WEBVTT

00:00:00.140 --> 00:00:03.620
There are a number of password dumping tools which can be used on

00:00:03.620 --> 00:00:06.270
Windows machines to obtain the password hashes.

00:00:07.090 --> 00:00:10.590
In this example, we will use PwDump version 7.1.

00:00:11.500 --> 00:00:15.730
Using the tool, we will dump out the SYSTEM and SAM registry hives,

00:00:16.030 --> 00:00:19.850
which will then give us the NTLM and LAN Manager hashes of

00:00:19.850 --> 00:00:21.690
the various accounts within the system.

00:00:22.010 --> 00:00:26.170
We will then use the hashes we obtained with John coupled with the word

00:00:26.170 --> 00:00:29.850
lists to crack them and obtain the clear text passwords.

00:00:30.180 --> 00:00:34.960
I have already uploaded the PwDump tool to the targeted machine. In order to

00:00:34.960 --> 00:00:37.840
run the tool, we can perform this from a shell prompt.

00:00:38.010 --> 00:00:42.880
I'm going to issue the command Pwdump7.exe, followed by an output

00:00:42.880 --> 00:00:47.970
file, which I will call WindowsHashes.txt. What the tool did right

00:00:47.980 --> 00:00:51.140
now is it dumped both of the registry hives that we need that we

00:00:51.140 --> 00:00:52.480
can now use within John.

00:00:53.210 --> 00:00:54.860
Let's copy this to our machine.

00:00:55.110 --> 00:01:00.400
I'm going to quickly download the WindowsHashes.txt to my Kali Linux machine.

00:01:03.380 --> 00:01:05.019
Now that I have this on my machine,

00:01:05.420 --> 00:01:09.060
let's use John to crack those hashes. There are three files which I

00:01:09.060 --> 00:01:11.120
would like to bring to your attention within John,

00:01:11.250 --> 00:01:15.310
the first being john.pot. Every time John the Ripper cracks a hash,

00:01:15.700 --> 00:01:17.710
the results are recorded in the pot file.

00:01:17.870 --> 00:01:21.280
This helps John skip these hashes should they reappear again.

00:01:21.510 --> 00:01:25.090
The pot file can also be used to customize the cracking process.

00:01:25.320 --> 00:01:28.870
It can be used to perform character analysis of already cracked

00:01:28.870 --> 00:01:31.270
hashes and prepare custom character sets.

00:01:32.020 --> 00:01:36.250
The john.rec file is the default session file for John the Ripper.

00:01:36.390 --> 00:01:39.480
When you run John without specifying any session names,

00:01:39.870 --> 00:01:43.520
it creates a file called john.rec. This file holds the

00:01:43.520 --> 00:01:46.400
command‑line parameters which were passed to John.

00:01:46.700 --> 00:01:50.850
It is also used when you want to resume your cracking process at a later stage.

00:01:51.040 --> 00:01:54.730
The john.log file holds the cracking process details and the

00:01:54.730 --> 00:01:57.720
sequence of characters that John has already tried.

00:01:57.850 --> 00:02:00.210
Keep in mind that the file size of this will depend

00:02:00.210 --> 00:02:01.840
on how long John has been running.

00:02:02.340 --> 00:02:05.980
The files that we have just discussed can be found in the John directory.

00:02:07.010 --> 00:02:09.400
Now that we have the hash files from the machine,

00:02:09.509 --> 00:02:14.650
let's go ahead and crack this using John. I will issue the command john and I

00:02:14.650 --> 00:02:21.200
will define a pot file called winhash.pot. Next, I will define a session name

00:02:21.200 --> 00:02:26.400
called winhash‑session, and the reason for this would be in case I would like

00:02:26.400 --> 00:02:28.560
to resume this at a later stage.

00:02:29.330 --> 00:02:29.720
Next,

00:02:29.720 --> 00:02:34.180
I will define the file which contains the hashes. So you will

00:02:34.180 --> 00:02:37.160
notice that I have not defined a word list, and the reason for this

00:02:37.160 --> 00:02:39.840
is I would like to show you that John would leverage its own

00:02:39.840 --> 00:02:45.700
built‑in word list and its own rules, which currently is the WorldList rule set.

00:02:45.840 --> 00:02:49.560
Thus far, John has already cracked two password hashes,

00:02:49.900 --> 00:02:54.040
which are for the administrator account and for the vagrant account .To

00:02:54.040 --> 00:02:58.320
view the status of the current cracking session, I can hit any key, which

00:02:58.320 --> 00:03:02.670
will provide me with a status report. Within this report, there are a

00:03:02.670 --> 00:03:04.350
number of metrics that's displayed.

00:03:04.790 --> 00:03:07.460
Let's take a look at what each one of these metrics stand for.

00:03:07.940 --> 00:03:12.150
The first metric represents the number of successful guesses per second.

00:03:12.790 --> 00:03:16.350
It will stay at 0 until at least 1 password is cracked.

00:03:18.000 --> 00:03:23.850
The next one stands for candidate passwords tested per second. The one

00:03:23.850 --> 00:03:29.170
after that stands for crypts or password hashes or cipher computations

00:03:29.170 --> 00:03:34.980
per second. Following that is the combinations of candidate passwords

00:03:34.980 --> 00:03:37.450
or target hashes per second.

00:03:39.120 --> 00:03:41.890
Now let's use one of the word lists which we have downloaded.

00:03:42.720 --> 00:03:44.260
Our command remains the same,

00:03:44.430 --> 00:03:47.520
with the exception of adding in a specific word list,

00:03:47.880 --> 00:03:50.220
and you'll take notice that I've added in one of the

00:03:50.220 --> 00:03:52.560
word lists from our seclist repository.

00:03:53.420 --> 00:03:57.370
I added in some word mangling rules, which is called WordList.

00:03:58.000 --> 00:04:01.340
Let's take a look at the outcome now. By using a better word

00:04:01.340 --> 00:04:04.810
list, we were able to increase our chances of success by

00:04:04.810 --> 00:04:06.470
cracking some additional passwords.

00:04:07.600 --> 00:04:10.600
Let's move onto the next demo where we will look at using John the

00:04:10.600 --> 00:04:14.200
Ripper to crack password hashes from Linux machines.