- [Instructor] So let's start off with password cracking
with John the Ripper.
John the Ripper is one
of the longtime favorite password cracking programs.
It comes with Kali Linux,
and is one of the standards
that we use for password cracking.
Very easy to crack.
And we're gonna show a demo
of how to use John the Ripper in depth.
So let's take a look at a demo of John the Ripper.
If you just type john at the command line
of your Kali box, you'll see John the Ripper's help menu.
And basically just type john, have some options,
and then the password file that you're trying to crack.
So one of the options is a word list.
So if you wanna use a dictionary list
to crack passwords, you can use that.
Use the rule switch to do some mangling rules
for the word list, so it'll switch all O's to zeros
all I's to ones, and those types of things.
It'll change uppercase to lowercase.
And it'll try to manipulate the words
for several different combinations
in order to crack more passwords.
There's also the show command,
where if you run that against the password hash list,
it'll show all the passwords you have cracked so far.
And there's the pot switch,
which basically, the pot file in John the Ripper
is a file that's used to list all the passwords
that have been cracked so far.
There's also the format switch,
which will tell John the Ripper
which hash format you're trying to crack.
So by default, John the Ripper will try
to pick the hash format based off
of the hash that you have listed.
It'll automatically try to detect what format it's in,
but for some cases, like one we're gonna show you now,
it has two different hash formats in it.
So you can specifically say
which format you're trying to crack.
So let's look at this password file that we're gonna crack.
So in here, this is a standard Windows password file.
You can see the username,
you can see the LM hash first,
and then the second after the colon is the NT hash.
So like we mentioned before,
the LM hash is kind of an outdated way of storing passwords
which older versions of Windows used.
And it's very easy to crack passwords
using this hashing algorithm.
It's because it stores it in such an insecure manner.
It converts all of your passwords to uppercase,
then splits it in two, so it is very easy to crack.
But then second, on later versions of Windows,
they stored only the NT hash.
Still has a spot for the LM hash,
just in case you're storing both.
But the NT hash is the one that you'll need to crack
in order to log into the account.
So you'll see a whole list of users and their hashes.
So if we just do john, and do it against the password hash,
you see instantly we start cracking passwords,
and you can see there all the passwords
that are getting cracked are uppercase,
which means that it's automatically doing the LM hash first.
And you can see over on the left side
are all the passwords that you're cracking.
On the right side, are the users
that it's cracking the passwords for.
If you notice, all the user accounts have a number after it,
either one or two,
and that also shows you that this is an LM hash.
Let's look up above at the very top
to show you that it is cracking LM hashes,
and we'll go into more details on what those numbers mean.
So you can see, detected type, LM,
and that's what it's cracking,
but it also says that it also recognized NT hashes in there.
We're starting off by cracking the LM,
but it also has NT in there as well.
So the numbers after the passwords are telling you
which part of the password it's cracking.
Remember LM hashes, by default,
they split the password in two sections,
two seven-character sections.
So the word password, since it's more than seven characters,
it'll split everything up until the last D,
and put it into one side of the password,
and then the D will be in the second side of the password.
So it splits it in two.
And so the number on the side there
shows you which side of the password it's cracking.
If it shows one, that means
it cracked the first half of the password.
If it shows two, that means
it cracked the second half of the password.
And that's really because LM hash has split those two.
So if you hit any key while John the Ripper is running,
it'll pop up a little status menu.
So just hit Space Bar,
and it pops up the status menu at the bottom.
So if you look at the bottom,
it says we have cracked 456 passwords,
or at least parts of passwords.
And it's done that within one minute and 21 seconds.
This is running within a virtual machine,
so it's slower than it probably would be
if you're running it right on your main machine.
And you see the percentage it's cracked,
0.02% of the password combinations so far.
It tells you when it believes
it'll finish the password cracking,
and it tells you how fast it's cracking as well.
You can see it's cracking thousands of passwords per second.
Over to the way right,
it shows what password it's currently guessing.
And you can see it goes pretty quickly.
So, as it says, passwords printed above might be partial,
and that's because it is the LM hash,
which does split passwords into two.
And that's just because of how Microsoft's algorithm works.
So if we do john, the show command, and the password hashes,
it'll show you all the passwords that it's cracked so far.
So if you look at the bottom one, the user name, greg,
it has cracked part of the password.
