John the Ripper Introduction

00:00

Hello. My name is Dustin, and welcome to password cracking John the Ripper. Not to be confused with Jack is a free and open source password cracker.

00:10

It can do both dictionary based attacks, brute forcing and also a combination of the two. It was initially developed for the UNIX operating system and was originally designed to detect week UNIX passwords. It now runs on many operating systems, including a version for Android. Even

00:27

it's typically shared via the source code, but it does offer a more friendly pro version. The Windows version of it even offers a gooey, since it is typically a command line interface tool.

00:43

As with most security tools we've talked about, they do come preinstalled on most versions of Cali, Lennox and John The Ripper is no different. So if you're working with the Cali Lennox machine or a Cali Lennox PM, there isn't anything you need to do. Just run the commands.

00:59

Installing it on other versions of Lennox, including, like unto, can be pretty easy as well. They offer the free version, which you must compile yourself, or a paid version that comes with customer support and installation, walk throughs and support to do that

01:17

of the basic steps to install it on a new bun to Orlen experience are just download. The latest version

01:25

confirmed the signature. This is something you really always want to do. When you're looking for security tools or hacking tools anything like that, you want to make sure you're getting exactly what you think you are. And if you remember from our other module, we talked about getting the hash for that file and comparing the hashes.

01:44

So once you know that the hash is matching, it is the John the Ripper version that you were looking for. You un compressed the file and compiled the sources.

01:53

After that, you install it via the normal Install command. So Damian versions of Lennox. It's just act, get install. Or, if you're using other versions, you can use a Yum install and then John

02:07

for Windows. It's really easy. There is, ah, regular John the Ripper command line tool, and you just download that and extract it and run it from the command line. And they do have the gooey version, um, half sweet, which will actually get into in the next part,

02:27

and that one you just download of installer extract the file and then just run it like you would any other Windows installer

02:38

in this lab. We're going to be using John the Ripper in order to crack our windows passwords.

02:44

And we've got those hash is that we dumped from our Windows machine and we're gonna load them and use our custom dictionary in order to crack the passwords. Then we're going to hop into our linen virtual machine

02:57

and do the same thing. We're gonna create a couple of new users

03:00

and trained crack those passwords as well.

03:07

So let's go ahead and hop into our Windows machine.

03:15

There we go.

03:16

And so if you notice I've already downloaded John the Ripper and I extracted the file. So in order to run it, you do need to run it from the folder location at Sand. And that's where we're gonna put all of our files as well. It makes it a lot easier when everything's in the same location.

03:34

So open your John, um, folder, and then we're going to open

03:38

the run folder

03:39

and this is where rules we're gonna have a couple of our files.

03:44

So the file are the after that we're gonna crack our windows, not text. And we open that up.

03:51

You can see this. Just kind of your standard, um, password Dump output.

03:57

And so it's got your years. The name and then a couple hash is as well, and we're actually gonna be using our custom word lists because we did a lot of re come and we learned what the users in this area like. And so we think will be a little faster to use a custom word list. And so let's show you that really quick. There is custom wordless.

04:16

So this is the real quick word list. We don't want this to take

04:18

forever, but this is just as you can see, just a list of words. And John, they're cool will go through these and see if it can match any of the hashes.

04:29

So let's go and get started. If you hold a shift and right click in the folder, let's get in here.

04:39

You can see the open command window here, and that will open. The command would know in this exact directory, which is where we want to be, so we don't have to see the or change directory all the way in here.

04:49

As you can see, we are right here. So in order to run, John the Ripper is pretty easy. The command for General Motors istan.

05:00

And we're gonna do gas stash. Although most of the options are all dash dash, um, format, because we know these are anti hashes because they're from the Windows machine,

05:12

and then we will do dash cash

05:14

word list.

05:15

We want to use our own custom. Wordless John the Ripper does have its own built in wordless. But we're gonna use ours because we think it's gonna go a little bit faster.

05:25

And so here we would just name it us, um, word list text, because that's our

05:32

wordless that we already built. And then the next thing you need to type is just the name of the file with hash is that you'd like cracked and ours is just windows

05:45

text.

05:46

So once we hit enter, it will run through it. You can see it loaded. Six password hash is no different. Sultan. It'll actually print out the ones that cracked right here. Right here is well, But if you're cracking a whole bunch of passwords or the output gets jumbled or anything, you can actually show the passwords using John.

06:05

So what we'll do is we will do John

06:10

Dash, Dash show In the name of the file. We want the passwords,

06:15

uh, that we cracked previously.

06:19

And I have seen this before where it gets kind of wonky. Um, it's showing that didn't crack any. But we see right here that it is. So let's go ahead and we can take a look at the

06:29

I believe, john dot pot

06:32

there is. And so this is kind of like the cache file for it. Um, if we go ahead and we will rename it

06:42

Dr 60

06:45

we're gonna open it. You could see it actually did crack those passwords. So the 1st 1 to God was Jell O Best boss and mega desk Indian CDs of the same ones and hear it lists the user name as well. So Jim's Jello Michael was best boss, and Dwight was mega desk.