Within Metasploit, you have the ability to use John the
Ripper. John is found within the auxiliary modules of
Metasploit. To access the module,
you can issue the command use auxiliary/analyze/crack_, and
right here, I'm going to hit the Tab button.
Now this will display the various options that we have to leverage John
within Metasploit. So let's take a look at the Linux one,
for example.
And if I take a look at the options that's available,
you can see that I have a number of options that I can define within
Metasploit, which will then use John to crack the hashes when I perform
a hash dump within Metasploit. Let's take a look now at the auxiliary
module that's available for Windows.
We can view this by issuing the command use
auxiliary/analyze/crack_windows. If you go into options, we can see that
we've got quite a bit of options that we can configure here as well.
So I've already dumped the hashes of a Windows machine,
and this is available in my current database.
Now I'm going to use John within Metasploit to perform
a password crack on those hashes.
Since I've already defined my custom word list,
I'm going to go ahead and issue the run command. While this is running,
it's running through the list of hashes that's available in my
database, coupling these with my word list,
and it will ultimately give me the cracked hashes and the clear
text passwords of those hashes. Now that some time has elapsed,
I'm going to kill the process of John.
Let's take a look at the creds database,
and immediately I can see that some of the password hashes have been cracked,
and I'm able to view them in clear text. So here we have looked
at how we can leverage John within Metasploit.