Some googling pointed me to this source code file which, when compiled, should generate MD4 collisions using Wang's method (published in 2005). This is not the fastest collision attack for MD4, but it is enough to produce thousands of them.
However, tools like John the Ripper are for finding passwords from their hash; collisions are no help at all for such a task. Finding a collision is about computing two distinct strings m and m' which, when both hashed, yield the same value. For collisions, we do not care which hash value we actually obtain, as long as we get the same for both messages. For cracking password, you work over a fixed hash value which you cannot choose (you found it in a database or a similar source), and you try to find a string p which hashes to that specific value (and none other): this is a preimage attack.
MD4 is also academically broken with regards to preimages; an attack was found by Leurent in 2008. Mind the "academically" term, though: the attack has cost 2102 evaluations of the hash function. This is millions of times faster than the robustness expected from a hash function with a 128-bit output (which should resist up to cost 2128); however, this attack is still way beyond that which is technologically doable right now (a very big organization with lots of computers and money, like Google, might dedicate its vast wealth to the problem and perform about one billionth of the work within a few years, but no more).
For cracking passwords which were hashed with MD4, the best known method is still a "dictionary attack", also known as "brute force": try potential passwords until a match is found. If the hashing process did not include a per-password random element (a "salt") then the brute force effort can be shared through the use of precomputed tables (e.g. rainbow tables) but the tables still have to be built at least once.