Okay so let's just continue up with this follow-up tutorial on John the Ripper.
We have obtained root access and we needed root access
in order to have access to etc passwd and etc shadow
where the passwords are stored.
Now we need to go ahead and type in as root.
"unshadow"
Yes, my typing skills are amazing.
So just type in "unshadow /etc/passwd"
and "/etc/shadow"
Excellent
and we need to store this in some sort of file.
You can name it whatever you want.
You can actually smash your keyboard if you wish.
I'm gonna go ahead and name mine "pass"
Press ENTER
If you do "ls", you'll see that there is a data file named "pass"
Let's just go ahead and type in "cat pass"
Press ENTER
and there you go
I have lots of things here, lots of hashes...
Actually, maybe not lots of hashes.
Sorry about that
but you have "root :", and here you have an encryption
and then down below somewhere, if I can just find it...
There we go
So it says "test :" and then you have an encryption there.
Let's go ahead and clear the screen.
Now "john" has a lot of options here.
Let me just switch to full screen mode
and look --
You can specify certain rules.
You can specify files.
So just do a word list and then read from the word list.
You can have a configuration file for john itself to substitute john.com
which you can also alter as well
There are literally tons and tons of rules here
depending on what you are cracking
what sort of encryption you are cracking
but the most specific rules are the best ones.
Actually, the best ones
That's what I wanted to say
The best ones are when you can actually specify certain rules
on your brute force attack.
So let's say, I don't know
I want you to try all the words
where the first letter is a capital letter
then the second letter is lower case letter or something of a kind
because it is likely the first letter will be capital
more likely than not
and if you know that the the last three characters are actually numbers
you can also do that as well.
There are a ton load of options.
You can do these things with crunch, as I have shown you before
but I just wanted to make a mention of it that it does exist
for John the Ripper as well.
However, what people generally tend to use for John the Ripper
is "--format - NAME"
Now name, of course
you will substitute with one of the encryption types
with one of the hashes
so it forces one of these hashes to be decrypted.
If you don't know which type of a hash it is, it's not a big deal at all.
Don't worry about it.
John will be able to figure it out on its own
but it will issue a warning.
Look at how many of them there are.
There are a lot of them
and as I said, if you don't know which one it is, no big deal.
Also a very nice thing is...
You know those files that you download from torrents
and then, I don't know
sometimes it says that the file is zipped and that there is a password on it?
Well, you can use John the Ripper to actually crack it open.
That's very nice as well
but in any case, we're just gonna use John with the most basic options
in order to crack the password hashes for a Linux system
as we are cracking system passwords today.
You can also use this crack status
"emit a status line whenever a password is cracked"
If you have a very large file of hashes
you can also use this one to tell you when something is cracked
but generally, you just want to leave it to run to the end.
Anyway, let's just go ahead and clear to screen.
Use john
So just type in "john"
It's called John the Ripper, but the command to execute it is just John
and then type in the file that we have previously made.
So "pass", press Enter
and for you, its gonna say, I don't know
something like password's cracked or something like that.
For me, it says "Loaded 2 password hashes with 2 different salts"
So yeah, there we go.
It says "No password hashes left to crack"
because I have cracked them previously
but it doesn't matter whether you find them here or not.
What you want to do is be able to see them later on
and that's the command that is of importance to you
regardless of whether you see them here or not.
So they will be printed out here.
It will say "username password"
However, that's not what you want.
What you want is "john --show"
Oops, sorry
"john --show pass"
Excellent
So you type in "john", then you type in space
once the job is done completely
and then space, dash dash, show, space
and then name of the file for which you wanted to crack the hashes
and then it says "root : test : 0 :0 : root : /root : /bin/bash"
It says "root : test" and this is the password for root.
So you see here - the root account, colon
The password for root account is test
and you can just disregard the rest
and the password for our regular user
test, colon, test
I really should be using something different here
other than just pretty much naming everything "test"
because it can get a bit confusing.
That's one of the things that I would suggest to you that you change
but many case, this cracking process can take a while
so keep that in mind.
John the Ripper is not perfect
and of course, its performance is dependent
on the physical capabilities of your machine.
If it's something rather complex and difficult
It's gonna take a lot longer than this.
Although there's always that factor of chance
that you will be able to figure it out a relatively short amount of time.
In any case, it doesn't cost you a lot to simply give it a shot
because you always have a chance
and this is the format that you will get for the files.
Make sure to save the files somewhere
so that you can always review them later on with "john --show" command.
I just want to reiterate once again
it makes no difference whatsoever that I wasn't shown passwords here
because it says "No password hashes left to crack"
"Loaded 2 password hashes with 2 different salts"
Doesn't really matter.
All of this you will see
except this last line
and then instead of the last line
you will see something like this
but again, it doesn't matter to you at all
primarily because that's the terminal output.
That's the standard output.
You don't want to just have it there in the standard output.
You want to have it somewhere
where you are always able to access it
and that's why after you've cracked them
clear the screen and use "john --show"
and then the name of the file
in order to list them here
because like that, they are stored for good on your computer
where you can review them at any later time.
You do not want to be memorizing these passwords
and once again, do use something different other than "test"
You can see I was confused there for moment
primarily because I use these things.
Anyway, I bid you all farewell
and in the follow-up tutorial
I'm gonna go ahead and jump into Windows
and see what we can actually do there
and how can we extract and crack the passwords in Windows
or bypass them completely.
Until then, I'm gonna call the tutorial here
and I hope to see you there as well.