Let's play with john the ripper

1/ Introduction

Everybody in infosec industry knows john the ripper. If you sit quietly in the middle of the night in a server room, you can hear tons of passwords being cracked by john.

I use john from time to time, but I did a little diving into the configuration file and figured that john is a lot more than a cracker. It's almost a DSL for cracking passwords.

2/ john, ok but which one?

I recommend to use the john from openwall: http://www.openwall.com/john/. It's faster, it's packed with a lot of patch, and easier to use. So, take this one. Installation is straightforward: wget it, untar-gz it, and run.

3/ rules, rules, rules and dry-run

You can launch john in dry-run mode. With this mode, john will print the candidate passwords. That's pretty cool in order to test the rules. The parameter is --stdout. Without --rules parameter, john will try only password listed in the wordlist file. We can see that john is pretty good for mangling password with --rules

mitsurugi@dojo:~/john-1.7.9-jumbo5-Linux-x86-32/run$ cat wordlist
mitsurugi
mitsurugi@dojo:~/john-1.7.9-jumbo5-Linux-x86-32/run$ ./john --wordlist=wordlist --stdout
mitsurugi
words: 1  time: 0:00:00:00 DONE (Thu Apr 14 16:12:20 2016)  w/s: 20.00  current: mitsurugi
mitsurugi@dojo:~/john-1.7.9-jumbo5-Linux-x86-32/run$ ./john --wordlist=wordlist --stdout --rules
mitsurugi
Mitsurugi
mitsurugis
mitsurugi1
Mitsurugi1
igurustim
1mitsurugi
MITSURUGI
mitsurugi2
mitsurugi!
mitsurugi3
mitsurugi7
mitsurugi9
mitsurugi5
mitsurugi4
mitsurugi8
mitsurugi6
mitsurugi0
mitsurugi.
mitsurugi?
mtsrg
igurustiM
Igurustim
mitsurugI
2mitsurugi
4mitsurugi
Mitsurugi2
Mitsurugi!
Mitsurugi3
Mitsurugi9
Mitsurugi5
Mitsurugi7
Mitsurugi4
Mitsurugi6
Mitsurugi8
Mitsurugi.
Mitsurugi?
Mitsurugi0
3mitsurugi
7mitsurugi
9mitsurugi
5mitsurugi
6mitsurugi
8mitsurugi
Mitsurugis
mitsurugied
mitsuruging
Mitsurugied
Mitsuruging
words: 49  time: 0:00:00:00 DONE (Thu Apr 14 16:12:23 2016)  w/s: 1225  current: Mitsuruging
mitsurugi@dojo:~/john-1.7.9-jumbo5-Linux-x86-32/run$

So, if you want to crack passwords, you better have to use the --rules option :-)
We can also learn that variations doesn't give you better security. If you thought that doubling your password will be harder to crack, think again, because it's in default rules list of john!!

If you want more mangling, you can try the --rules=single options:
mitsurugi@dojo:~/john-1.7.9-jumbo5-Linux-x86-32/run$ ./john --wordlist=wordlist --stdout --rules=single
mitsurugi
Mitsurugi
(...)
Mitsurug
m.itsurugi
mi.tsurugi
M.itsurugi
(...)
nurayeyfu
<oyditiho               //this one is cool on qwerty keyboard :)
Nurayeyfu               //this one too
(...)
*mitsurugi*
-mitsurugi-
=mitsurugi=
_mitsurugi_
(...)
mitsurugi2012
mitsurugi2013
mitsurugi2014
mitsurugi2015
(...)
words: 841  time: 0:00:00:00 DONE (Thu Apr 14 16:19:14 2016)  w/s: 21025  current: mitsurugi1900
mitsurugi@dojo:~/john-1.7.9-jumbo5-Linux-x86-32/run$

841 variations for a single word!! That's impressive!

4/ Writing your rules

That's not easy. The language used is (almost) braindead. The better doc I found is on openwall:
http://www.openwall.com/john/doc/RULES.shtml

5/ Use case, md5 salted password

Imagine, you found a SQL injection, you got the database, but passwords are salted, then hashed. You have the salt, you want the password.
Let's imagine that salt value is "Th1s_is_4_g00d_s4lt", and we want to crack this hash: 9c5e420f4b6f4878275502c5f097ffea

At first, we generate a wordlist:
mitsurugi@dojo:~/john-1.7.9-jumbo5-Linux-x86-32/run$ ./john --wordlist=wordlist --stdout --rules=single > my_wordlist
words: 841  time: 0:00:00:00 DONE (Thu Apr 14 16:19:14 2016)  w/s: 21025  current: mitsurugi1900
mitsurugi@dojo:~/john-1.7.9-jumbo5-Linux-x86-32/run$

Then, we create our rule. This is a string command, with the insertion of a string:
AN"STR" insert string STR into the word at position N
So,we create a rule in our john.conf file:
mitsurugi@dojo:~/john-1.7.9-jumbo5-Linux-x86-32/run$ cat my.john.conf
[List.Rules:mitsu]
A0"Th1s_is_4_g00d_s4lt"
mitsurugi@dojo:~/john-1.7.9-jumbo5-Linux-x86-32/run$

and the appropriate password file:
mitsurugi@dojo:~/john-1.7.9-jumbo5-Linux-x86-32/run$ cat password
user:9c5e420f4b6f4878275502c5f097ffea
mitsurugi@dojo:~/john-1.7.9-jumbo5-Linux-x86-32/run$

And now, we can see the magic happening:
mitsurugi@dojo:~/john-1.7.9-jumbo5-Linux-x86-32/run$ ./john --format=raw-MD5 --wordlist=my_wordlist --config=my.john.conf --rules=mitsu password
Loaded 1 password hash (Raw MD5 [SSE2 32x4])
Th1s_is_4_g00d_s4lt=mitsurugi= (user)
guesses: 1  time: 0:00:00:00 DONE (Thu Apr 14 16:53:55 2016)  c/s: 10666  trying: Th1s_is_4_g00d_s4ltMitsurugiT - Th1s_is_4_g00d_s4ltmitsurugi444
Use the "--show" option to display all of the cracked passwords reliably
mitsurugi@dojo:~/john-1.7.9-jumbo5-Linux-x86-32/run$

Job's done, MD5 salted hash has been cracked.

I think that you can crack it with a single pass, due to preprocessor commands in john.conf file, but I didn't figure out. Maybe it's better to make many passes and improve wordlist file.

6/ Conclusion

As we see, John can make a lot more than just crack passwords. It can help to generate wordlists, and the language is very powerfull (although braindead).
If you know the patterns used by someone to create passwords, john can help you to crack them :-)

The --stdout option is really usefull in order to see the common patterns used by people to derivate passwords from common words. If you use one of them, I think it's time for you to change.