使用 John the Ripper 进行弱口令检测和破解

John the Ripper 是一款常见的弱口令检测（或者说是破解）的小工具。

一、John the Ripper 的编译过程

其编译与安装过程比较简单：

1. 在官网上下载源代码：https://www.openwall.com/john/
2. 解压缩并进行编译：make clean linux-x86-64

# 注意，clean 后面需要跟上体系架构参数，如果没有内容，会提示如下内容
andy@localhost:~/SourceCode/John-1.8.0/src$ make
To build John the Ripper, type:
    make clean SYSTEM
where SYSTEM can be one of the following:
linux-x86-64-avx         Linux, x86-64 with AVX (2011+ Intel CPUs)
linux-x86-64-xop         Linux, x86-64 with AVX and XOP (2011+ AMD CPUs)
linux-x86-64             Linux, x86-64 with SSE2 (most common)
linux-x86-avx            Linux, x86 32-bit with AVX (2011+ Intel CPUs)
linux-x86-xop            Linux, x86 32-bit with AVX and XOP (2011+ AMD CPUs)
linux-x86-sse2           Linux, x86 32-bit with SSE2 (most common, if 32-bit)
linux-x86-mmx            Linux, x86 32-bit with MMX (for old computers)
linux-x86-any            Linux, x86 32-bit (for truly ancient computers)
linux-alpha              Linux, Alpha
linux-sparc              Linux, SPARC 32-bit
linux-ppc32-altivec      Linux, PowerPC w/AltiVec (best)
linux-ppc32              Linux, PowerPC 32-bit
linux-ppc64              Linux, PowerPC 64-bit
linux-ia64               Linux, IA-64
freebsd-x86-64           FreeBSD, x86-64 with SSE2 (best)
freebsd-x86-sse2         FreeBSD, x86 with SSE2 (best if 32-bit)
freebsd-x86-mmx          FreeBSD, x86 with MMX
freebsd-x86-any          FreeBSD, x86
freebsd-alpha            FreeBSD, Alpha
openbsd-x86-64           OpenBSD, x86-64 with SSE2 (best)
openbsd-x86-sse2         OpenBSD, x86 with SSE2 (best if 32-bit)
openbsd-x86-mmx          OpenBSD, x86 with MMX
openbsd-x86-any          OpenBSD, x86
openbsd-alpha            OpenBSD, Alpha
openbsd-sparc64          OpenBSD, SPARC 64-bit (best)
openbsd-sparc            OpenBSD, SPARC 32-bit
openbsd-ppc32            OpenBSD, PowerPC 32-bit
openbsd-ppc64            OpenBSD, PowerPC 64-bit
openbsd-pa-risc          OpenBSD, PA-RISC
openbsd-vax              OpenBSD, VAX
netbsd-sparc64           NetBSD, SPARC 64-bit
netbsd-vax               NetBSD, VAX
solaris-sparc64-cc       Solaris, SPARC V9 64-bit, cc (best)
solaris-sparc64-gcc      Solaris, SPARC V9 64-bit, gcc
solaris-sparcv9-cc       Solaris, SPARC V9 32-bit, cc
solaris-sparcv8-cc       Solaris, SPARC V8 32-bit, cc
solaris-sparc-gcc        Solaris, SPARC 32-bit, gcc
solaris-x86-64-cc        Solaris, x86-64 with SSE2, cc (best)
solaris-x86-64-gcc       Solaris, x86-64 with SSE2, gcc
solaris-x86-sse2-cc      Solaris 9 4/04+, x86 with SSE2, cc
solaris-x86-sse2-gcc     Solaris 9 4/04+, x86 with SSE2, gcc
solaris-x86-mmx-cc       Solaris, x86 with MMX, cc
solaris-x86-mmx-gcc      Solaris, x86 with MMX, gcc
solaris-x86-any-cc       Solaris, x86, cc
solaris-x86-any-gcc      Solaris, x86, gcc
sco-x86-any-gcc          SCO, x86, gcc
sco-x86-any-cc           SCO, x86, cc
tru64-alpha              Tru64 (Digital UNIX, OSF/1), Alpha
aix-ppc32                AIX, PowerPC 32-bit
macosx-x86-64            Mac OS X 10.5+, Xcode 3.0+, x86-64 with SSE2 (best)
macosx-x86-sse2          Mac OS X, x86 with SSE2
macosx-ppc32-altivec     Mac OS X, PowerPC w/AltiVec (best)
macosx-ppc32             Mac OS X, PowerPC 32-bit
macosx-ppc64             Mac OS X 10.4+, PowerPC 64-bit
macosx-universal         Mac OS X, Universal Binary (x86 + x86-64 + PPC)
hpux-pa-risc-gcc         HP-UX, PA-RISC, gcc
hpux-pa-risc-cc          HP-UX, PA-RISC, ANSI cc
irix-mips64-r10k         IRIX, MIPS 64-bit (R10K) (best)
irix-mips64              IRIX, MIPS 64-bit
irix-mips32              IRIX, MIPS 32-bit
dos-djgpp-x86-mmx        DOS, DJGPP, x86 with MMX
dos-djgpp-x86-any        DOS, DJGPP, x86
win32-cygwin-x86-sse2    Win32, Cygwin, x86 with SSE2 (best)
win32-cygwin-x86-mmx     Win32, Cygwin, x86 with MMX
win32-cygwin-x86-any     Win32, Cygwin, x86
beos-x86-sse2            BeOS, x86 with SSE2 (best)
beos-x86-mmx             BeOS, x86 with MMX
beos-x86-any             BeOS, x86
generic                  Any other Unix-like system with gcc

