John The Ripper is a free and open-source software for fast password cracking. Cracking DMG, RAR and other types of passwords is made easier using magnumripper's 'jumbo' version of John The Ripper.

Windows Password Hashes
John The Ripper 0 Password Hashes Cracked 1 Left Hand Holster
John The Ripper 0 Password Hashes Cracked 1 Left Hand 1
John The Ripper 0 Password Hashes Cracked 1 Left Hand Free
John The Ripper 0 Password Hashes Cracked 1 Left Hand Piano

Install John

John the Ripper (JTR) is a widely known and verified fast password cracker, available for Windows, DOS, BeOS, and OpenVMS and many flavours of Linux. It uses wordlists/dictionary to crack many different types of hashes including MD5, SHA, etc. John the Ripper: Fast Password Cracker. The John The Ripper module is used to identify weak passwords that have been acquired as hashed files (loot) or raw LANMAN/NTLM hashes (hashdump). The goal of this module is to find trivial passwords in a short amount of time. To crack complex passwords or use large wordlists, John the Ripper should be used outside of Metasploit. This initial version just handles LM/NTLM credentials. It says 'No password hashes loaded', 'No password hashes loaded (see FAQ)', or 'No password hashes left to crack (see FAQ)'. A: Your password file taken from a Unix-like system might be shadowed. You need to get both /etc/passwd and the shadow file (typically /etc/shadow or /etc/master.passwd), and combine them into one file using 'unshadow' (which is supplied with John). John the Ripper’s primary modes to crack passwords are single crack mode, wordlist mode, and incremental. The single crack mode is the fastest and best mode if you have a full password file to crack. Wordlist mode compares the hash to a known list of potential password matches. Incremental mode is the most powerful and possibly won’t complete. Aug 25, 2020 John the Ripper’s primary modes to crack passwords are single crack mode, wordlist mode, and incremental. The single crack mode is the fastest and best mode if you have a full password file to crack. Wordlist mode compares the hash to a known list of potential password matches. Incremental mode is the most powerful and possibly won’t complete.

Install John The Ripper using brew

Find John The Ripper Utilities Folder

John comes with extra utilities to help generate hashes. By default brew does not install/symlink john's extra utilities to the PATH folder /usr/local/bin. The path can be found in a variety of ways:

Using ls and following the path will eventually return /usr/local/Cellar/john-jumbo/1.9.0/share/john/ or similar:

If you have readlink installed, it's even easier:

Generating Hashes

When cracking files, John cracks the hash of the password rather than the file itself. To generate the hash files, we use the extra utilities from the folder in the last step.

For DMG files, we'll pass the encrypted-files.dmg file to the dmg2john command and output the hash to a .hash file.

The other tools available to generate hash files are:

RAR: rar2john_cmd
PDF: pdf2john.pl
ZIP: zip2john
7Z: 7z2john.pl

Crack the Hash

The last step is to crack the hash. We use the john tool directly for this step.

To ensure the GPU instead of the CPU is doing the cracking, specify a format with -opencl in its suffix. For example, dmg will be significantly slower than using dmg-opencl.

You can see the password above is abc_123. If it's not clear you can run john --show encrypted-files.dmg.hash Outlook for mac 15 spell check before sending letter. to present it clearer.

To make things even faster, if you have an idea of what the password is, you can pass a regular expression to john using the --mask flag.

Another thing I like to do at the end is remove the password on the DMG file and keep it empty:

Windows Password Hashes

Now when you open it, click the OK button.

John The Ripper 0 Password Hashes Cracked 1 Left Hand Holster

Script

To put all the above together, I use this script to set aliases to crack DMG files

After seeing how to compile John the Ripper to use all your computer's processors now we can use it for some tasks that may be useful to digital forensic investigators: getting around passwords. Today we will focus on cracking passwords for ZIP and RAR archive files. Luckily, the JtR community has done most of the hard work for us. For this to work you need to have built the community version of John the Ripper since it has extra utilities for ZIP and RAR files.
For this exercise I have created password protected RAR and ZIP files, that each contain two files.
The password for the rar file is 'test1234' and the password for the zip file is 'test4321'.
In the 'run' folder of John the Ripper community version (I am using John-1.7.9-jumbo-7), there are two programs called 'zip2john' and 'rar2john'. Run them against their respective file types to extract the password hashes:
This will give you files that contain the password hashes to be cracked.. something like this:
After, that you can run John the Ripper directly on the password hash files:
You should get a message like: Loaded 1 password hash (PKZIP [32/64]). By using John with no options it will use its default order of cracking modes. See the examples page for more information on modes.
Notice, in this case we are not using explicit dictionaries. You could potentially speed the cracking process up if you have an idea what the password may be. If you look at your processor usage, if only one is maxed out, then you did not enable OpenMP when building. If you have a multi-processor system, it will greatly speed up the cracking process.

John The Ripper 0 Password Hashes Cracked 1 Left Hand 1

Now sit back and wait for the cracking to finish. On a 64bit quad-core i7 system, without using GPU, and while doing some other CPU-intensive tasks, the password was cracked in 6.5 hours.

John The Ripper 0 Password Hashes Cracked 1 Left Hand Free

Now if you want to see the cracked passwords give john the following arguments:
It should output something like:

John The Ripper 0 Password Hashes Cracked 1 Left Hand Piano

Note: the hash file should have the same type of hashes. For example, we cannot put the rar AND zip hashes in the same file. But this means you could try to crack more than one zip/rar file at a time.
For the rar file it did not take nearly as long since the password was relatively common. If you take a look at john.conf in the run directory, it has a list of the patterns it checks (in order). The pattern 12345 is much more likely than 54321, so it is checked first resulting in a quick crack.