Install john and use john to crack the linux Password

1. # cd/tmp
# Wget http://www.openwall.com/john/g/john-1.7.4.2.tar.gz
# Tar-zxvf john-1.7.4.2.tar.gz
# Cd, john-1.7.4.2
# Cd src
# Make linux-x86-any-a.out
Or use yum install john
2: unshadow/etc/passwd/etc/shadow> passwd.txt (note that only root can execute unshadow,
Because only root can read/etc/shadow .)
3: chmod 600 passwd.txt
4: john passwd.txt
In addition, if the attack has been successfully cracked, you can view john. pot.
# John-show passwd.txt
# John-show-users: yujs passwd.txt
Obtain the password of the specified user.
John the Ripper's four attack Modes

Worddlist Mode)
This is the simplest Mode Supported by John. the only job you need to do is to tell John where the dictionary is (the dictionary is a text file, A single word in each line of the content indicates the password of the test. In the dictionary file cracking mode, you can use the word change function to automatically apply these rules to each read word to increase the chance of cracking.

Simple mode (Single Crack)
The "simple" attack mode is specifically designed for "using an account as a password". The so-called "using an account as a password" means that if a user account is "john 」, the password is also "john 」. In simple mode, john uses the "Account" field in the password file to crack the password, you can also apply multiple "word change" rules to the "Account" to increase the chance of cracking. For example, if the account is john, it will try "john", "john0", "njoh", "j0hn 」.... And other rule changes to try the password.

"Enhanced" Attack Mode)
This is John's most powerful cracking mode. It will automatically try all possible character combinations and then use them as passwords for cracking. It takes a long time to crack this mode, because it takes a lot of time to try to combine characters, John will define some character frequency tables (character frequencytables) to help crack. In short, this method is the "Violence Law", which tests all possible combinations of passwords to obtain the correct results.

"Plug-in module" attack Mode (External Mode)
This cracking mode allows users to write some "cracking module programs" in C language and then use them in John. In fact, the so-called "cracking Module Program" is a secondary expression designed in C language, and its function is to generate some words for John to try to crack. While

When running the John program, it automatically compiles these C-language sub-statements when loading these "cracking module programs" and then uses them. (Really great, let me admire this point)

John the Ripper command column parameter description

Command column command]

John [-command column parameters] [Password File name]

Command Column Parameters]

Parameter:-single
Note: The Single Crack mode is used for decryption. It is used to guess and decrypt data based on the user's account changes. The change rules are recorded in JOHN. [List. rules: Single] region. (I will introduce it later)

Example: john-single passwd

Parameter:-wordfile: [dictionary file name]-stdin

Note: The "Dictionary" cracking mode is used for decryption. A single word can be read from the dictionary or the-stdin parameter can be added to crack the attack by inputting a single word on the keyboard.

Example: john-wordfile: bigdict. dic passwd

Parameter:-rules
Note: The word rule change function is enabled in the dictionary file cracking mode. For example, if "dictionary file" is used to read a single word cook, the word change function is enabled, the program may try cook, c00k, cooker, cook0... And other words. Detailed change Rules are recorded in the [List. Rules: Wordlist] area of the JOHN. INI file. (I will introduce it later)

Example: john-wordfile: bigdict. dic-rules passw

Parameter:-incremental [: Mode name] (the parameter can also be abbreviated as-I [: Mode name])
Note: The "enhanced" Mode for decryption means that all possible characters are combined as passwords for cracking. Many schema names are defined in the [Incremental: *****] area of the JOHN. INI file to specify which mode to use for cracking. (I will introduce it later)

Example: john-I: all passwd

Parameter:-external: [Module name]
Note: The "plug-in module" cracking mode is used for decryption. You can write an additional "cracking Module Program" by yourself 」. The "cracking Module Program" is recorded in the [List. External: ******] area of the JOHN. INI file.

Example: john-external: double passwd

Parameter:-stdout [: LENGTH]
Note: This option has nothing to do with cracking, but simply displays the words produced by John on the screen.

Example: john-I: all-stdout

Parameter:-restore [: name of the reply file]
Note: continue the last interrupted decryption. John can press the <CTRLC> key to interrupt the password cracking process, and the current decryption progress will be stored in a file named "restore. With the "-restore" parameter, you can read the location where the last cracking was interrupted from the "restore" file and continue the cracking.

Example: john-restore

Parameter:-session [: file recording name]
Note: This option allows you to set the file name of the current session file. A work record is a file that can be used to reply to a job with the "-restore" parameter. In addition, when John is used to crack multiple jobs, the "-session" parameter can be used to set different records for each job without mixing them together.

Example: john-wordfile: bigdict. dic-session: work1 passwd

Parameter:-status [: the name of the recording file]
Note: displays the working status recorded in the work record.

Example: john-status: restore

Parameter:-makechars: [file name]
Note: create a "Character Frequency table 」. This option will generate a "Character Frequency table" based on the cracked password. (Note: John records the cracked password in the JOHN. POT file ,). If the specified file name already exists, it will be overwritten. Files generated by this option can be used in the "enhanced" cracking mode.

Example: john-makechars: ownchars

Parameter:-show
Note: The password that has been cracked is displayed. Because the JOHN. POT file does not store "Account" information, you should enter the corresponding password during use.

Example: john-show passwd

Parameter:-test
Note: the speed at which the current machine executes various types of password cracking for John is tested.

Example: john-test

Parameter:-users: [-] LOGIN | UID [,...]
Note: Only the password of an "Account" is cracked, for example, only for root users or users with root privilege UID = 0. (If the "-" symbol is added before the LOGIN | UID name, it means not to crack the password of this "account)

Example: john-I: all-users: root passwd

Parameter:-groups: [-] UID [,...]
Note: Only passwords of users in a group are cracked. (If "-" is added before the UID name, it indicates that the password of the user in the "Group" is not cracked)
Example: john-I: all-groups: 100
Parameter:-shells: [-] SHELL [,...]
Note: like the preceding two parameters, this option only applies to password cracking for all users who can use shell. (If the SHELL Name is preceded by the "-" symbol, it indicates that the password of the user who can use the SHELL is not cracked ). When specifying a SHELL, you can omit the absolute path. For example, the "-shells: csh" parameter will contain paths such as "/bin/csh" or "/usr/bin/csh, however, if you specify "-shells:/bin/csh", it only contains the SHELL Name "/bin/csh.

Example: john-I: all-shells: csh passwd

Parameter:-salts: [-] COUNT
Note: Only passwords of accounts with "salts" greater than "COUNT" are cracked, this gives you a better cracking speed (the so-called "salts" refers to the single-bit UNIX used as the basis for the "password" encoding ). For example, you can first crack the password "-salts: 2" of a certain user to get a better speed, and then crack the password of the remaining user "-salts: -2 」.

Example: john-I: all-salts: 2 passwd

Parameters:-format: NAME and-savemem: LEVEL
Note: These two parameters are related to John's internal operation settings and are not directly related to the cracking, so they are omitted.

The two most common examples are john-w: all.txt passwd.txt.

John-show passwd.txt>/pass.txt saves the decryption result to pass.txt.

You can download the dictionary at http://www.milw0rm.com /.