Welcome to part four of this module
now that we have covered the more popular word list creation tools.
It's time to take a look at the infamous John the Ripper John the Ripper is a free password cracking
software tool initially developed for Unix systems.
It now runs on 15 different platforms 11 of which are architecture specific versions of Unix DOS when
32 bios an open VM s it comes pre packed with Cally Linux and it is located under applications.
Password attacks John John is one of the most popular password testing and breaking programs out there.
It combines a number of password crackers into one package.
Auto detects password hash types and includes a customizable cracker.
It can be run against various encrypted password formats including several crypt password hashes most
commonly found on various Unix versions such as based on DHS MDG 5 and blowfish Kerber Ross F S and
windows and T 2000 XP 2003 and so forth additional modules have extended its ability to include empty
four based password hashes and passwords stored in LDP my sequel and others John doesn't actually need
a word list in order to function although providing one is usually a good idea for more complex hashes
as a small aside.
Notice that a single tack or dash is used for loading the help options with John.
The first thing I want to point out because John doesn't really make it self evident is that unless
you specify otherwise using the tack tack port equals name switch.
John is going to save all of your cracked passwords to a default port file.
This file is typically located in period slash John under the root directory.
I'll demonstrate this once we have a few passwords.
This is important to remember though in case you ever wish to either crack a Hash again perhaps to test
out a new word list or if you just want to reference all of the hashes and passwords that you have cracked
to date.
There are several ways to use John and several approaches one can take to doing so.
In this first example we're going to crack the shadow file that comes in Cally Linux.
We already know the default password is tor but let's say that we forgot it.
Or perhaps more likely we have pilfered the Etsy shadow file of another Linux system and wish to crack
those passwords.
This is about as easy as it gets.
We just type.
John get see Shadow and hit enter.
No word list was needed in this example.
In fact the use of a word list with John is purely optional although doing so will increase your chances
of cracking the password if you run the same command again.
Notice that it does not try to crack the password a second time nor does it display the already cracked
password.
This is because as I mentioned the information is stored in John's pot file.
There are two ways to retrieve this information
we could use the tac tac show option
which shows us that the user name is Root and the password is Tor.
It also displays the hash once again and more usernames and passwords would be listed if the file contained
them.
Alternatively now that we've got a user name and password we'll type Ellis and notice that John pot
has been created.
Again this is the default file and directory but you can use the aforementioned switch to create a unique
port file.
So if we cap the file
we can see a rather long hash string and at the end of it after the colon we can see the password.
Tor will refer back to this as we go.
It isn't a horrible idea to create multiple port files for different projects since the program makes
no effort to indicate wish which hash and cracked password came from which project and the list can
grow quite long over time.
One on quirk of John the Ripper is that I've noticed over the years is that sometimes with some formats
John has this odd habit of cracking a password and then separating it into two parts as though they
were two separate hashes.
For example secret for eighty three might cat out as secret for the first line and 43 for the second.
Even though it's really all one string using the Tac tac show command when you run John usually gives
the full string so I don't know why the pot file displays it in this way.
It can make things a bit confusing.
So my point is that it's not a great idea to rely on just the pot file as a long term repository of
your cracked passwords.
All right.
So in the basic example we cracked a shadow file.
Now let's look at cracking a Windows 7 password file.
This is only slightly more advanced.
Here's the file we want to crack we can see in plain text that the user name is test let's pretend for
a moment that we don't know what format this hash is a simple google search would probably tell us that
Windows hashes are cracked using the elm format option but let's say that we don't know the exact source
of a hash and therefore we can't easily just look it up.
There's a handy little program called hash identifier that comes into play hash identifier comes prepackaged
with Kelly 2.0.
It's a simple little program and it's too simple to be an entire section unto itself.
So this is the perfect moment to cover it.
So first we're going to copy the hash.
Please notice that everything between these two cones is the hash the 1 0 0 7 is not part of it.
And I believe that this is the encrypted version of test.
