passwords could be:

• Markus1, Markus2, Markus3 (etc.)
• MArkus, MARkus, MARKus (etc.)
• Markus!, Markus$, Markus* (etc.)

This technique is called word mangling. John is building it’s own dictionary based on the information that it has been fed and uses a set of rules called «mangling rules» which define how it can mutate the word it started with to generate a wordlist based off of relevant factors for the target you’re trying to crack. This is exploiting how poor passwords can be based off of information about the username, or the service they’re logging into.

John’s implementation of word mangling also features compatibility with the Gecos fields of the UNIX operating system, and other UNIX-like operating systems such as Linux. So what are Gecos? Remember in the last task where we were looking at the entries of both /etc/shadow and /etc/passwd? Well if you look closely You can see that each field is seperated by a colon «:». Each one of the fields that these records are split into are called Gecos fields. John can take information stored in those records, such as full name and home directory name to add in to the wordlist it generates when cracking /etc/shadow hashes with single crack mode.

Using Single Crack Mode

To use single crack mode, we use roughly the same syntax that we’ve used to so far, for example if we wanted to crack the password of the user named «Mike», using single mode, we’d use:

• —single — This flag lets john know you want to use the single hash cracking mode.

A Note on File Formats in Single Crack Mode:

If you’re cracking hashes in single crack mode, you need to change the file format that you’re feeding john for it to understand what data to create a wordlist from. You do this by prepending the hash with the username that the hash belongs to, so according to the above example- we would change the file hashes.txt

Hash type: raw-md5

What are Custom Rules?

As we journeyed through our exploration of what John can do in Single Crack Mode- you may have some ideas about what some good mangling patterns would be, or what patterns your passwords often use- that could be replicated with a certain mangling pattern. The good news is you can define your own sets of rules, which John will use to dynamically create passwords. This is especially useful when you know more information about the password structure of whatever your target is.

Common Custom Rules

Many organisations will require a certain level of password complexity to try and combat dictionary attacks, meaning that if you create an account somewhere, go to create a password and enter:

You may receive a prompt telling you that passwords have to contain at least one of the following:

• Capital letter
• Number
• Symbol

This is good! However, we can exploit the fact that most users will be predictable in the location of these symbols. For the above criteria, many users will use something like the following:

A password with the capital letter first, and a number followed by a symbol at the end. This pattern of the familiar password, appended and prepended by modifiers (such as the capital letter or symbols) is a memorable pattern that people will use, and reuse when they create passwords. This pattern can let us exploit password complexity predictability.

Now this does meet the password complexity requirements, however as an attacker we can exploit the fact we know the likely position of these added elements to create dynamic passwords from our wordlists.

How to create Custom Rules

Custom rules are defined in the john.conf file , usually located in /etc/john/john .conf if you have installed John using a package manager or built from source with make and in /opt/john/john.conf on the TryHackMe Attackbox.

Let’s go over the syntax of these custom rules, using the example above as our target pattern. Note that there is a massive level of granular control that you can define in these rules, I would suggest taking a look at the wiki here in order to get a full view of the types of modifier you can use, as well as more examples of rule implementation.

[List.Rules:THMRules] — Is used to define the name of your rule, this is what you will use to call your custom rule as a John argument.

We then use a regex style pattern match to define where in the word will be modified, again- we will only cover the basic and most common modifiers here:

• Az — Takes the word and appends it with the characters you define
• A0 — Takes the word and prepends it with the characters you define
• c — Capitalises the character positionally

These can be used in combination to define where and what in the word you want to modify.

Lastly, we then need to define what characters should be appended, prepended or otherwise included, we do this by adding character sets in square brackets [ ] in the order they should be used. These directly follow the modifier patterns inside of double quotes » » . Here are some common examples:

• [0-9] — Will include numbers 0-9
• [0] — Will include only the number 0
• [A-z] — Will include both upper and lowercase
• [A-Z] — Will include only uppercase letters
• [a-z] — Will include only lowercase letters
• [a] — Will include only a
• [!£$%@] — Will include the symbols !£$%@

Putting this all together, in order to generate a wordlist from the rules that would match the example password «Polopassword1!» (assuming the word polopassword was in our wordlist) we would create a rule entry that looks like this:

• [List.Rules:PoloPassword]
• cAz»[0-9] [!£$%@]»

• Capitalise the first letter — c
• Append to the end of the word — Az
• A number in the range 0-9 — [0-9]
• Followed by a symbol that is one of [!£$%@]

Using Custom Rules

We could then call this custom rule as a John argument using the —rule=PoloPassword flag.

