WEBVTT 00:00:00.430 --> 00:00:03.450 Hey there. I'm Rishalin, and welcome to this Red Team Tools 00:00:03.450 --> 00:00:06.570 course by Pluralsight, and today, I will be showing you how to 00:00:06.570 --> 00:00:08.570 access credentials using John the Ripper. 00:00:09.210 --> 00:00:12.090 Let's consider a scenario. You have been contracted to 00:00:12.090 --> 00:00:14.350 perform a red team assessment by your client. 00:00:15.080 --> 00:00:17.640 One of the items that the client has asked you to perform 00:00:17.780 --> 00:00:20.280 is the auditing of the strength of passwords which have 00:00:20.280 --> 00:00:21.750 been used in the environment. 00:00:22.640 --> 00:00:23.770 In order to do this, 00:00:24.060 --> 00:00:26.180 you would need to correct the password hashes that you come 00:00:26.180 --> 00:00:28.700 across while performing your penetration test. 00:00:29.590 --> 00:00:30.920 Over and above this task, 00:00:31.340 --> 00:00:33.730 you would need to correct password hashes that you discover 00:00:34.130 --> 00:00:35.950 to further you reaching the environment. 00:00:36.720 --> 00:00:40.680 One of the tools which you can use to accomplish the tasks is John the Ripper. 00:00:41.330 --> 00:00:43.530 Let's spend a few moments discussing John the Ripper. 00:00:43.930 --> 00:00:46.340 It is one of the most simplest tools to use, 00:00:46.420 --> 00:00:48.780 which offer a high level of customization. 00:00:51.040 --> 00:00:53.910 John the Ripper, or JTR, as it's commonly abbreviated, 00:00:54.050 --> 00:00:58.410 was developed by Alexander Peslyak, who is also known as Solar Designer. 00:00:58.920 --> 00:01:02.850 He's the founder of Openwall who maintains the releases of John the Ripper. 00:01:03.220 --> 00:01:06.840 Thanks Alexander for creating this awesome tool. John the 00:01:06.840 --> 00:01:08.410 Ripper is an open source passive cracker, 00:01:09.090 --> 00:01:11.930 which was designed to be both feature rich and fast. 00:01:12.340 --> 00:01:15.110 It combines several cracking modes in one program, 00:01:15.410 --> 00:01:17.450 and it's fully configurable for your needs. 00:01:18.140 --> 00:01:18.900 For example, 00:01:19.210 --> 00:01:22.210 you can define a custom cracking mode using the built‑in 00:01:22.210 --> 00:01:27.040 compiler supporting a subset of C. John the Ripper is 00:01:27.040 --> 00:01:29.090 available for several different platforms, 00:01:29.350 --> 00:01:31.820 which enables you to use the same cracker everywhere. 00:01:32.700 --> 00:01:35.580 This gives you the ability to continue a cracking session, 00:01:35.710 --> 00:01:38.960 which is started on another platform on a completely different 00:01:38.960 --> 00:01:43.400 platform. Time to replace an open source tool. It is available on 00:01:43.400 --> 00:01:45.650 GitHub or via the Openwall website. 00:01:46.140 --> 00:01:49.180 Since this is open source, you have the ability to download the 00:01:49.180 --> 00:01:51.240 source code and customize it to your liking, 00:01:51.980 --> 00:01:53.850 it is easy to install and use. 00:01:54.430 --> 00:01:58.150 It has a wide range of supported hashes of which it is able to crack. 00:01:58.590 --> 00:02:01.290 Some of them are commonly used today, such as SHA, 00:02:01.790 --> 00:02:04.620 MD5, SSH private keys, and of course, 00:02:04.620 --> 00:02:09.780 the most common, NTLM version 1 and 2, and Kerberos protocols. Of course, 00:02:09.789 --> 00:02:14.770 there is a lot more that John the Ripper can crack. So when we consider the 00:02:14.780 --> 00:02:18.440 Red team kill chain, John the Ripper comes into play directly after the 00:02:18.440 --> 00:02:22.820 exploitation phase and moves you along the kill chain past the escalation 00:02:22.820 --> 00:02:27.150 phase into what's the lateral movement phase. Let's map the techniques that 00:02:27.150 --> 00:02:30.460 you will learn in this course to the Mitre Att&ck framework. The main 00:02:30.460 --> 00:02:34.650 category that we'll be considering is credential access. Within credential 00:02:34.650 --> 00:02:37.820 access, the first technique that we'll look at is credential dumping. 