3. 编译完成后，会在 “src” 同级的 “run” 目录中生成名为 “john” 的程序，直接使用即可，其实也不涉及什么安装流程了。

二、John the Ripper 的使用方法

1. 检测（或者说破解）弱口令

1）Linux 的用户口令保存在 “/etc/shadow” 文件中，可先将其拷贝到一个文本文档中：

# shadow 加密保存 root 或其他用户的口令
sudo cat /etc/shadow
root:$6$6VgjtRpu$DbbXO54tDOsqhEQD1rqrwrL83cd4fSUisNHvFu69VA5mYIKtE556LQzzbaSxGLQFh7u.smpe2meRjTPn5y0uJ1:17716:0:99999:7:::
andy:$6$DK4ye8lg$.DWNm6KZbt.0gbpwN/KoKUoC.2wONd.JQL/Dp8jGYOcUHAt37ecz24Zy5bfq3EUw8Ajt1aAuQT.hWEqxPr1Su1:17716:0:99999:7:::

#拷贝 shadow 文件
sudo cp /etc/shadow shadow.txt

2）执行检测或破解

#执行检测或破解
andy@localhost:~$ run/john shadow.txt 
Loaded 2 password hashes with 2 different salts (crypt, generic crypt(3) [?/64])
Press 'q' or Ctrl-C to abort, almost any other key for status
123456           (andy)
123456           (root)

andy@localhost:~$ run/john --show shadow.txt 
root:123456:17716:0:99999:7:::
andy:123456:17716:0:99999:7:::

2. 更新弱口令字典

1）John the Ripper 针对弱口令的检测或破解，其实就是利用了弱口令字典。其默认的字典保存在 “run” 目录中，文件名为 “password.lst”，下面截取了一小段，感受一下

123456
12345
password
password1
123456789
12345678
1234567890
abc123
computer
tigger
1234
qwerty
money
carmen
mickey
secret
summer
internet
a1b2c3
123
service

2）做一个实验，我把用户的密码强度提高，比如123456@china，这就不在弱口令字典中了

andy@localhost:~$ sudo passwd andy
[sudo] password for andy: 
Enter new UNIX password: 
Retype new UNIX password: 

3）重新拷贝 “/etc/shadow” 文件，然后进行检测或破解，你会发现经过很长时间也破解不了

CPU狂转，这就是暴力破解

4）将该密码也作为弱口令添加到弱口令字典中，再进行检测或破解呢？

编辑弱口令字典

重新执行检测或破解，这次很快就破解了。也就是说，随着时间的延续发展，可以不断的更新弱口令字典，以保证口令的强度。

andy@localhost:~$ run/john shadow.txt 
Loaded 2 password hashes with 2 different salts (crypt, generic crypt(3) [?/64])
Remaining 1 password hash
Press 'q' or Ctrl-C to abort, almost any other key for status
123456@china     (andy)

andy@localhost:~$ run/john --show shadow.txt 
root:123456:17716:0:99999:7:::
andy:123456@china:17821:0:99999:7:::

2 password hashes cracked, 0 left

---