As a full command: john —wordlist=[path to wordlist] —rule=PoloPassword [path to file]

As a note I find it helpful to talk out the patterns if you’re writing a rule- as shown above, the same applies to writing RegEx patterns too.

Jumbo John already comes with a large list of custom rules, which contain modifiers for use almost all cases. If you get stuck, try looking at those rules [around line 678] if your syntax isn’t working properly.

Now, time for you to have a go!

Cracking a Password Protected Zip File

Yes! You read that right. We can use John to crack the password on password protected Zip files. Again, we’re going to be using a separate part of the john suite of tools to convert the zip file into a format that John will understand, but for all intents and purposes, we’re going to be using the syntax that you’re already pretty familiar with by now.

Similarly to the unshadow tool that we used previously, we’re going to be using the zip2john tool to convert the zip file into a hash format that John is able to understand, and hopefully crack. The basic usage is like this:

• [options] — Allows you to pass specific checksum options to zip2john, this shouldn’t often be necessary
• [zip file] — The path to the zip file you wish to get the hash of
• > — This is the output director, we’re using this to send the output from this file to the.
• [output file] — This is the file that will store the output from

We’re then able to take the file we output from zip2john in our example use case called «zip_hash.txt» and, as we did with unshadow, feed it directly into John as we have made the input specifically for it.

Cracking Password Protected RAR Archives

We can use a similar process to the one we used in the last task to obtain the password for rar archives. If you aren’t familiar, rar archives are compressed files created by the Winrar archive manager. Just like zip files they compress a wide variety of folders and files.

Almost identical to the zip2john tool that we just used, we’re going to use the rar2john tool to convert the rar file into a hash format that John is able to understand. The basic syntax is as follows:

• rar2john — Invokes the rar2john tool
• [rar file] — The path to the rar file you wish to get the hash of
• > — This is the output director, we’re using this to send the output from this file to the.
• [output file] — This is the file that will store the output from

Once again, we’re then able to take the file we output from rar2john in our example use case called «rar_hash.txt» and, as we did with zip2john we can feed it directly into John..

Cracking SSH Keys

Okay, okay I hear you, no more file archives! Fine! Let’s explore one more use of John that comes up semi-frequently in CTF challenges. Using John to crack the SSH private key password of id_rsa files. Unless configured otherwise, you authenticate your SSH login using a password. However, you can configure key-based authentication, which lets you use your private key, id_rsa, as an authentication key to login to a remote machine over SSH. However, doing so will often require a password- here we will be using John to crack this password to allow authentication over SSH using the key.

Who could have guessed it, another conversion tool? Well, that’s what working with John is all about. As the name suggests ssh2john converts the id_rsa private key that you use to login to the SSH session into hash format that john can work with. Jokes aside, it’s another beautiful example of John’s versatility. The syntax is about what you’d expect. Note that if you don’t have ssh2john installed, you can use ssh2john.py , which is located in the /opt/john/ssh2john.py . If you’re doing this, replace the ssh2john command with python3 /opt/ssh2john.py or on Kali, python /usr/share/john/ssh2john.py .

• ssh2john — Invokes the ssh2john tool
• [id_rsa private key file] — The path to the id_rsa file you wish to get the hash of
• > — This is the output director, we’re using this to send the output from this file to the.
• [output file] — This is the file that will store the output from

Example Usage on Kali

For the final time, we’re feeding the file we output from ssh2john, which in our example use case is called «id_rsa_hash.txt» and, as we did with rar2john we can use this seamlessly with John:

Thank you for completing this room on John the Ripper! I hope you’ve learnt a lot along the way. I’m sure by now you understand the basic principles and the pattern that there is to using John with even the most obscure supported hashes. I’d recommend checking out the Openwall Wiki here for more information about using John, and advice, updates or news about the tool.