[How-To] Installing thc Hydra in Ubuntu

The steps below are how to easily install thc Hydra in Ubuntu with the majority of required libraries for common tasks. Hydra is a pretty well-known remote authentication service brute force cracker. It can perform rapid dictionary attacks against more then 30 protocols, including telnet, ftp, http, https, smb, several databases, and much more. I usually use it to test web forms on apps I'm making.

Please note: The main thc-Hydra website as malicious. Do not visit there on your main system. All of the links on this page go straight to the source at github.

First you need to install git and tools to build the code. We will use this to get the source for thc-Hydra, and to update it from time to time.

sudo apt-get install git build-essential

Next, we need to get the source for thc-Hydra from github:

cd /opt/
git clone https://github.com/vanhauser-thc/thc-hydra.git
sudo chown -R [your username] thc-hydra
sudo chmod -R 755 thc-hydra

Now you should have the source code, but most likely if you install now it will be missing a lot of the libraries it needs. Install some of the most common libraries from the packages below:

sudo apt-get install zlib1g-dev libssl-dev libidn11-dev libcurses-ocaml-dev libpcre3-dev libpq-dev libsvn-dev libafpclient-dev libssh-dev

Now try to build hydra

./configure

Check the output and see if you can find any missing libraries.

./configure
make -jX
sudo make install

Here "make -jX" where X is the number of processors your system has.

Now hydra should be installed. Type which hydra to see the install location. You can test ssh with a password list with the following command:

/usr/local/bin/hydra -l root -P PW.list -f -s 22 -t 4 -e ns  127.0.0.1 ssh

Read More

Attacking Zip File Passwords from the Command Line

There was recently a question on SuperUser linking back to CybercrimeTech's article about cracking passwords, with an issue about zip files using ZipCrypto, and never finding the password. I left an answer, saying that I guess zip2john does not know how to accurately extract the hash from zip files using that particular algorithm.

In such a case, you can either 1) figure out the data structure, and update zip2john (https://github.com/magnumripper/JohnTheRipper), or use the same approach that we have used before with LUKS to attack the file directly from the command line.

Definitely, attempting to crack the hash is faster, but if you are stuck and don't have time to reverse engineer a new file type, this would *eventually* work for you.

See the code below as an example of having John generate the password then passing it to 7zip to try. This should work regardless of chosen encryption, unless you have to specify it when opening the archive. It is not clean, but it should be enough to illustrate.

    #!/bin/bash
    # Using john the ripper to brute-force a zip container
    startTime=$(date)
    if [ $(file $1 | grep -c "Zip archive data") ]; then
        john -i --stdout | while read i; do   # this is john generating password to stdout
            echo -ne "\rtrying \"$i\" "\\r
            7z -p$i -so e $1 2>&1> /dev/null     # this is your zip command
            STATUS=$?
            if [ $STATUS -eq 0 ]; then
                echo -e "\nPassword is: \"$i\""
                break                         # if successful, print the password and quit
            fi
        done
        echo "Start time $startTime"
        echo "End time $(date)"
    else
        echo "The file does not appear to be a zip file"
    fi


This approach should work when you are unable to extract the hash, but is much, much slower (not really practical for most applications). See the results below.

    ...
    trying "pmc"
    7-Zip [64] 9.20  Copyright (c) 1999-2010 Igor Pavlov  2010-11-1
    Processing archive: test.zip
    Extracting  Sample_memo.pdf     Data Error in encrypted file. Wrong password?
    **Sub items Errors: 1**
 
    trying "1234"
    7-Zip [64] 9.20  Copyright (c) 1999-2010 Igor Pavlov  2010-11-18
    Processing archive: test.zip
    Extracting  Sample_memo.pdf
    **Everything is Ok**
    Size:       60936
    Compressed: 51033
 
    Password is: "1234"
    Start time 2015. 01. 03. (토) 19:02:51 KST
    End time 2015. 01. 03. (토) 19:02:51 KST

Read More

PRNewsWire Quotes CybercrimeTech

PRNewsWire, when writing about Passware's new LUKS GPU-assisted brute force cracker, referenced our work on LUKS password cracking with John the Ripper.

Just to be clear, prior tests with JoT were with multi-CPU - not GPU - enabled password generation. Also, we basically had only one thread attempting to access the LUKS device. Multi-threading may be able to increase practical guessing to a few a second, but probably still not as many as Passware's 300 guesses claim.

While their title is not exactly accurate, thanks for mentioning us!

Full article can be found here:

http://www.prnewswire.com/news-releases/passware-first-to-enable-computer-forensics-to-crack-linux-disk-encryption-luks-300004871.html

Read More

[How-to] Cracking ZIP and RAR protected files with John the Ripper

After seeing how to compile John the Ripper to use all your computer's processors now we can use it for some tasks that may be useful to digital forensic investigators: getting around passwords. Today we will focus on cracking passwords for ZIP and RAR archive files. Luckily, the JtR community has done most of the hard work for us. For this to work you need to have built the community version of John the Ripper since it has extra utilities for ZIP and RAR files.

For this exercise I have created password protected RAR and ZIP files, that each contain two files.

test.rar: RAR archive data, v1d, os: Unix
 
test.zip: Zip archive data, at least v1.0 to extract 

The password for the rar file is 'test1234' and the password for the zip file is 'test4321'.

