JTR and breaking the domain admin's NTLM hash

JTR

JTR (John the ripper) is a tool whose purpose is to crack hashes as efficiently as possible.

John is given, in its simplest form, the hash type (--format) as a parameter, the file where the hash is located, and a list of possible values to try.

Cracking NTLM hash

In the last module, we obtained the admin user's (Anne's) username and password NTLM hash. Let's now save the NTLM hash (only the NTLM hash, not the LM hash, not the username, and no colons) to the file "hash.txt".

CD
echo "56..." > hash.txt

The identifier of NTLM hash in JTR is "NT". We use rockyou.txt password list located at /usr/share/wordlists/rockyou.txt.

So the command from John is:

john --format=NT -w=/usr/share/wordlists/rockyou.txt hash.txt

JTR should crack the password in seconds and output it to the terminal.

Exercises

Evilcorp - Scenario 1

This is a scenario, please do not unnecessarily close it within the same course area (Scenario 1) so that you do not lose your progress. Please add time if necessary. It may take a few minutes for the scenario to start, please wait patiently.

Hakatemia PRO