debianの場合は、パッケージが用意されているので、aptitude経由でJohn the Ripperをインストールする。
$ su -
Password:
# aptitude search john
p john - active password cracking tool
p john-data - active password cracking tool - character sets
# aptitude install john
Reading package lists... Done
Building dependency tree
Reading state information... Done
Reading extended state information
Initializing package states... Done
Reading task descriptions... Done
The following NEW packages will be installed:
john john-data{a}
0 packages upgraded, 2 newly installed, 0 to remove and 6 not upgraded.
Need to get 899kB of archives. After unpacking 1802kB will be used.
Do you want to continue? [Y/n/?] y
Writing extended state information... Done
Get:1 http://ftp.jp.debian.org lenny/main john-data 1.7.2-3 [648kB]
Get:2 http://ftp.jp.debian.org lenny/main john 1.7.2-3 [251kB]
Fetched 899kB in 1s (865kB/s)
Selecting previously deselected package john-data.
(Reading database ... 57003 files and directories currently installed.)
Unpacking john-data (from .../john-data_1.7.2-3_all.deb) ...
Selecting previously deselected package john.
Unpacking john (from .../archives/john_1.7.2-3_i386.deb) ...
Processing triggers for man-db ...
Setting up john-data (1.7.2-3) ...
Setting up john (1.7.2-3) ...
mode of `/var/run/john' changed to 0700 (rwx------)
Reading package lists... Done
Building dependency tree
Reading state information... Done
Reading extended state information
Initializing package states... Done
Writing extended state information... Done
Reading task descriptions... Done
次に、パスワードファイルを作る。ここまでの作業はrootで行わなければいけない。
# unshadow /etc/passwd /etc/shadow > passwdfile # exit
オプションとパスワードファイルなしで起動すると、ヘルプを見ることができる。
$ /usr/sbin/john John the Ripper password cracker, version 1.7.2 Copyright (c) 1996-2006 by Solar Designer and others Homepage: http://www.openwall.com/john/ Usage: john [OPTIONS] [PASSWORD-FILES] --single "single crack" mode --wordlist=FILE --stdin wordlist mode, read words from FILE or stdin --rules enable word mangling rules for wordlist mode --incremental[=MODE] "incremental" mode [using section MODE] --external=MODE external mode or word filter --stdout[=LENGTH] just output candidate passwords [cut at LENGTH] --restore[=NAME] restore an interrupted session [called NAME] --session=NAME give a new session the NAME --status[=NAME] print status of a session [called NAME] --make-charset=FILE make a charset, FILE will be overwritten --show show cracked passwords --test perform a benchmark --users=[-]LOGIN|UID[,..] [do not] load this (these) user(s) only --groups=[-]GID[,..] load users [not] of this (these) group(s) only --shells=[-]SHELL[,..] load users with[out] this (these) shell(s) only --salts=[-]COUNT load salts with[out] at least COUNT passwords only --format=NAME force ciphertext format NAME: DES/BSDI/MD5/BF/AFS/LM/NT/mscash/NETLM/NETNTLM --save-memory=LEVEL enable memory saving, at LEVEL 1..3
ログアウトして、一般ユーザになってからjohnを起動する。enterキーを押すことで現状が表示される。c/sは「1秒間のパスワード解析試行回数」と言う意味らしい。下のようにオプション指定が無い場合、シングル、辞書、インクリメンタルの順番で解析が行われる。
$ /usr/sbin/john /root/passwdfile Created directory: /home/hoge/.john Loaded 2 password hashes with 2 different salts (FreeBSD MD5 [32/32]) guesses: 0 time: 0:00:02:15 90% (2) c/s: 1917 trying: dickensed guesses: 0 time: 0:00:30:33 (3) c/s: 1930 trying: c16306
かなり時間がかかる。topで確認すると、john-mmxというプロセスが走っている。
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 29097 hoge 20 0 3864 1256 932 R 98.3 1.0 2:07.76 john-mmx
これだけCPUパワーを必要とするのにもかかわらず、マルチコア、マルチプロセッサには対応していない。HT有効のXeonを2つ装備しているマシンだと下のようになる。このことは大きな問題ではない。-usersオプションをつけたり、パスワードファイルを分割すればいいだけだ。
top - 14:44:41 up 5 min, 2 users, load average: 0.98, 0.59, 0.24 Tasks: 86 total, 2 running, 84 sleeping, 0 stopped, 0 zombie Cpu0 :100.0%us, 0.0%sy, 0.0%ni, 0.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st Cpu1 : 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st Cpu2 : 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st Cpu3 : 0.0%us, 0.0%sy, 0.0%ni,100.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st Mem: 2062960k total, 130876k used, 1932084k free, 5788k buffers Swap: 6040400k total, 0k used, 6040400k free, 78668k cached PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 2386 hoge 20 0 25736 6812 1160 R 100 0.3 3:43.66 john
解析中はCtrl+Cで中断できる。
$ /usr/sbin/john /root/passwdfile Created directory: /home/de/.john Loaded 2 password hashes with 2 different salts (FreeBSD MD5 [32/32]) guesses: 0 time: 0:00:02:15 90% (2) c/s: 1917 trying: dickensed guesses: 0 time: 0:00:30:33 (3) c/s: 1930 trying: c16306 guesses: 0 time: 0:00:39:15 (3) c/s: 1927 trying: rotivi guesses: 0 time: 0:00:45:04 (3) c/s: 1928 trying: bowy1 guesses: 0 time: 0:00:45:05 (3) c/s: 1928 trying: b1kka guesses: 0 time: 0:01:06:45 (3) c/s: 1934 trying: moreela1 guesses: 0 time: 0:01:09:44 (3) c/s: 1935 trying: mcc1cens guesses: 0 time: 0:01:11:53 (3) c/s: 1935 trying: a1gay Session aborted
中断した解析を再開するには、-restoreオプションをつける。
$ /usr/sbin/john -restore Loaded 2 password hashes with 2 different salts (FreeBSD MD5 [32/32]) guesses: 0 time: 0:01:11:56 (3) c/s: 1935 trying: pjfom guesses: 0 time: 0:01:12:04 (3) c/s: 1935 trying: dung9
解析の結果を見るには、-showオプションをつけて、パスワードファイルを指定する。
$ /usr/sbin/john -show /root/passwdfile 0 password hashes cracked, 2 left
解析の途中経過等の情報はホームディレクトリ以下の.johnに保存されている。
$ ls -la ~/.john total 160 drwx------ 2 hoge hoge 4096 2009-12-06 13:47 . drwxr-xr-x 25 hoge hoge 4096 2009-12-06 15:00 .. -rw------- 1 hoge hoge 146710 2009-12-06 15:05 john.log -rw------- 1 hoge hoge 0 2009-12-06 13:47 john.pot -rw------- 1 hoge hoge 94 2009-12-06 15:05 john.rec
最後に、一時ファイルとプログラム自体を削除しておく。
$ rm -fr /home/de/.john/
$ su -
Password:
# aptitude purge john
Reading package lists... Done
Building dependency tree
Reading state information... Done
Reading extended state information
Initializing package states... Done
Reading task descriptions... Done
The following packages will be REMOVED:
john{p} john-data{u}
0 packages upgraded, 0 newly installed, 2 to remove and 6 not upgraded.
Need to get 0B of archives. After unpacking 1802kB will be freed.
Do you want to continue? [Y/n/?] Y
Writing extended state information... Done
(Reading database ... 57053 files and directories currently installed.)
Removing john ...
Purging configuration files for john ...
Processing triggers for man-db ...
(Reading database ... 57014 files and directories currently installed.)
Removing john-data ...
Reading package lists... Done
Building dependency tree
Reading state information... Done
Reading extended state information
Initializing package states... Done
Writing extended state information... Done
Reading task descriptions... Done
# exit