Video Summary - TryHackMe John the Ripper The Basics Walkthrough

What John the Ripper is (Task 1: Introduction)

John the Ripper (often shortened to John) is a hash cracking tool used in CTFs and password auditing.
It can attack more than just password hashes, including:
- ZIP/RAR archives protected by passwords
- SSH keys (e.g., private keys) via conversion tools
- Other related formats
Recommended prerequisite topics on TryHackMe:
- Hashing Basics
- Public Key Cryptography Basics
- Cryptography Basics
Learning objectives covered in the room:
- Crack passwords
- Crack Windows hashes
- Crack password-protected ZIP/RAR
- Crack SSH key passwords

Hashes convert data of any length into fixed-length outputs.
Security model:
- Hashing is one-way: you can compute a hash from input, but reversing it back to the original input is impractical.
How John cracks hashes:
- Primarily via dictionary attacks:
  - Generate hashes for candidate passwords from a wordlist
  - Compare generated hashes to the target hash
- Brute force is mentioned, but deferred.

Jumbo John is emphasized:
- It’s the “fuller” John distribution with extra modules/tools.
- Includes utilities like:
  - zip2john (convert ZIP passwords to John-crackable format)
  - rar2john (convert RAR)
  - SSH key conversion support
Notes:
- On TryHackMe attack boxes, you typically don’t need to install locally.
- On Kali Linux, john/jumbo-related tooling is often preinstalled.
Wordlists:
- rockyou.txt is used as the main example wordlist.
- Mentions SecLists as a source of many additional wordlists.
Operational guidance:
- If files are remote, you may need to SSH into the attack environment to access them.

Core command structure:
- john <options> <hash file path>
Key workflow concept:
- Automatic hash detection can fail or misidentify the hash type.
- Better approach:
  1. Identify the hash type
  2. Supply the correct John format using --format (and sometimes raw-<type>)
Hash identification:
- Uses an external idea/tool called hash identifier (hashid) and a Python script from GitHub.
- Typical flow:
  - Paste hash → identify likely types (e.g., MD5/SHA1/SHA256/SHA512/Whirlpool)
  - Then run John with the correct format
Format-string sensitivity:
- The walkthrough repeatedly stresses that correct formatting options and exact syntax matter.

Covers NT hashes / NTLM (stored in Windows SAM database).
John can crack these when provided the correct format.
Extraction context:
- Hashes may be obtained from SAM using tools (example mentioned: mimikatz).
- Another referenced option: DS* dump (e.g., DSdodit-style context).
Practical approach in the room:
- Identify the format by listing John formats and searching for NT-related entries.
- Crack using the NT format to produce the plaintext password.

Linux password sources:
- /etc/shadow (actual password hashes)
- /etc/passwd (account data/fields that relate to hashes)
Important concept:
- John may require combined input in a John-friendly format.
Uses unshadow:
- unshadow <passwd_file> <shadow_file> > <output>
Then cracking proceeds “normally” on the combined file (sometimes with/without explicit format depending on results).

Single crack mode is a targeted guessing approach:
- Uses word mangling rules based on user-specific information.
- Instead of a huge wordlist, you provide context (e.g., username/profile fields like gecos).
Command style:
- john --single ... --format ... <file>
Demonstrated behavior:
- The hash input file is modified to include the user identity prefix (e.g., “Joker;” plus the hash) so John knows what to mangle.
Result:
- John mutates the provided name and finds the cracked password (example: “Joker” with digit substitution).

Why custom rules help:
- Humans follow predictable password patterns (e.g., capitalize the first letter, add numbers/symbols).
Rule engine details:
- Rules are stored in a John rules file (e.g., john.conf / john.pf mentioned).
- Example rule concepts include:
  - C: capitalize
  - A: append using character sets
  - AZ / a-z / 0-9 style bracketed character ranges/sets
How to run a custom rule:
- Use --rule=<rule_name> with your wordlist and hash.
Conceptual demonstration:
- Create rules to apply specific transformations (e.g., capitalize first letter and append numbers/symbols).

Use zip2john to convert a password-protected ZIP into a John-crackable hash format.
Then:
- Run John against the generated hash file (often without needing to explicitly specify format, since conversion prepares it).
After cracking:
- Use the recovered password to unzip and retrieve the flag.

Mirrors the ZIP workflow using rar2john.
Then:
- Crack the produced RAR hash with John.
Extract:
- Use Linux extraction tooling (example: unrar x) with the recovered password and read flag.txt.

SSH keys can be password-protected.
John cracks key passwords by converting the private key into a John-readable hash:
- Typically via ssh2john (or an SSH-to-John conversion script).
In this walkthrough:
- The ssh2john command/tool may not be available as a binary, so a Python script is used to mimic it.
- Convert id_rsa → SSH hash file
Then:
- Crack using John with a wordlist (rockyou.txt referenced).
Outcome:
- Retrieves the private key passphrase (example: “mango”), enabling SSH/key usage.

Correct hash type/format is crucial (auto-detection can be wrong).
Wordlist quality strongly impacts success.
For special file types, use conversion tools to produce John-crackable inputs:
- unshadow, zip2john, rar2john, ssh2john-like scripts