john VS mimikatz

John The Ripper

🔗Kali Linux Wordlist: What you need to know 🔗crunch 🔗WordLists - Kali-Tools 🔗WordLists - GitLab - repository 🔗John - Kali-Tools . 🔗Openwall -github repository -John 🔗John-The-Ripper-Tutorial - Techy Rick 🔗Openwall -John - Offical Website . 🔗Hash Cat - Wiki 🔗Cap 2 Hashcat 🔗Markov - Chain 🔗Hash Cat - Forums 🔗Security Stack Exchange - Question 260773 🔗StationX - How to use Hashcat 🔗MSF/Wordlists - charlesreid 🔗MSFConsole 🔗How to use hashcat 🔗MSF/Wordlists - charlesreid1 🔗Where do the words in /usr/share/dict/words come from? 🔗SCOWL (Spell Checker Oriented Word Lists) 🔗The spell utility -spell - find spelling errors (LEGACY) - UNIX What are Different Types of Cryptography? sha1-vs-sha2-the-technical-difference-explained-by-ssl-experts/ 🔗password-encryption 🔗Secure-Programs SHA-1 🔗What-are-computer-algorithms 🔗What Are MD5, SHA-1, and SHA-256 Hashes, and How Do I Check Them? - howtogeek.com 🔗kali-linux-wordlist-what-you-need-to-know

Ok, both John the ripper, hashcat and other tools seem to support extracting the hash, or directly trying to discover the password.

With the root hash you can crack the root password using tools like John The Ripper[0]. More generally, I assume, this exploit can be used to read any arbitrary files on the system, bypassing regular access control, and plenty of other stuff you aren't supposed to be able to do as a non-privileged user.

0: https://www.openwall.com/john/

use (John the Ripper)[https://github.com/openwall/john] and (rockyou.txt)[https://github.com/rockyou.txt]

this actually seems to have been reported as a bug and fixed years ago but it is still affecting me on a version freshly downloaded from the AUR, is there a way around this or another program i can use?

John the Ripper

Since I used to work for the employer in question, I decide to crack my own password-protected pay statements. I downloaded and built John the Ripper jumbo and then all I had to do was run a few commands after looking at the documentation, and there was my SIN number almost instantly.

However, most credential brute forcing takes place offline against a leaked database from some site. A program like John the Ripper is used to try hashing each word in a dictionary until it matches the entries in the database. Because this all happens offline, there's no mechanism in place to delay the attempts or lock the user out.

Mimikatz

Typically, Mimikatz is used to extract NTLM password hashes or Kerberos tickets from memory. However, one of its lesser-known capabilities is the ability to extract plaintext passwords from dumps created for the LSASS process. This means that an attacker can compromise plaintext passwords without running any nefarious code on domain controllers. Dump files can be created interactively or using ProcDump , and in either case, the activity is unlikely to be flagged by anti-virus software. Once the dumps are created, they can be copied off the domain controller and the plaintext credentials can be harvested using Mimikatz offline.

Mimikatz can be used to perform pass-the-ticket, but in this post, we wanted to show how to execute the attack using another tool, Rubeus , lets you perform Kerberos based attacks. Rubeus is a C# toolset written by harmj0y and is based on the Kekeo project by Benjamin Delpy, the author of Mimikatz .

What is DCShadow? DCShadow is a command in the Mimikatz tool that enables an adversary to register a rogue domain controller and replicate malicious changes across the domain.

Mimikatz provides a variety of ways to extract and manipulate credentials, but one of the most alarming is the DCSync command. Using this command, an adversary can simulate the behavior of a domain controller and ask other domain controllers to replicate information — including user password data. In fact, attackers can get any account’s NTLM password hash or even its plaintext password, including the password of the KRBTGT account, which enables them to create Golden Tickets.

Using Mimikatz , it is possible to leverage the password of the KRBTGT account to create forged Kerberos Ticket Granting Tickets (TGTs) which can be used to request Ticket Granting Server (TGS) tickets for any service on any computer in the domain.

Using the ChangeNTLM and SetNTLM commands in Mimikatz , attackers can manipulate user passwords and escalate their privileges in Active Directory . Let’s take a look at these commands and what they do.

Mimikatz will extract local tickets and save them to disk for offline cracking. Simply install Mimikatz and issue a single command: