John the Ripper is one of the most loved and versatile hash password-cracking tools out their. It combines speed, ease of use and reliability. But first of what is a hash?
What is a hash?
Hashing is taking a data of any length and turning it into a fixed length string that masks it's original value of the data. Their are hundreds of different hashing algorithms and some of the more common ones are MD5, SHA1, SHA3-512, NTLM, CRC32, etc.
How do you attack hashes?
Their are two over-arching ways of cracking hashes. One of the methods is a rainbow table. Essentially, you have a precomputed table full of hashes that point to the password. This is what most websites like hashes.com use to crack your has. Although it is incredibly fast, it can take a large amount of storage space and can only use "precomputed" hashes. In addition, developers of hashing algorithms have added something called "salt" that changes the hash output. I will not be covering rainbow tables on this blog post.
Then their is the other way. Hashes are designed in a way to make cracking them near impossible. But it is possible to hash a word and see if it matches. This is the method I am going to be using. Although it is not as quick as a rainbow table, it is funner and will be able to crack nearly all hashes.
John the Ripper
Installation of John the Ripper
You can install John the ripper on your respective systems by using this link.
To use john use the syntax bellow:
john hash.txt
./john.exe hash.txt
The Modes of John the Ripper
Single Crack Mode
This mode makes use of the information already available inside the username. The format for text file is:
username:hash
Some examples of how this would work would be with the word Anonymous:
Anonymous
an0nym0us
AnOnYmOuS
Anonymous1
Syntax: This mode is the default mode the JtR starts with but you can specify it with:
john --single hash.txt
Wordlist Crack Mode
In this mode it computes the hashes of a word list and then compares it to the one given. In JtR you can use any specified word list but it does choose a default one if none is specified. For this post i am going to be using the infamous rockyou wordlist.
Example Usage:
john --wordlist=/usr/share/wordlists/rockyou.txt --format=raw-md5 crack.txt
Incremental Crack Mode
Incremental mode is the most powerful cracking mode. It tries every single possible combination of characters until it completes. This means it will not stop.
Example usage:
john --incremental hash.txt
You can specify the option for the incremental mode by:
john --incremental=digits incremental.txt
john --incremental=Alpha incremental.txt
You can see all the options in the john.conf in /etc/john/john.conf
.
Identifying hashes
John's auto hash detection can be a bit unreliable. Here, is a good script for identifying hashes in python.
john --format=[format] [path to file]
--format= - Input the format of the hash
Example Usage:
john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt hash_to_crack.txt
Notes:
If you are unsure about telling John which hash type to crack, use john --list=formats. If you are search for a specific type of hash use john --list=formats | grep -iF "md5", if you are on Linux.
Cracking Multiple files
To crack multiple files that have the same encryption just add them both to the end. The syntax for multiple md5 hashes is as so: john [file 1][file 2]
john -form=raw-md5 crack.txt md5.txt
Cracking other files
Sometimes the hash is not easy to extract from a file. That is when Jumbo John comes in handy. It has a bunch of different tools for extracting hashes out of other formats. I will cover a few here.
Zip2John
We are going to use zip2john to output a hash in a text file. This can then be attacked like a normal hash.
zip2john [options] [zip file] > [output file]
Example Usage:
zip2john zipfile.zip > zip_hash.txt
Rar2John
Almost identical to the zip2john tool, we can output a RAR file to a hash text file. John will be able to understand this.
rar2john [rar file] > [output file]
Example Usage:
rar2john rarfile.rar > rar_hash.txt
SSH2John
You know, I wonder if their is a pattern to this? You can find your pub id_rsa private key in linux at ~/. ssh/id_rsa
ssh2john [id_rsa private key file] > [output file]
Example Usage:
ssh2john id_rsa > id_rsa_hash.txt
Practise
If you want to practice some hash cracking, here are some hashes.
Sources
https://tryhackme.com/room/johntheripper0
https://www.hackingarticles.in/beginner-guide-john-the-ripper-part-1/
https://www.varonis.com/blog/john-the-ripper
Documentation
https://www.openwall.com/john/doc/
https://github.com/openwall/john