00:02:38.060 --> 00:02:39.070 Within this technique, 00:02:39.080 --> 00:02:42.610 we will use an additional tool to obtain parts of the hashes of a system 00:02:42.740 --> 00:02:44.950 which will then be used in the brute force technique. 00:02:45.400 --> 00:02:46.610 In the brute force technique, 00:02:46.610 --> 00:02:49.610 we will attempt to brute force the hashes using the 00:02:49.610 --> 00:02:50.830 capabilities of John the Ripper. 00:02:51.900 --> 00:02:55.770 As a bonus, we will consider the exploitation for credential access technique. 00:02:56.380 --> 00:02:57.120 In this technique, 00:02:57.440 --> 00:03:00.950 we will look at a metasploit session and how we can leverage 00:03:00.950 --> 00:03:03.540 John the Ripper within that session to crack the password 00:03:03.540 --> 00:03:07.560 hashes. To follow along in the demos, you would need a version of Kali Linux. 00:03:07.920 --> 00:03:13.670 I am currently using version 2020.1b, but you can use any version that you like. 00:03:14.340 --> 00:03:14.780 Also, 00:03:14.780 --> 00:03:17.850 I recommend that you have an up to date operating system. For 00:03:17.850 --> 00:03:20.530 that, just open the terminal window and run the following 00:03:20.530 --> 00:03:25.750 commands, apt‑get update and apt‑get upgrade. 00:03:26.210 --> 00:03:29.850 This will install any updates and upgrades in your operating system. 00:03:31.440 --> 00:03:34.200 John the Ripper has a number of cracking modes which can be used. 00:03:34.500 --> 00:03:35.970 Let's take a look at a few of them. 00:03:36.940 --> 00:03:38.300 We will begin with single mode. 00:03:39.000 --> 00:03:43.120 This mode leverages a number of fields, such as login names, 00:03:43.130 --> 00:03:47.790 full names, and the user's home directory to generate candid passwords. 00:03:48.620 --> 00:03:51.940 It gives you the ability to use a large set of mangling rules, 00:03:51.950 --> 00:03:53.050 which can be applied. 00:03:53.850 --> 00:03:57.250 This is by far a much faster than wordlist mode. 00:04:00.440 --> 00:04:04.370 Wordlist mode is the simplest cracking mode supported by John the Ripper. 00:04:05.540 --> 00:04:06.080 In essence, 00:04:06.090 --> 00:04:11.010 all you need to do in this mode is specify a wordlist and some password files. 00:04:11.870 --> 00:04:14.250 Of course, you can enable word mangling rules, 00:04:14.440 --> 00:04:19.540 which can be used to modify or mangle words producing other likely passwords. 00:04:21.029 --> 00:04:23.830 Incremental mode is one of the most powerful cracking 00:04:23.830 --> 00:04:25.590 modes you could use in John the Ripper. 00:04:26.360 --> 00:04:29.080 This mode enables you to try every single possible 00:04:29.080 --> 00:04:31.550 character combination as a password. 00:04:32.320 --> 00:04:36.280 Keep in mind that due to the massive character combinations that's available, 00:04:36.620 --> 00:04:41.350 this mode might never actually terminate. External mode gives you 00:04:41.350 --> 00:04:43.830 the ability to define an external cracking mode, 00:04:43.960 --> 00:04:45.430 which can be used with John the Ripper. 00:04:46.270 --> 00:04:50.270 These functions are called in the subset of C and are compiled by John, 00:04:50.280 --> 00:04:53.650 it's startup, when you request a particular mode to be used. 00:04:55.110 --> 00:04:58.940 Mask mode is a fast way to produce password candidates given a 00:04:58.940 --> 00:05:03.230 specific mask. A mask consists of static letters, 00:05:03.270 --> 00:05:05.280 ranges, or a syntax. 00:05:05.710 --> 00:05:07.550 You could even combine both of them together.