Practice ntds.dit File Part 6: Password Cracking With John the Ripper – Wordlist
After password cracking examples with hashcat, I want to show you how to crack passwords with John the Ripper (remember we also produced hashes for John the Ripper: lm.john.out and nt.john.out).
Hello FriendsIn this video I will talk about How to Crack Encrypted Hash Password - Using John The Ripper.-. John the Ripper password cracker. Free & Open Source for any platform; in the cloud; Pro for Linux; Pro for macOS. Wordlists for password cracking; passwdqc policy enforcement. Hello 1 password hash cracked, 0 left My pot file has 1340887 untagged hash lines out of 5132667 total.
First we use the rockyou wordlist to crack the LM hashes:
Option –wordlist specifies the wordlist to use, and option –pot specifies the pot file I want to create/use.
Output:
And then we use option –show to display the (partially) recovered passwords:
Output:
Cracking NTLM hashes is done with a similar command, it’s just the name of the files that changes:
Output:
And then we use option –show to display the recovered passwords:
Output:
John the Ripper is a favourite password cracking tool of many pentesters. There is plenty of documentation about its command line options.
I’ve encountered the following problems using John the Ripper. These are not problems with the tool itself, but inherent problems with pentesting and password cracking in general.
- Sometimes I stumble across hashes on a pentest, but don’t recognise the format, don’t know if it’s supported by john, or whether there are multiple “–format” options I should try.
- The hashes you collect on a pentest sometimes need munging into a different format… but what’s the format john is expecting?
- John will occasionally recognise your hashes as the wrong type (e.g. “Raw MD5″ as “LM DES”). This is inevitable because some hashes look identical.
- Sometimes I gain access to a system, but can’t recall how to recover the password hashes for that particular application / OS.
These problems can all be sorted with a bit of googling or grepping through the john source code. I thought it might be helpful to compile a cheat sheet to reduce the amount of time I spend grepping and googling.
In the first release of this page I’ve:
- Copied example hashes out of the source code for most supported hash types.
- Provided examples of what your hashes.txt file might look like (though I’m sure other variations are supported that aren’t covered here yet).
- For each example hash I’ve stated whether it will be automatically recognised by john, or whether you’ll have to use the “–format” option (in which case I’ve included which –format option you need)
I haven’t yet done the following:
- Added reminders on how hashes can be collected.
- Added information on how to munge the hashes into a format supported by john.
This sheet was originally based on john-1.7.8-jumbo-5. Changes in supported hashes or hash formats since then may not be reflected on this page.
afs – Kerberos AFS DES
Supported Hash Formats
bfegg – Eggdrop
Supported Hash Formats
bf – OpenBSD Blowfish
Supported Hash Formats
bsdi – BSDI DES
Supported Hash Formats
crypt – generic crypt(3)
Supported Hash Formats
des – Traditional DES
Supported Hash Formats
dmd5 – DIGEST-MD5
Supported Hash Formats
TODO: No working example yet.
dominosec – More Secure Internet Password
Supported Hash Formats
<none> – EPiServer SID Hashes
Supported Hash Formats
hdaa – HTTP Digest access authentication
Supported Hash Formats
hmac-md5 – HMAC MD5
Supported Hash Formats
hmailserver – hmailserver
Supported Hash Formats
ipb2 – IPB2 MD5
Supported Hash Formats
krb4 – Kerberos v4 TGT
Supported Hash Formats
krb5 – Kerberos v5 TGT
Supported Hash Formats
lm – LM DES
Supported Hash Formats
lotus5 – Lotus5
Supported Hash Formats
md4-gen – Generic salted MD4
Supported Hash Formats
md5 – FreeBSD MD5
Supported Hash Formats
md5-gen – Generic MD5
Supported Hash Formats
TODO: No working example yet.
mediawiki – MediaWiki MD5s
Supported Hash Formats
mscash – M$ Cache Hash
Supported Hash Formats
mscash2 – M$ Cache Hash 2 (DCC2)
Supported Hash Formats
mschapv2 – MSCHAPv2 C/R MD4 DES
Supported Hash Formats
mskrb5 – MS Kerberos 5 AS-REQ Pre-Auth
Supported Hash Formats
mssql05 – MS-SQL05
Supported Hash Formats
mssql – MS-SQL
Supported Hash Formats
mysql-fast – MYSQL_fast
Supported Hash Formats
mysql – MYSQL
Supported Hash Formats
mysql-sha1 – MySQL 4.1 double-SHA-1
Supported Hash Formats
netlm – LM C/R DES
Supported Hash Formats
netlmv2 – LMv2 C/R MD4 HMAC-MD5
Supported Hash Formats
netntlm – NTLMv1 C/R MD4 DES [ESS MD5]
Supported Hash Formats
netntlmv2 – NTLMv2 C/R MD4 HMAC-MD5
Supported Hash Formats
nethalflm – HalfLM C/R DES
Supported Hash Formats
md5ns – Netscreen MD5
Supported Hash Formats
nsldap – Netscape LDAP SHA
Supported Hash Formats
ssha – Netscape LDAP SSHA
Supported Hash Formats
nt – NT MD4
Supported Hash Formats
openssha – OpenLDAP SSHA
Supported Hash Formats
oracle11 – Oracle 11g
Supported Hash Formats
oracle – Oracle
Supported Hash Formats
pdf – pdf
Supported Hash Formats
phpass-md5 – PHPass MD5
Supported Hash Formats
phps – PHPS MD5
Supported Hash Formats
pix-md5 – PIX MD5
Supported Hash Formats
po – Post.Office MD5
Supported Hash Formats
rar – rar
Supported Hash Formats
raw-md4 – Raw MD4
Supported Hash Formats
raw-md5 – Raw MD5
Supported Hash Formats
raw-md5-unicode – Raw MD5 of Unicode plaintext
Supported Hash Formats
raw-sha1 – Raw SHA-1
Supported Hash Formats
raw-sha224 – Raw SHA-224
Supported Hash Formats
raw-sha256 – Raw SHA-256
Supported Hash Formats
raw-sha384 – Raw SHA-384
Supported Hash Formats
raw-sha512 – Raw SHA-512
Supported Hash Formats
salted-sha – Salted SHA
Supported Hash Formats
sapb – SAP BCODE
Supported Hash Formats
sapg – SAP CODVN G (PASSCODE)
Supported Hash Formats
sha1-gen – Generic salted SHA-1
Supported Hash Formats
skey – S/Key
Supported Hash Formats
John The Ripper Nt Hash
TODO: No working example yet.
TODO: No working example yet.
TODO: No working example yet.
TODO: No working example yet.
ssh – ssh
Supported Hash Formats
sybasease – sybasease
Supported Hash Formats
xsha – Mac OS X 10.4+ salted SHA-1
Supported Hash Formats
zip – zip
Supported Hash Formats
John The Ripper Crack Hashes
Tags: johntheripper, pentest
Posted in Cheat Sheets