Hello, everyone. And this video, we're going to be taking a look at
password cracking with John the Ripper more
specifically. We'll be taking a look at cracking. Ntlm hashes.
Now in the previous videos within this module, or
this section. We were able to dump
all the relevant hashes from our Windows 7
virtual machine and our Windows 10 virtual machine,
and we saved them into their relevant files here. So we
have hashes Windows, 7 Dot, txt and Ashes Windows 10.
EXT, now John the Ripper is a relatively simple tool to
use when it comes down to cracking various hashes.
And of course, when we talking about Windows hashes, and
those are relevant to Windows 7 and later. These
will typically use the ntlm hashes. Now, if
I just kept the contents of one of
these hashes here, one of these files containing the ashes and
ntlm, hash essentially consists of an
LM hash and an empty hash right now,
the LM hash as mentioned was used in
Is versions of Windows and was deprecated and the
ntlm hash is sort
of kept for compatibility reasons. And again, cracking
it with John, the Ripper. As I said, is very, very simple. You
just need to know the type of hash that you're trying to crack. That
being said, when cracking passwords or
hashes with John the Ripper, you need to use a word list.
Right now, word list can be can
be created manually based on what you are
able to do to actually
addicted or whether or not you're able to predict what characters
or what range of characters will
be will be used in or Watering your
password of characters were used in creating those
particular password. So for example, if
you're familiar with the company's password policy and it says
the password should be longer than eight characters and
they should be alphanumeric and include numbers and symbols, then
you can generate word lists with those parameters in
place. And you can use those word list with crack in for
the pros.
Of cracking. Now, when we talk about the
word, the default word list that comes that comes prepackaged
with John. The Ripper that is
under the user, share user,
share John directory and
we can then grab that and say we are looking for passwords. And
if I just grab that, sorry, this is the password dot list
file, which is right over here. So this is the default Wireless that
comes with John the Ripper. Now, of course, we can utilize the
rocky word list that comes.
It's prepackaged with with Kali
Linux. So that is under user share word lists. And
if we list that here, you can see we have the rock U dot txt
.g zip. So this is a compressed file and
we can actually go ahead and decompress this. So I'm going to say pseudo
gzip and decompress and going to say use them,
share word lists and
rock. You dot txt, .gz gzip
and hit enter, and of course, that's going to require a
root privileges. So I'll just provide my password. And there
we are, the followers.
Looks like it has been extracted. So if I list the contents of the wordless
directory, again, you can see we have rho q dot txt. So
we're going to be using the rocky .txt Wireless
primarily because it's extremely comprehensive. So,
again using John is very, very simple. And again, it
will require root privileges. So, if you're currently using the root user, then
you don't need to use the sudo command. So, we'll
start off with the Windows 7 hashes. So, if I just cut
the contents of window of the Windows 7 hashes
here, so when the seven dot txt, you
See that we have various accounts here that
we would like to add that. We would like to actually
crack in regards to the password. So the most important
accounts are going to be the administrator account and of course any other
user account. Now in this particular
case, since we are using a Windows 7 VM, the
guest and ie user accounts do not have
valid passwords will actually the IE user
account does have a valid password. Of course, I added the
user, Mike right over here. So when cracking
With John the Ripper. There is not a 100% success
rate. And of course, it will depend on the word list that
you actually create. So you can create custom Willis but that
is going to take a lot of computational power. And again,
based on the complexity of the password. It
can take anywhere from a few hours to days or weeks or
even months, right? So that's something that you want to take into consideration. So
let's start off with, by cracking the Windows 7 hashes.
So we will invoke the John command. So
we say,
John and we specify the format of
the hashes. So the format are going to be of NT or NT hash,
right? And then we specify the word list which is done
by specifying the word list as follows. So word list and
then we specify the directory to the word list. So user share word
list and we then
say rock you dot txt. Right
and we hit enter. But before we do that, we
need to specify the file containing the hashes that
we want to crack. In this case. It's going to be
Crashes, Windows, 7 Dot txt and we
hit enter and you can see the cracking process has
begun and it actually completed quite quickly.
So for
the guest account, you can see it actually loads all
the for password hashes with no different salts.
So, again, it gives us the format. So that's India, standard en
T hash. And then, of course, there is no open
MP support for this hash type and it uses a
fork. So, in terms of the crack,
Cooking process, you can see for the guest account it. That's
pretty much a blank password, which I actually
told you about before for the administrator account as
we were able to do with, with the windows, credential that
deter, the password is password as it is. And
then, of course, for the user Alexis, you can see the password is
test password. So we weren't able to crack the
other user user password, which was the
count, Mike which again we might need
to crack manually and of course that will
Why a building our own word list. So again,
that's how simple it is to crack. Aunty Aunty LM hashes
or NT hashes for that matter. Now, let's
move on to the Windows 10 hashes. So
I will just use the same command and we'll substitute the
Windows 7 hash file and with
the Windows 10 ash fall and hit enter and
you can see for the Windows 10 VM.
We can see that we
were able to crack the the passwords
for
Two users. One of them being the user
Martin and the other being the user. Dragon,
one, two, three. Now, if I cut the contents of hashes
Windows, 10, dot txt. This is a VM that
I set up the administrator account. I believe, I
did not set any particular password. I could be wrong. However,
we were able to crack Martin and the other user via
the other user account, which was Windows
10. So, given that we were able to crack the passage, we can then
use these passwords to, again, open up,
put put
Joe or other potential access vectors like
services like SSH or FTP, we
can use these user accounts and the apostles because as
I mentioned user accounts and the relevant passwords are
usually reused by users, so they don't have to remember these
passwords though. They don't have to remember more than one password.
So you can see that in this
case we have, we were able to get Martin in Windows 10
and in terms of the passwords for the
Windows 10 ashes, and then for the Windows 7 patches, we were
able to get there.
Administrator password and of course, the
deposit for the user Alexis. So again, this
information is extremely useful because now we have direct
access to the Target. We know about the passwords and
we can, then we can now Taylor our in our tax even
more as we move along in into the target Network,
that that being said, that's going to be it for this
module. And I'll be seeing you in the next module.