So we're going to minimize this
and we'll call up hash identifier
and now we will paste in our hash
excellent hash.
I.D. has determined that the hash is either empty five or elem.
So if we didn't already know elem we'd probably try empty five.
First we'd fail and then we'd try them.
Since we know we'll skip the failure and go right in and crack the password to get out of hash identifier.
Just press control C and now we'll type in John Tack Tack format equals l m Tak tak user equals test
because that is the user name associated with this hash.
If there was no user name associated with the hash you would just not include this and we'll give it
the path route slash Windows 7 hash and we'll press enter.
So we're using the first switch to specify the format of the hash to be cracked.
The second is the user name associated with the hash and then we provide the path to the hash file which
in my case is stored in the root directory and there we go right away.
Password 1 2 3.
But it's divided into two parts which is a little weird and if we cut the pot file
we can see that the same thing has happened.
That's a little weird but the password is in fact password or pass W R D I should say 1 2 3.
So that's a little quirk of John like I was talking about before does that sometimes.
But in any case it did give us the password so right away we see that we caches fall very easily to
John we haven't needed to resort to a word list yet I created a text file with several simple empty
five hashes for the next part of the demonstration.
Again if we didn't already know these were empty fives we could just call up a hash identifier or some
other similar tool.
Paste the hash in and get a read out of the most probable formats so for this next attack let's go ahead
and specify a word list.
I created a very simple list using crunch just called Passwords dot text for more info about crunch
please see the prior video now at this point you might be wondering if there is a list of all the formats
that are available with John the Ripper and there is for this we just type John Tak tak sorry list people's
formats and I have to say that for such a well regarded tool with such an illustrious history and the
cracking community this read out is the sloppy est of all the cracking tools bundled with this operating
system and you do actually need to find the correct format code in this mess because in some cases simply
using empty 5 won't produce a result.
In this case it expects us to type in raw MDG 5 so that's going to look like this.
Shawn tack tack format equals raw dash empty five.
We're gonna give it our path to the target and we're going to say word list equals root passwords and
you could change everything after the equal sign for word list for example if you were using the rock
you would list.
You would simply give it that path and we press enter
we can see that it cracked three of the six hashes we could specify a larger stronger word list and
crack those remaining three but that could potentially take hours.
Keep in mind that the larger the word list the longer this process will take.
Also keep in mind that while John is performing the process of cracking hashes it is extremely resource
intensive.
If you decide to set John to work on cracking hashes for you overnight make absolutely sure that the
cooling system for your computer is fully operational where you could seriously burn out your processor.
I've seen old laptops heat up to dangerous temperatures when running John for prolonged periods since
most people tend to leave John on to work overnight while they sleep.
It's worth the safety reminder to make sure that nothing flammable is anywhere near your laptop or computer
system just in case.
So now let's take a look at how to crack into a password protected rar file.
The process you're about to see is almost identical for a password protected zip file so crystal clear
the screen the first thing we need to do is get the password hash for the raw file that we wish to break
into the Ripper comes to the party prepared with RA to John which will give us a hash value for the
File.
We'll also be able to use zip to John in the same way for a zip file.
So we take the rar file and we typed RAS to John secret dot Ra.
I suppose I should point out that secret Ras is a file I created and a stored on my desktop.
If you have the raw file in another directory you will need to provide the path
and we're going to tie
secret dot text.
This will cause John the Ripper to create a text file which will contain the hash value of the password
for the RAs and I'm afraid I am going to have to specify the directory so route desktop and we'll put
this on Route desktop.
There we go.
Now
secret Don't text has been created.
And if we open it up
we can see that we have the value for the hash.
Great.
So now you may be thinking that we're almost there and we are except for a bug that threw me for a loop
for about four hours while trying to record this video and you may run into it as well.
There's precious little help for it online which is why I'm including it in this video.
If we did try to do this the way that John wants it to be done by saying John Tak tak format equals
RA secret text we get this annoying and very uninformative error message.
It doesn't matter how you try to adjust the syntax you won't get anywhere poring through forums.
I've seen that many other people have had this same problem.
The solution is just to remove the format switch now this quite naturally makes this process take much
longer
but at least it will work please note that again we could have used a custom word list here although
it's really not necessary in this instance.
John will crack this eventually and I'll press the spacebar while John works to give you an idea of
how long this will take and of the progress being made.
I'll make cuts to the video if need be.
I'm not really sure exactly how long this will take.
OK so why is this such a big issue for users of the Ripper as near as I can determine based on my research.
Older versions of John worked just fine.
Then somewhere along the way something went a little screwy with zip to John and RA to John in terms
of how they write out the hash.
I can't spot the error with my naked eye and I presume that the developers haven't been able to either
the long and short of it is that John does not recognize the format of the hash.
So when you specify a rar or zip.
John throws up its hands spits out that error and just simply gives up by not specifying a format every
format will be attempted.
John literally throws the kitchen sink at the hash.
So of course it takes about 30 times longer than again this is only a single hash that we're dealing
with here.
So that's good news but the bad news is that using every format like this means that a complex password
is going to take much much longer to crack.
As of the time of this recording I don't know what the fix is.
You could downgrade to a much older version of John the Ripper though of course.
I don't recommend doing that.
Maybe if enough people complain the developers will finally fix the glitch.
Or maybe I'm misunderstanding the nature of the error.
In either case I recommend you try it with the format switch first and if it works for you.
Great.
If not you'll just have to bite the bullet until a better solution presents itself.
While this is running I want to go over one more important thing about this process because there is
a lot of misunderstanding particularly as it relates to encrypted zip and rar files.
Password hashes are not extracted from the file itself.
John the Ripper does not really do this to correct the misnomer.
John the Ripper does not actually retrieve the hash from the file itself.
It extracts certain information from the file.
Also it is completely inaccurate to believe that the file is entirely encrypted.
In the case in cases where encryption is being used instead critical unencrypted an encrypted file items
such as the salt are retrieved to generate a non hash.
These items are used by John the Ripper with various password guesses to test the decryption.
It uses the zip or RAR password hash generation function to create a hash from the guesses that is in
turn used to generate the crypt values the generated crypto values are then used to test against a small
extracted and well-defined portion of the encrypted file.
So while John the Ripper is not extracting a password password hash that can be sent to any old password
hash checker rainbow table lookup thing it is doing the next best thing extracting critical cracking
information.
The steps to crack it are essentially one hash is generated from a password guests to a few extra steps
are added to the check that decryption succeeds or fails and there are a lot of fails and three repeat
what makes Rau cracking so difficult is a different salt for each RA file and more importantly the large
and variable number of hash iterations that are needed before the decryption test can even be performed.
The newer zip process is similar but the iterations are not variable.
At least last time I checked making it somewhat easier.
That is the nut of how it is done and the answer is you don't really get a password hash of a zip file
or Rafael until just before the file is actually cracked.
So this is just about done but I am going to make a cut to the video here already.
So here we have the super secure password of 1 2 3 4.
Now obviously I chose a weak password so that this process would not take too long.
Remember that this password is now included in the john pot file with the others.
Keep in mind also that you can use a word list for cracking this as you can with any other type of cracking
that John performs.
It's just not a requirement.
All right then this covers all of the basic and most common uses of John the Ripper.
Remember that John can be used to crack any sort of hash listed in the formats read out.
So if you run up against a hash somewhere else by all means give it a try.
This is a powerful tool with a lot of possibilities.
It's been around forever and despite a few bugs that I really wish they would fix.
It is pretty well maintained.
If you find that John simply won't work right for you and Carly try it out on another operating system
even windows as there are versions that work with just about everything.
I hope this tutorial was helpful and I remind you to never use this or any other tool against any target
that you do not personally own or have written permission to penetration test.
Otherwise you might be breaking the law.
Thank you.