Lab 4 Password Cracking with John the Ripper (JTR)

Background

Install John the Ripper from the Fedora Repository and use it to crack a weak password of a newly created user.

System Setup

Prerequisites:

• A hypervisor with a guest running Fedora Server 32 or 33

Part I: Install John the Ripper Package and Create New User

1. yum install john
2. Create a new user named jtrtest and set the password to abc123. Show the commands below in a screenshot:

Part II: Run john to crack the weak password

JTR contains a program named unshadow that combines the contents of the passwd and shadow files:

1. cd ~
2. unshadow /etc/passwd /etc/shadow > mypasswd

If we tried to crack the passwords in this file, it would take a long time due to the number of accounts contained in the file (all of them) so we want to isolate the account we just created.

3. Using the cat and grep commands, filter the user account jtrtest and create a new file named cracklist that contains only the single account jtrtest. Show your command and display the contents of the file below:

4. Run the following command to crack the password of the jtrtest account:

/usr/sbin/john cracklist

Show your work

Once complete, you can use the following command to show the results:

5. /usr/sbin/john show cracklist

Show your work