There are a number of password dumping tools which can be used on
Windows machines to obtain the password hashes.
In this example, we will use PwDump version 7.1.
Using the tool, we will dump out the SYSTEM and SAM registry hives,
which will then give us the NTLM and LAN Manager hashes of
the various accounts within the system.
We will then use the hashes we obtained with John coupled with the word
lists to crack them and obtain the clear text passwords.
I have already uploaded the PwDump tool to the targeted machine. In order to
run the tool, we can perform this from a shell prompt.
I'm going to issue the command Pwdump7.exe, followed by an output
file, which I will call WindowsHashes.txt. What the tool did right
now is it dumped both of the registry hives that we need that we
can now use within John.
Let's copy this to our machine.
I'm going to quickly download the WindowsHashes.txt to my Kali Linux machine.
Now that I have this on my machine,
let's use John to crack those hashes. There are three files which I
would like to bring to your attention within John,
the first being john.pot. Every time John the Ripper cracks a hash,
the results are recorded in the pot file.
This helps John skip these hashes should they reappear again.
The pot file can also be used to customize the cracking process.
It can be used to perform character analysis of already cracked
hashes and prepare custom character sets.
The john.rec file is the default session file for John the Ripper.
When you run John without specifying any session names,
it creates a file called john.rec. This file holds the
command‑line parameters which were passed to John.
It is also used when you want to resume your cracking process at a later stage.
The john.log file holds the cracking process details and the
sequence of characters that John has already tried.
Keep in mind that the file size of this will depend
on how long John has been running.
The files that we have just discussed can be found in the John directory.
Now that we have the hash files from the machine,
let's go ahead and crack this using John. I will issue the command john and I
will define a pot file called winhash.pot. Next, I will define a session name
called winhash‑session, and the reason for this would be in case I would like
to resume this at a later stage.
Next,
I will define the file which contains the hashes. So you will
notice that I have not defined a word list, and the reason for this
is I would like to show you that John would leverage its own
built‑in word list and its own rules, which currently is the WorldList rule set.
Thus far, John has already cracked two password hashes,
which are for the administrator account and for the vagrant account .To
view the status of the current cracking session, I can hit any key, which
will provide me with a status report. Within this report, there are a
number of metrics that's displayed.
Let's take a look at what each one of these metrics stand for.
The first metric represents the number of successful guesses per second.
It will stay at 0 until at least 1 password is cracked.
The next one stands for candidate passwords tested per second. The one
after that stands for crypts or password hashes or cipher computations
per second. Following that is the combinations of candidate passwords
or target hashes per second.
Now let's use one of the word lists which we have downloaded.
Our command remains the same,
with the exception of adding in a specific word list,
and you'll take notice that I've added in one of the
word lists from our seclist repository.
I added in some word mangling rules, which is called WordList.
Let's take a look at the outcome now. By using a better word
list, we were able to increase our chances of success by
cracking some additional passwords.
Let's move onto the next demo where we will look at using John the
Ripper to crack password hashes from Linux machines.