Practice ntds.dit File Part 6: Password Cracking With John the Ripper – Wordlist

After password cracking examples with hashcat, I want to show you how to crack passwords with John the Ripper (remember we also produced hashes for John the Ripper: lm.john.out and nt.john.out).

First we use the rockyou wordlist to crack the LM hashes:

Apr 19, 2017 If john -show=left is run against a file with no hashes cracked yet, john will print statistics but will not print any password hashes. Only if at least one hash has been cracked will john print the remaining hashes from the file like it's supposed to. Tested against john 1.8.0-jumbo-1-5603-g70e8d4c+.
John the Ripper (JTR) is a widely known and verified fast password cracker, available for Windows, DOS, BeOS, and OpenVMS and many flavours of Linux. It uses wordlists/dictionary to crack many different types of hashes including MD5, SHA, etc. John the Ripper: Fast Password Cracker.
Use john to crack password. $ john -show encrypted.hash encrypted.zip:@3ncPa5Sword@:::::encrypted.zip 1 password hash cracked, 0 left rar2john utility will work in the same way for rar archives. Additional notes. There are other interesting utilities in the community-enhanced version which you may like to examine. /apps/john$ ls -1.2john.

Option –wordlist specifies the wordlist to use, and option –pot specifies the pot file I want to create/use.

John The Ripper 0 Password Hashes Cracked 1 Left Hand Twill

Using default input encoding: UTF-8 Loaded 1 password hash (Raw-SHA256 SHA256 128/128 SSE2 4x) Press 'q' or Ctrl-C to abort, almost any other key for status 0g 0:00:00:06 DONE (2017-01-06 12:47) 0g/s 2347Kp/s 2347Kc/s 2347KC/s Session completed show $ john -show mypassword 0 password hashes cracked, 1 left What did I do wrong? Yes I've just discovered what the the mangling rules are. Root@kali:/ctf# rm./root/.john/john.pot root@kali:/ctf# john shadow.bak Warning: detected hash type 'sha512crypt', but the string is also recognized as 'crypt' Use the '-format=crypt' option to force loading these as that type instead Using default input encoding: UTF-8 Loaded 4 password hashes with 4 different salts (sha512crypt.

Output:

And then we use option –show to display the (partially) recovered passwords:

Output:

Cracking NTLM hashes is done with a similar command, it’s just the name of the files that changes:

Output:

And then we use option –show to display the recovered passwords:

John The Ripper 0 Password Hashes Cracked 1 Left Hand Free

Output:

John The Ripper 0 Password Hashes Cracked 1 Left Hand Piano

Hash type	Username (if used as salt)	Hash encoding (often includes salt)	Plaintext	Support in JtR	“Format” name	Default on	Also supported on
DES crypt	rEK1ecacw.7.c	password	yes	des	ancient Unix-like, recent Solaris	all Unix-like, PHP 5.3.0+
BSDI crypt	_J9.K0AyUubDrfOgO4s	password	yes	bsdi	BSDI BSD/OS	all *BSD, some Linux, PHP 5.3.0+
bigcrypt	qiyh4XPJGsOZ2MEAyLkfWqeQ	passphrase	yes (split)	des	?	HP-UX, OSF/1, Digital Unix, Tru64
crypt16	qi8H8R7OM4xMUNMPuRAZxlY.	passphrase	1.7.6+ if supported by the underlying OS (have to add -DHAVE_CRYPT)	crypt	?	Ultrix
MD5 crypt	$1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/	password	yes	md5	FreeBSD, NetBSD, many Linux, Cisco IOS	OpenBSD, almost all Linux, PHP 5.3.0+
SHA-256 crypt	$5$MnfsQ4iN$ZMTppKN16y/tIsUYs/obHlhdP.Os80yXhTurpBMUbA5 $5$rounds=5000$usesomesillystri$KqJWpanXZHKq2BOB43TSaYhEWsQ1Lr5QNyPCDH/Tp.6	password rasmuslerdorf	1.7.6+ if supported by the underlying OS	crypt	recent Ubuntu, recent Fedora	glibc 2.7+, PHP 5.3.2+, some Solaris 10+
SHA-512 crypt	$6$zWwwXKNj$gLAOoZCjcr8p/.VgV/FkGC3NX7BsXys3KHYePfuIGMNjY83dVxugPYlxVg/evpcVEJLT/rSwZcDMlVVf/bhf.1 $6$rounds=5000$usesomesillystri$D4IrlXatmP7rx3P3InaxBeoomnAihCKRVQP22JZ6EY47Wc6BkroIuUUBOov1i.S5KPgErtP/EN5mcO.ChWQW21	password rasmuslerdorf	1.7.6+ if supported by the underlying OS	crypt	recent Ubuntu, recent Fedora	glibc 2.7+, PHP 5.3.2+, some Solaris 10+
bcrypt	$2a$05$bvIG6Nmid91Mu9RcmmWZfO5HJIMCT8riNW0hEp8f6/FuA2/mHZFpe	password	yes	bf	OpenBSD	recent *BSD, some Linux, Solaris 10+, PHP 5.3.0+
LM (LanMan)	855c3697d9979e78ac404c4ba2c66533	passphrase	yes (split)	lm	Windows NT, 2000, XP; Mac OS X 10.3	Windows Vista, 7; Samba
NTLM	$NT$7f8fe03093cc84b267b109625f6bbf4b	passphrase	Pro or jumbo patch	nt	Windows NT, 2000, XP, Vista, 7; Samba	?
Mac OS X salted SHA-1	0E6A48F765D0FFFFF6247FA80D748E615F91DD0C7431E4D9	macintosh	Pro or jumbo patch	xsha	Mac OS X 10.4+	?
Netscreen	admin	admin$nKv3LvrdAVtOcE5EcsGIpYBtniNbUn	netscreen	Jumbo patch needed	md5ns	All	N/A
Oracle	USER ALFREDO	000EA4D72A142E29 EB026A76F0650F7B	#95LWEIGHTS CIAO2010	Jumbo patch needed	oracle	Oracle 10	Oracle 11g
SAP	DDIC	(Username<space-padding-to-40>$HASHCODE) See File SAP-pw-test-for-user-DDIC.zip	DDIC	Jumbo patch needed	sapb	?	?
SAP	TEST_0001	Download adobe lightroom cc. (Username<space-padding-to-40>$HASHCODE) See File SAP-pw-test-file-for-TEST_0001.zip	NewPassword12$$	Jumbo patch needed	sapg	?	?
Cisco Pix	rharris	zyIIMSYjiPm0L7a6	phonehome	Jumbo patch needed	pix-md5	All	N/A