In the 'run' folder of John the Ripper community version (I am using John-1.7.9-jumbo-7), there are two programs called 'zip2john' and 'rar2john'. Run them against their respective file types to extract the password hashes:

./zip2john ../test.zip > ../zip.hashes
./rar2john ../test.rar > ../rar.hashes

This will give you files that contain the password hashes to be cracked... something like this:

../test.zip:$pkzip$2*2*1*0*0*1b*a80c*95e4e9547dcfcde4b8b2f05a80aaeb9d15dd76e7526b81803c8bf7*2*0*1b*f*72051312*0*44*0*1b*a808*cbafdd390bf49ea54064ab3ff9f486e6260b9854e37d1ee3a41c54*$/pkzip$

After, that you can run John the Ripper directly on the password hash files:

./john ../zip.hashes

You should get a message like: Loaded 1 password hash (PKZIP [32/64]). By using John with no options it will use its default order of cracking modes. See the examples page for more information on modes.

Notice, in this case we are not using explicit dictionaries. You could potentially speed the cracking process up if you have an idea what the password may be. If you look at your processor usage, if only one is maxed out, then you did not enable OpenMP when building. If you have a multi-processor system, it will greatly speed up the cracking process.

Now sit back and wait for the cracking to finish. On a 64bit quad-core i7 system, without using GPU, and while doing some other CPU-intensive tasks, the password was cracked in 6.5 hours.

Loaded 1 password hash (PKZIP [32/64])

guesses: 0  time: 0:00:40:29 0.00% (3)  c/s: 2278K  trying: eDTvw - ekTsl
guesses: 0  time: 0:01:25:10 0.00% (3)  c/s: 1248K  trying: ctshm#ni - ctshfon9
guesses: 0  time: 0:02:56:40 0.00% (3)  c/s: 1499K  trying: BR489a - BR48jf
guesses: 0  time: 0:03:56:04 0.00% (3)  c/s: 1703K  trying: fjmis5od - fjmidia0
guesses: 0  time: 0:04:46:09 0.00% (3)  c/s: 1748K  trying: Difg1ek - DifgbpS
guesses: 0  time: 0:05:21:22 0.00% (3)  c/s: 1855K  trying: btkululp - btkulene
guesses: 0  time: 0:06:02:43 0.00% (3)  c/s: 1857K  trying: ghmnymik - ghmnyasd
test4321         (../test.zip)
guesses: 1  time: 0:06:32:34 DONE (Mon Jul 28 17:50:22 2014)  c/s: 1895K  trying: telkuwhy – test43ac

Now if you want to see the cracked passwords give john the following arguments:

./john ../zip.hashes --show

It should output something like:

../test.zip:test4321 
1 password hash cracked, 0 left 

Note: the hash file should have the same type of hashes. For example, we cannot put the rar AND zip hashes in the same file. But this means you could try to crack more than one zip/rar file at a time.

For the rar file it did not take nearly as long since the password was relatively common. If you take a look at john.conf in the run directory, it has a list of the patterns it checks (in order). The pattern 12345 is much more likely than 54321, so it is checked first resulting in a quick crack.

Loaded 1 password hash (RAR3 SHA-1 AES [32/64]) 

guesses: 0  time: 0:00:00:10 1.38% (1) (ETA: Mon Jul 28 18:23:58 2014)  c/s: 24.86  trying: rar.tsett - ttests 

guesses: 0  time: 0:00:02:12 13.40% (1) (ETA: Mon Jul 28 18:28:19 2014)  c/s: 25.98  trying: Test29 - Test2rar9 

test1234         (test.rar) 

guesses: 1  time: 0:00:17:03 DONE (Mon Jul 28 18:28:56 2014)  c/s: 24.01  trying: test1234 - testrar1234 

Use the "--show" option to display all of the cracked passwords reliably 

Read More

[How-to] Compiling John the Ripper to use all your processors for password cracking

John the Ripper is a fast password cracker, currently available for many flavors of Unix, Windows, DOS, BeOS, and OpenVMS. Its primary purpose is to detect weak Unix passwords. Besides several crypt(3) password hash types most commonly found on various Unix systems, supported out of the box are Windows LM hashes, plus lots of other hashes and ciphers in the community-enhanced version.

Today we are going to show you how to compile John the Ripper to use all of your processors (we will talk about compiling for NVIDIA GPUs later).

First you should visit Openwall's site and download the John the Ripper source code. I recommend getting the community-enhanced version since it contains support for many other hashes and ciphers. As of this writing, the current version of the community edition is 1.7.9.

You also need to install a compiler and ssl. On Ubuntu systems, you can just install the build-essential package, and libssl-dev.

sudo apt-get install build-essential libssl-dev

Download and verify the version suitable for your platform. In this example I am compiling on Linux Mint 17 (Ubuntu Trusty).

Extract the tar:

tar -xvf john*.tar.gz

Enter the newly created directory into the “run” directory:

cd john*/src

Important: This step enables parallel-processing in John using OpenMP.

nano Makefile

Remove the # before

OMPFLAGS = -fopenmp

and

OMPFLAGS = -fopenmp -msse2

Now save, and close.

Type “make | more” and choose the type of system that you are using. I am running a 64bit version of Linux, so I will choose linux-x86-64-native. If you have a 32 bit system, make sure to choose x86. If you don't know what to choose then “generic” will probably work for you.

Once you have edited the Makefile, and picked the system to compile for, then build the program:

make clean linux-x86-64-native

On multi-processor systems you can also add -j5 where 5 is the number of processors on your system.

make clean linux-x86-64-native -j5

Once the process is done – if it had no errors – then the binaries will be in the 'run' directory.

cd ../run

You can test it by running ./john --test

Troubleshooting

If there was an error building, try building “generic”. If it works, then you probably chose the wrong build options.

Read More