More on tuning John the Ripper

In my previous post I covered how you can tune the search space of a password cracker IF you suspect a password is going to be following a particular form or style. Since then I’ve had some interesting feedback, and one cool recommendation, to expand on sha512crypt:
“Thanks. For sha512crypt, you could also demo –fork (in bleeding-jumbo) or OpenMP.” – SD.

Well, alrighty then, let’s look at what else we can do with sha512crypt. I’ll also talk a little bit about how to get the most out of the machine you’re running John The Ripper (JtR) on. For historical reasons, I tend to use oclhashcat as my GPU cracker and JtR as my CPU-based cracker, even though JtR now supports CUDA.

In this post we’ll also see another benefit of having the latest, greatest code tree: Being able to import Pre-Shared Keys into oclhashcat or JtR that you might have gathered in ike-scan- where previously you would have had been using “psk-crack” to crack.

First off, we get the bleeding-edge jumbo code from where it lives in git. I’m doing this on Kali – any Debian-based distribution should be very similar, and other Linuxes should be fairly easy to build on too.

BTW use git fetch instead of git clone if you have already checked out this code in the past

Then make the following changes (if you can’t read diffs uncomment OMPFLAGS = -fopenmp -msse2 in Makefile), and add the custom incremental section into john.conf:

Then build it:

This spits out a big list of platforms. I happen to be using kali 32 bit, just because I had a VM handy. I did give it 2 virtual CPUs, or else there’d be no point :) I think the best target for my platform is:

At this point I got an error about a missing pcap header file, so

…and try again:

It appears to default to the “correct” number of threads, saving me typing OMP_NUM_THREADS=2 in front of the command. However, we’ll give an example of that later just to compare.

And just to see how much faster it is with two CPUs, we’ll try with one. Two cores work out roughly twice as fast as one, which is what you’d expect. (NB. This is in a VM, so I’m not sure how it maps the 2 CPUs I asked for onto my physical 2 CPU, 4 core rig).

And since we’ve got the bleeding-edge version, you can also do other cool stuff like take the PSK file that ike-scan can output, and use one of your favourite cracking tools to do that, instead of psk-crack.

Or you can swap the “*” separator to “:” within the file “john-compat-psk” and use oclhashcat. ( -m 5300 is for MD5, -m 5400 is for SHA1 ).

…and then copy and paste the new file into your oclhashcat command: