August 26, 2008
Getting John the ripper to run with LDAP SSHA passwords
To get john the ripper to run on an ordinary shadow file, I just ranapt-get install john
and then
john /etc/shadow
To get it to run on ldap passwords with SSHA:
Make script to extract passwords from ldap:
Run the script:
#!/usr/bin/perl
# This script is getpwfromldap.pl
use strict;
use Net::LDAP;
my $ldap = Net::LDAP->new( '127.0.0.1' );
my $mesg = $ldap->bind('cn=ldapadmin,dc=whatever,dc=example, dc=com',
password => 'ldappassword'
);
$mesg = $ldap->search(
base => "dc=whatever,dc=example,dc=com",
filter => "(uid=*)"
);
$mesg->code && die $mesg->error;
foreach my $entry ($mesg->entries) {
print $entry->get_value('uid') . ":" . $entry->get_value('userPassword') . ": \n" ;
}
$mesg = $ldap->unbind; # take down session
./getpwfromldap.pl > ldappasswdfile
The content of the file should look like this:
user:{SSHA}971E3Lf01ZxHlIt5gK8f3MU8ubPPOyzG:
(no this is not one of my passwords).
Install SSHA compatible john:
wget http://btb.banquise.net/bin/myjohn.tgz
tar xvzf myjohn.tgz
cd john/src
cd make linux-x86-any
cd ../run
Run john on the file you made:
./john ldappasswdfile
Getting it to work with mixed SSHA and crypt from ldap:
Problem: You have a file with mixed entries
user:{SSHA}971E3Lf01ZxHlIt5gK8f3MU8ubPPOyzG:
user2:{crypt}IUHjbpfAE9dHQ:
Solution: You have to run twice.
- Do as above for SSHA (with myjohn).
- Remove {crypt} from the crypt lines and run john (from myjohn) again.
Posted 1 year, 7 months ago on August 26, 2008
The trackback url for this post is http://people.binf.ku.dk/~hanne/blog/bblog/trackback.php/37/
The trackback url for this post is http://people.binf.ku.dk/~hanne/blog/bblog/trackback.php/37/
Comments have now been turned off for this post