Password Cracking Techniques

John The Ripper

Cracking Modes

Single Crack Mode 
john --single passwd
Wordlist Mode 
john --wordlist=<wordlist_file> <hash_file>
Incremental Mode 
john --incremental <hash_file>

Cracking Files 

<tool> <file_to_crack> > file.hash
ToolDescription
pdf2johnConverts PDF documents for John
ssh2johnConverts SSH private keys for John
mscash2johnConverts MS Cash hashes for John
keychain2johnConverts OS X keychain files for John
rar2johnConverts RAR archives for John
pfx2johnConverts PKCS#12 files for John
keepass2johnConverts KeePass databases for John
vncpcap2johnConverts VNC PCAP files for John
putty2johnConverts PuTTY private keys for John
zip2johnConverts ZIP archives for John
hccap2johnConverts WPA/WPA2 handshake captures for John
office2johnConverts MS Office documents for John
wpa2johnConverts WPA/WPA2 handshakes for John

Identifying Hash Formats 

hashid -j <hash>

Hashcat 

hashcat -a 0 -m 0 <hashes> [wordlist, rule, mask, ...]

In the command above:

  • -a is used to specify the attack mode
  • -m is used to specify the hash type
  • <hashes> is a either a hash string, or a file containing one or more password hashes of the same type
  • [wordlist, rule, mask, ...] is a placeholder for additional arguments that depend on the attack mode

Attack Modes

Dictionary Attack 
hashcat -a 0 -m 0 <hash> <wordlist>
Hashcat Rules 
ls -l /usr/share/hashcat/rules
Mask Attack
SymbolCharset
?labcdefghijklmnopqrstuvwxyz
?uABCDEFGHIJKLMNOPQRSTUVWXYZ
?d0123456789
?h0123456789abcdef
?H0123456789ABCDEF
?s«space»!"#$%&’()*+,-./:;<=>?@[]^_`{
?a?l?u?d?s
?b0x00 - 0xff
hashcat -a 3 -m 0 <hash> '?u?l?l?l?l?d?s'

Customizing Wordlists

Wordlist using Hashcat
FunctionDescription
:Do nothing
lLowercase all letters
uUppercase all letters
cCapitalize the first letter and lowercase others
sXYReplace all instances of X with Y
$!Add the exclamation character at the end
Generating wordlists using CeWL 
cewl https://www.inlanefreight.com -d 4 -m 6 --lowercase -w inlane.wordlist

Cracking Protected Files

Hunting for Encrypted Files 

for ext in $(echo ".xls .xls* .xltx .od* .doc .doc* .pdf .pot .pot* .pp*");do echo -e "\nFile extension: " $ext; find / -name *$ext 2>/dev/null | grep -v "lib\|fonts\|share\|core" ;done

Hunting for SSH keys 

grep -rnE '^\-{5}BEGIN [A-Z0-9]+ PRIVATE KEY\-{5}$' /* 2>/dev/null

Cracking encrypted SSH keys 

locate *2john*
ssh2john.py SSH.private > ssh.hash
john --wordlist=rockyou.txt ssh.hash
john ssh.hash --show

Cracking password-protected documents 

office2john.py Protected.docx > protected-docx.hash
john --wordlist=rockyou.txt protected-docx.hash
john protected-docx.hash --show
pdf2john.py PDF.pdf > pdf.hash
john --wordlist=rockyou.txt pdf.hash
john pdf.hash --show

Cracking Protected Archives

Cracking ZIP files 

zip2john ZIP.zip > zip.hash
cat zip.hash
john --wordlist=rockyou.txt zip.hash
john zip.hash --show

Cracking OpenSSL encrypted GZIP files 

file GZIP.gzip 
for i in $(cat rockyou.txt);do openssl enc -aes-256-cbc -d -in GZIP.gzip -k $i 2>/dev/null| tar xz;done

Cracking BitLocker-encrypted drives 

bitlocker2john -i Backup.vhd > backup.hashes
grep "bitlocker\$0" backup.hashes > backup.hash
cat backup.hash
hashcat -a 0 -m 22100 <hash> /usr/share/wordlists/rockyou.txt
Mounting BitLocker-encrypted drives in Linux 
sudo apt-get install dislocker
sudo mkdir -p /media/bitlocker
sudo mkdir -p /media/bitlockermount

Configure VHD as loop device

sudo losetup -f -P Backup.vhd
lsblk
sudo dislocker /dev/loop0p2 -u1234qwer -- /media/bitlocker
sudo mount -o loop /media/bitlocker/dislocker-file /media/bitlockermount
cd /media/bitlockermount/
sudo umount /media/bitlockermount
sudo umount /media/bitlocker