This post assumes you have access to a the target filesystem in question and want to extract and then crack the password hashes from the local machine.
In this example I am going to crack the account passwords used in Metasploitable 2 but the techniques here can be used in many different scenarios.
Allows you to override the hash type detection. As of John the Ripper version 1.8.0, valid 'format names' are descrypt, bsdicrypt, md5crypt, bcrypt, LM, AFS, tripcode, dummy, and crypt (and many more are added in jumbo). You can use this option when you're starting a cracking session or along with one of: '-test', '-show', '-make-charset. John the Ripper is capable of cracking many password hashes (both salted and non-) including SHA1. In this mode John the ripper uses a wordlist that can also be called a Dictionary and it compares the hashes of the words present in the Dictionary with the password hash. Example In this case we have a custom wordlist, and a hash that we need to compare.
John the Ripper is included by default with Kali 2 – which is what I am using here.
To be able to crack the accounts we need two files from the target system:
- /etc/passwd -> Containing the user information
- /etc/shadow -> Containing the corresponding password hashes for the users
(Again there are various ways you could grab these files – for a vey simple example using Metaspolitable 2 as the target see this post here: https://securityaspirations.com/2017/07/03/metasploitable-2-compromise-nfs-shares/)
Once you have the two files we can begin cracking them with John the Ripper.
However before we give the hashes to John, we need to combine the two files into one so that the user and the password hashes are merged. We can do this with a utility called ‘Unshadow’ (also included in Kali2 by default).
The command required is:
unshadow Path_to_passwd Path_to_shadow > output.txt
Now we have the combined merged.txt file:
Now lets put john to work. We could supply a password list for John to use but it comes with a default set of passwords so we may as well try those first.
To start the crack, point John at our newly created file:
Within a couple of seconds we appear to have a hit on most of the accounts:
It’s not always this quick and of course we are still missing the ‘root’ account but you get the idea. I let the crack run for another hour before cancelling but the root account had still not being cracked. The password may be hidden in the John password list I would just need to let the cracking process run to completion to find out. If that failed it might be worth trying some bigger password lists (such as the ‘rockyou’ list).
One way or another, once complete, you can view each of the accounts and their corresponding passwords by running the following command and referencing the original file you gave John to crack:
john show <file.txt>
If you want to confirm they work, test them out on the Metasploitable box:
John The Ripper Crack Hash
Hashes.com is a hash lookup service. This allows you to input an MD5, SHA-1, Vbulletin, Invision Power Board, MyBB, Bcrypt, Wordpress, SHA-256, SHA-512, MYSQL5 etc hash and search for its corresponding plaintext ('found') in our database of already-cracked hashes.
It's like having your own massive hash-cracking cluster - but with immediate results!
We have been building our hash database since August 2007.
We are not cracking your hash in realtime - we're just caching the hard work of many cracking enthusiasts over the years.
The MD5 message-digest algorithm is a widely used hash function producing a 128-bit hash value. Although MD5 was initially designed to be used as a cryptographic hash function, it has been found to suffer from extensive vulnerabilities. It can still be used as a checksum to verify data integrity, but only against unintentional corruption. It remains suitable for other non-cryptographic purposes, for example for determining the partition for a particular key in a partitioned database. The weaknesses of MD5 have been exploited in the field, most infamously by the Flame malware in 2012. The CMU Software Engineering Institute considers MD5 essentially cryptographically broken and unsuitable for further use. MD5 Decrypt.
In cryptography, SHA-1 (Secure Hash Algorithm 1) is a cryptographic hash function which takes an input and produces a 160-bit (20-byte) hash value known as a message digest – typically rendered as a hexadecimal number, 40 digits long. It was designed by the United States National Security Agency, and is a U.S. Federal Information Processing Standard. Since 2005 SHA-1 has not been considered secure against well-funded opponents, and since 2010 many organizations have recommended its replacement by SHA-2 or SHA-3. Microsoft, Google, Apple and Mozilla have all announced that their respective browsers will stop accepting SHA-1 SSL certificates by 2017. SHA1 Decrypt.
John Crack Sha1 Hash
The MySQL5 hashing algorithm implements a double binary SHA-1 hashing algorithm on a users password. MySQL Decrypt.
NT (New Technology) LAN Manager (NTLM) is a suite of Microsoft security protocols that provides authentication, integrity, and confidentiality to users. NTLM is the successor to the authentication protocol in Microsoft LAN Manager (LANMAN), an older Microsoft product. The NTLM protocol suite is implemented in a Security Support Provider, which combines the LAN Manager authentication protocol, NTLMv1, NTLMv2 and NTLM2 Session protocols in a single package. Whether these protocols are used or can be used on a system is governed by Group Policy settings, for which different versions of Windows have different default settings. NTLM passwords are considered weak because they can be brute-forced very easily with modern hardware. NTLM Decrypt.
SHA-2 (Secure Hash Algorithm 2) is a set of cryptographic hash functions designed by the United States National Security Agency (NSA). They are built using the Merkle–Damgård structure, from a one-way compression function itself built using the Davies–Meyer structure from a (classified) specialized block cipher. SHA-2 includes significant changes from its predecessor, SHA-1. The SHA-2 family consists of six hash functions with digests (hash values) that are 224, 256, 384 or 512 bits: SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256. SHA256 Decrypt.