Using samdump2 and John the Ripper to retrieve passwords

Using Samdump2 and John The Ripper

 Both can be built from source (easier than you think with sbopkg on Slackware)

1) To crack Linux user password

Get /etc/passwd and /etc/shadow and create 2 files called passwd.txt and shadow.txt respectively.

Use unshadow as follows;

unshadow passwd.txt shadow.txt > passwords.txt

Use John The Ripper to crack the passwords, as below;

john --wordlist:/usr/share/wordlists/sqlmap.txt passwords.txt

To view the cracked passwords, use; john --show passwords.txt

2) To crack Windows XP/7 password 

Firstly, we need to boot with a Live distribution or otherwise mount the drive containing the SAM file.

2a) Get the SAM file from C:/Windows/System32/config/SAM

2b) Get the system file from C:/Windows/System32/config/system

2c) Use samdump2 to extract hashes from SAM file as below;

samdump2 system SAM

This will show you a combination of users and hashed passwords, we want to output this to a file, for example;

samdump2 system SAM > hash.txt

2d) Use John The Ripper to crack the passwords, as below;

john -format=LM  hash.txt

or to use a specific wordlist, do;

john -format=LM -wordlist=/path/to/wordlist hash.txt

To view the cracked passwords, use; john --show hash.txt