Introduction

This article describes the basics of cracking user passwords stored in the /etc/passwd and /etc/shadow directories. The passwd directory stores information regarding groups, uids, usernames, and passwords, in the following format:

misty:x:501:501::/home/misty:/bin/bash

where x is the password. This article will use John the Ripper to crack user passwords and display them as plain text.

Note: The methods described in the following text were performed on Red Hat Enterprise Linux 5 Server Edition. Although that shouldn’t matter and this information should be accurate in any UNIX environment, if something is not working and you use Ubuntu, that may be the problem. However, if you are using Ubuntu, you have much more serious problems than we can solve here.

Installing John the Ripper

The first step is to download John the Ripper (http://www.openwall.com/john/g/john-1.7.6.tar.gz) and install it. To install extract everything to your home directory (or whatever directory you want, but I use /root/) and go into the src directory. Enter the command “make” and then enter the command “make clean generic”. Now go into the “run” directory and test out the program through the following commands:

cd ../run
./john --test

Running John the Ripper

Now that you have successfully installed john the ripper (if you haven’t, try using “john” instead of “./john”) it is time to use it to crack user passwords on your UNIX system. Type the following commands into your terminal to give the program the information it needs to begin brute forcing password hashes (by the way I highly recommend adding more words to the file password.lst in the run directory, since this is the wordlist we will be using to try and crack passwords with):

./john password.lst
./unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db

check the file /tmp/crack.password.db and see where the x used to be, and the string now there instead of that x is the password. If it still isnt showing the password, use the following command:

./john /tmp/crack.password.db

Be warned that that process takes forever, but once it’s finally done, check ./john –show and you should be able to see each password that was cracked along with the corresponding username.

Congrats! You’ve just cracked the passwords of the users on your UNIX system!