Hash cracking with hashcat and John the Ripper: modes, rules, masks and protected files

More than 100 machines in the catalogue include a hash cracking step: a hash from a database, from /etc/shadow, from Kerberos, or a password-protected zip. You almost never need a big GPU; you need to pick the right mode and wordlist. There is an in-browser hash identifier in identify hash.

1. Identify the hash

nth --text '$2y$10$abc...'          # name-that-hash
hashid -m '5f4dcc3b5aa765d61d8327deb882cf99'
hashcat --identify hash.txt         # hashcat 6.2.6 or later

The format gives most of them away:

2. Dictionary attack

hashcat -m 1000 hashes.txt /usr/share/wordlists/rockyou.txt
hashcat -m 1000 hashes.txt rockyou.txt --show          # what is already cracked
john --wordlist=rockyou.txt hashes.txt
john --show hashes.txt

With /etc/shadow, John needs it merged with /etc/passwd:

unshadow passwd shadow > unshadowed.txt
john --wordlist=rockyou.txt unshadowed.txt
john --format=crypt --wordlist=rockyou.txt unshadowed.txt    # for yescrypt

3. Rules: when rockyou is not enough

Rules transform each word (capitals, trailing digits, leet). They multiply the attempts but hit "corporate" passwords far more often:

hashcat -m 1000 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule
hashcat -m 1000 hashes.txt rockyou.txt -r /usr/share/hashcat/rules/OneRuleToRuleThemAll.rule
john --wordlist=rockyou.txt --rules=Jumbo hashes.txt

A custom wordlist: the company's name, the machine's, the users', the season and the year.

cewl http://target.htb -d 2 -m 5 -w words.txt     # words from the site itself
hashcat --stdout words.txt -r best64.rule > list.txt

4. Masks: when you know the pattern

If the policy demands "one uppercase, lowercase and four digits", or you have seen passwords like Company2024!:

# ?u upper ?l lower ?d digit ?s symbol ?a any
hashcat -m 1000 -a 3 hashes.txt '?u?l?l?l?l?l?d?d?d?d'
hashcat -m 1000 -a 3 hashes.txt 'Company?d?d?d?d?s'
# Dictionary + mask (word followed by 4 digits)
hashcat -m 1000 -a 6 hashes.txt words.txt '?d?d?d?d'

5. Protected files: the *2john tools

John ships a converter for almost any password-protected file. Convert, then crack:

zip2john backup.zip > zip.hash
rar2john backup.rar > rar.hash
keepass2john Database.kdbx > kp.hash
ssh2john id_rsa > ssh.hash
pdf2john report.pdf > pdf.hash
office2john document.docx > office.hash
7z2john backup.7z > 7z.hash         # needs the Compress::Raw::Lzma Perl module
john --wordlist=rockyou.txt zip.hash

For hashcat, strip the file name from the start of the line and find the mode with hashcat --example-hashes | grep -i keepass. Examples: on Access, a zip whose password sits inside a database; on Active, a Kerberoast ticket (Kerberoasting guide).

6. Performance

• Fast hashes (MD5, NTLM, SHA1): millions to billions per second. Use a dictionary with big rule sets, and masks.
• Slow hashes (bcrypt, sha512crypt, KeePass, Kerberos AES): thousands per second. Only a short, well-chosen wordlist. If all of rockyou would take days, in a CTF that is almost certainly not the intended path.
• Without a GPU (in a virtual machine, say), John is usually faster than hashcat on CPU for slow hashes.

hashcat -b -m 3200              # how long it will take on your box
hashcat ... -O -w 3             # optimised kernels and a heavier workload

Common errors

• Token length exception: the file is not in the format that mode expects (spaces, a username in front, or the wrong mode). Use --username if lines look like user:hash.
• No hashes loaded in John: give it the format with --format= (john --list=formats).
• It cracks in John but not in hashcat (or vice versa): some formats have variants; check --example-hashes and compare with yours character by character.

What next

A cracked password is worth more than one account: try it against every user and service (password reuse). In a domain, a spray with it can open several accounts at once (AD enumeration and password spraying).