Everybody and welcome to the next video we're gonna be going over.
Password cracking with John the Ripper.
Now this is not a full in-depth course of every option that John the Ripper has but I kind of want to
show you how to attack a basic Windows hashes and Linux hashes with a dictionary.
Now to do this for the windows hash.
We've gone ahead and grab them.
Now you can grab this with hash dump interpreter Mimi Katz whatever you want to do as long as it is
in this particular format such as the username the I.D. the anti the empty hash and the antelope or
the l am hash is all there and the three at the end.
So as long as it's in this format you should be fine.
So we have administrator guest guest account help assistance support test and user.
So what we want to do with this is load up John.
Now John has quite a bit of options so I will leave those two guys to actually go through each one.
But to run this you would do dash dashboard list and then you want to grab put a space here so they
can tab complete.
There's a there's a word list and user share.
John and password list.
So go ahead and remove that space.
So there's a lot of word list you can use the user wordless rock you to gain a little bit better of
a word list but I'm showing you a basic example.
The bigger the word list the longer it takes but the better off the better odds of finding a password.
Now the next thing is is it's going to take the hashes.
So in this case the windows hashes.
Now if John the Ripper is complaining that it can't identify the hash you can do dash dash format as
long as you know what is in this case then you can label it that way.
It's entirely up to you as long as you're in the correct format.
And John can identify them it'll go ahead and just pick the best option.
So go ahead and run this we can see here boom looks like we grabbed a password as the guest account
password and the administrator did not have a password in this particular case.
So it's been set to nothing which is exactly what we'd expect.
So it was very very quick but that's because the passwords are very simple on a wordless the board password
is going to show up pretty frequently near the top of the list.
But this gives you an example of how to actually crack the passwords with John now for Linux is a slightly
different conversation.
So what you actually need to do is get the ATC past WD file in the ATC shadow file.
Now if you're a Linux machine you're attacking does not have a shadow file you just need the Pat ATC
pass WD file.
Just make sure that if there's if we do Cat ATC past WD and you see Xs here it's using a shadow file
otherwise you'll see the full hash here such as when we do EDC cat you see shadow you can see we actually
have our hashes here so you would see this in place of the X..
Oh we need to do it.
We need a credit copy so if we can't see past you D.
Well despite the past.
So we're just running this locally here and then Cat ATC shadow into shadow.
Now with both of these we have the copy of ATC password and shadow.
Now what we need to use is we need to use something called um shadow which will bind them two together
and create a single file.
So if you um shadow it takes the password list first followed by the shadow file.
Now we're gonna dump that to Linux dot hash.
Perfect.
So if a cat Linux not hash you can see we have everything.
And if there's no parser there's no password.
If there is it went ahead and set it perfect that's exactly what we want.
Now John can be used exactly the same way with the Linux hashes.
So if we go back up to our word list here we just replace this with Linux nice and simple so we can
see here the password for admin is password password for guest is password.
Now the reason these are lowercase and it took a little bit longer and the windows was uppercase is
because windows in earlier systems don't care if the user name is past is upward or the password is
uppercase or lowercase.
It does not care.
So if you had a password and you put an uppercase in the middle of it it doesn't matter the password
is still can be rehashed.
It can be cracked even whether it's uppercase or lowercase it doesn't matter so that's why it should
have his password and the knees are actually lowercase which is what the true password is because Linux
actually cares about the password.
Now take a moment to link to a few.
John the Ripper tutorials above as well to work to show you kind of forcing in different variations
for wordless.
But this is just kind of give you a brief introduction of how to use John in case you do grab Windows
or Linux Ashley's.