You can tell that because the first half
of the password is all question marks,
so it doesn't know what that password is yet.
The second half of the password is ACME.
So it has fully cracked that, and this is only the LM side.
We did not try to crack the NT side of the hash yet.
So once again, Windows stores the passwords in both.
So let's say you have a password.
Your actual password is, let's say, password,
and it's all lowercase.
The LM side of it will make it appear
like it's all uppercase,
and the NT side will show the correct all lowercase.
And to actually log into that account,
you'll have to type it in
exactly how it is on the NT side to log in.
So you would have to understand that it is lowercase.
So you can see it's still working on Greg's password there.
And it's just cracked that first half,
which is that LM side.
The NT side, which we're highlighting right now,
that is the side it will crack next.
You can see there's a lot of people with the same password.
You see those accounts that are just highlighted
all have the same password.
And because these password hashes are not salted,
you could see the password hash
to the right of all those look exactly the same.
That's because they have the same exact password.
Good number of passwords that we have cracked so far.
It says there's 20 passwords left.
We have cracked 492 passwords.
So let's look at John's files that it creates.
If you look on your home directory,
in the hidden directory called .john,
there are three files.
There's the john.log file,
the john.pot file and the john.rac file.
john.pot file is where it stores all of the passwords
that have been cracked.
The john.rec file is where it monitors
exactly where you stopped a password crack.
You see we stopped the password cracking
in the middle of it, so if we start it up again,
it'll pick it up right back where it left off,
because of the john.rec file.
So let's take a look at this john.pot file.
So you can see here, it shows LM hashes, and show the hash,
and then it'll show the password that was cracked.
And we have cracked a lot of passwords so far.
So let's change the format to NT.
So it's the --format=nt.
And so now, instead of cracking LM hashes,
we're gonna crack NT hashes.
And you see really quickly,
just brute forcing the passwords,
it has quickly cracked a good number of passwords.
It's loaded 289 password hashes,
and within seconds cracked many of the passwords.
And this is strictly through brute force.
So it's just guessing many password combinations
and hoping to hit one of those.
You can see that it cracked 96 passwords
within a few seconds.
We just stop the scan so we can show you
what passwords were cracked.
So if we just do john --show
and then the password file,
it'll only show the LM hashes that were cracked.
We have to specifically say format=nt
to show the NT passwords that were cracked.
So now we can see the corrected case.
You see password is actually capital P,
and then the rest of the characters are lowercase.
And we are cracking the second half, which is the NT hash.
Some of the accounts don't have any password at all.
Some of the accounts have really easy passwords.
The username is the same as the password.
So those cracked really quickly.
So let's look at some dictionary attacks.
So John comes with its own dictionary,
and it has a lot of passwords in here.
We're not gonna scroll through all them.
A lot of the passwords have some file language in there,
'cause people end up using a lot of swear words
with their passwords.
So when John the Ripper picks the most common passwords
that people use and it puts it into a password file,
so you'll end up seeing a lot of crazy words in there.
So you can edit the file
if you want to add your own passwords to it,
or you can just create your own password file
and use that as your own word list.
We're just gonna add mypassword to the John list,
just for demonstration purposes.
Let's see how it looks to actually crack it.
So if we're using the --rules,
so it'll mango each password to crack more passwords,
use the word list switch,
and then show the path to the word list that we're using,
and then you put the password file that we're cracking.
Let's do format LM just so you can see
that we're specifically using LM hashes,
and that finished within seconds.
We did the NT and that also finished within seconds.
Within less than a second,
it went through the entire password list
and guessed, did not find anything.
I mean, we already cracked a good number
of the passwords already.
So it doesn't show you which passwords
would've been cracked through this
if it's already has the password in the john.pot file.
So we just added a new password, winter14,
a common password, just to see if this is in the word list.
So within a second, you could see that one account
used winter14 as their password.
And so dictionary cracking is highly recommended as well.
You could see how quick it goes through a dictionary.
So the john.pot file is where it's storing all of these.
So if we remove this john.pot file,
then it has no record of the passwords we've already cracked
and we can run the dictionary again
and see how quickly it finds those passwords.
So you saw within less than a second,
it guessed 71 passwords,
just strictly based off the dictionary that we were using.
And that is John the Ripper.