John the Ripper in Post-Exploitation

Using John the Ripper during the post-exploitation phase of penetration testing

During the post-exploitation phase of penetration testing, John the Ripper helps extract and analyze additional credentials, demonstrate impact, and gather evidence for reporting.

Credential Harvesting

After gaining access to systems, John the Ripper can be used to:

  • Extract and crack additional credential stores
  • Analyze password patterns for creating custom wordlists
  • Demonstrate the impact of weak password policies

Post-Exploitation Techniques

Extracting Local Password Hashes

# Extract and crack Windows SAM hashes
reg save HKLM\SAM sam.save
reg save HKLM\SYSTEM system.save
samdump2 system.save sam.save > windows_hashes.txt
john --format=nt windows_hashes.txt

Analyzing Password Patterns

# Extract patterns from cracked passwords
john --show --format=nt windows_hashes.txt > cracked_accounts.txt
grep -o '[^:]*$' cracked_accounts.txt > cracked_passwords.txt

# Generate statistics
john --wordlist=cracked_passwords.txt --stdout --rules:stats

Creating Custom Wordlists

# Generate custom wordlists based on discovered patterns
john --wordlist=cracked_passwords.txt --stdout --rules=best64 > custom_wordlist.txt

# Use custom wordlist for additional cracking
john --wordlist=custom_wordlist.txt --rules=single new_hashes.txt

Impact Demonstration

John the Ripper helps demonstrate the real-world impact of password vulnerabilities:

  1. Password Reuse Analysis

    • Identify accounts using identical passwords
    • Demonstrate cross-service authentication risks
    • Show potential for privilege escalation

  2. Password Strength Metrics

    • Calculate average time to crack different password types
    • Demonstrate percentage of easily cracked passwords
    • Show password complexity distribution

  3. Policy Effectiveness

    • Demonstrate bypass techniques for existing policies
    • Show patterns that comply with policy but remain weak
    • Provide evidence for policy improvement recommendations

Documentation for Reporting

When documenting post-exploitation findings:

  • Record all cracked credentials (sanitized appropriately)
  • Document password patterns and statistics
  • Provide evidence of potential business impact

Next Steps

After completing post-exploitation with John the Ripper, proceed to:

  • Preparing comprehensive reports with evidence
  • Developing remediation recommendations
  • Planning for follow-up testing to verify fixes