WEBVTT

00:00:00.840 --> 00:00:03.720
Within Metasploit, you have the ability to use John the

00:00:03.720 --> 00:00:07.290
Ripper. John is found within the auxiliary modules of

00:00:07.300 --> 00:00:09.110
Metasploit. To access the module,

00:00:09.310 --> 00:00:15.180
you can issue the command use auxiliary/analyze/crack_, and

00:00:15.180 --> 00:00:18.050
right here, I'm going to hit the Tab button.

00:00:19.100 --> 00:00:22.930
Now this will display the various options that we have to leverage John

00:00:23.050 --> 00:00:26.880
within Metasploit. So let's take a look at the Linux one,

00:00:26.880 --> 00:00:27.650
for example.

00:00:28.580 --> 00:00:30.720
And if I take a look at the options that's available,

00:00:30.780 --> 00:00:33.790
you can see that I have a number of options that I can define within

00:00:33.790 --> 00:00:37.840
Metasploit, which will then use John to crack the hashes when I perform

00:00:37.840 --> 00:00:42.010
a hash dump within Metasploit. Let's take a look now at the auxiliary

00:00:42.010 --> 00:00:43.900
module that's available for Windows.

00:00:44.170 --> 00:00:46.250
We can view this by issuing the command use

00:00:46.340 --> 00:00:53.020
auxiliary/analyze/crack_windows. If you go into options, we can see that

00:00:53.020 --> 00:00:55.770
we've got quite a bit of options that we can configure here as well.

00:00:55.880 --> 00:00:58.820
So I've already dumped the hashes of a Windows machine,

00:00:58.990 --> 00:01:01.370
and this is available in my current database.

00:01:02.060 --> 00:01:05.480
Now I'm going to use John within Metasploit to perform

00:01:05.480 --> 00:01:07.930
a password crack on those hashes.

00:01:08.330 --> 00:01:10.700
Since I've already defined my custom word list,

00:01:10.830 --> 00:01:17.420
I'm going to go ahead and issue the run command. While this is running,

00:01:17.430 --> 00:01:20.430
it's running through the list of hashes that's available in my

00:01:20.430 --> 00:01:23.270
database, coupling these with my word list,

00:01:23.600 --> 00:01:26.760
and it will ultimately give me the cracked hashes and the clear

00:01:26.760 --> 00:01:30.590
text passwords of those hashes. Now that some time has elapsed,

00:01:30.710 --> 00:01:32.960
I'm going to kill the process of John.

00:01:34.980 --> 00:01:36.660
Let's take a look at the creds database,

00:01:37.620 --> 00:01:41.500
and immediately I can see that some of the password hashes have been cracked,

00:01:41.980 --> 00:01:45.700
and I'm able to view them in clear text. So here we have looked

00:01:45.700 --> 00:01:48.240
at how we can leverage John within Metasploit.