Hey there. I'm Rishalin, and welcome to this Red Team Tools
course by Pluralsight, and today, I will be showing you how to
access credentials using John the Ripper.
Let's consider a scenario. You have been contracted to
perform a red team assessment by your client.
One of the items that the client has asked you to perform
is the auditing of the strength of passwords which have
been used in the environment.
In order to do this,
you would need to correct the password hashes that you come
across while performing your penetration test.
Over and above this task,
you would need to correct password hashes that you discover
to further you reaching the environment.
One of the tools which you can use to accomplish the tasks is John the Ripper.
Let's spend a few moments discussing John the Ripper.
It is one of the most simplest tools to use,
which offer a high level of customization.
John the Ripper, or JTR, as it's commonly abbreviated,
was developed by Alexander Peslyak, who is also known as Solar Designer.
He's the founder of Openwall who maintains the releases of John the Ripper.
Thanks Alexander for creating this awesome tool. John the
Ripper is an open source passive cracker,
which was designed to be both feature rich and fast.
It combines several cracking modes in one program,
and it's fully configurable for your needs.
For example,
you can define a custom cracking mode using the built‑in
compiler supporting a subset of C. John the Ripper is
available for several different platforms,
which enables you to use the same cracker everywhere.
This gives you the ability to continue a cracking session,
which is started on another platform on a completely different
platform. Time to replace an open source tool. It is available on
GitHub or via the Openwall website.
Since this is open source, you have the ability to download the
source code and customize it to your liking,
it is easy to install and use.
It has a wide range of supported hashes of which it is able to crack.
Some of them are commonly used today, such as SHA,
MD5, SSH private keys, and of course,
the most common, NTLM version 1 and 2, and Kerberos protocols. Of course,
there is a lot more that John the Ripper can crack. So when we consider the
Red team kill chain, John the Ripper comes into play directly after the
exploitation phase and moves you along the kill chain past the escalation
phase into what's the lateral movement phase. Let's map the techniques that
you will learn in this course to the Mitre Att&ck framework. The main
category that we'll be considering is credential access. Within credential
access, the first technique that we'll look at is credential dumping.
Within this technique,
we will use an additional tool to obtain parts of the hashes of a system
which will then be used in the brute force technique.
In the brute force technique,
we will attempt to brute force the hashes using the
capabilities of John the Ripper.
As a bonus, we will consider the exploitation for credential access technique.
In this technique,
we will look at a metasploit session and how we can leverage
John the Ripper within that session to crack the password
hashes. To follow along in the demos, you would need a version of Kali Linux.
I am currently using version 2020.1b, but you can use any version that you like.
Also,
I recommend that you have an up to date operating system. For
that, just open the terminal window and run the following
commands, apt‑get update and apt‑get upgrade.
This will install any updates and upgrades in your operating system.
John the Ripper has a number of cracking modes which can be used.
Let's take a look at a few of them.
We will begin with single mode.
This mode leverages a number of fields, such as login names,
full names, and the user's home directory to generate candid passwords.
It gives you the ability to use a large set of mangling rules,
which can be applied.
This is by far a much faster than wordlist mode.
Wordlist mode is the simplest cracking mode supported by John the Ripper.
In essence,
all you need to do in this mode is specify a wordlist and some password files.
Of course, you can enable word mangling rules,
which can be used to modify or mangle words producing other likely passwords.
Incremental mode is one of the most powerful cracking
modes you could use in John the Ripper.
This mode enables you to try every single possible
character combination as a password.
Keep in mind that due to the massive character combinations that's available,
this mode might never actually terminate. External mode gives you
the ability to define an external cracking mode,
which can be used with John the Ripper.
These functions are called in the subset of C and are compiled by John,
it's startup, when you request a particular mode to be used.
Mask mode is a fast way to produce password candidates given a
specific mask. A mask consists of static letters,
ranges, or a syntax.
You could even combine both of them together.