Cracking passwords after a pattern with John

Question

So I am trying to find out how easy it is to crack a password using some great Linux tools.

We all know about John as a password cracker and how great it is. But how about specifying a pattern.

Let's assume the following policies.

• A password must start with a capital letter followed by 3 small letters
• A password must end with 3 numbers
• A password must be exactly 7 in length

Password example: Aabc123

So I have not the slightest clue how to do this. I tried to Google it, but no success or even hints was made for me.

Is there a way to configure John to do this and how?

Answer 1

Your best bet is to use oclHashcat's mask processor available here.

You can use this to create a wordlist with your exact specifications.

?u is uppercase
?l is lowercase
?d are digits

So you can make a wordlist of the following:

mp64.exe ?u?l?l?l?d?d?d > wordlist.txt

Run either oclHashcat or JTR against that wordlist and you're good to go.

Answer 2

John has a mask too.

Mask mode is a fast way to produce password candidates given a "mask" that describes what the words should look like.

A mask may consist of:

• Static letters.
• Ranges in [aouei] or [a-z] syntax. Or both, [0-9abcdef] is the same as [0-9a-f].
• Placeholders that are just a short form for ranges, like ?l which is equivalent to [a-z].
• ?l lower-case ASCII letters
• ?u upper-case ASCII letters
• ?d digits
• ?s specials (all printable ASCII characters not in ?l, ?u or ?d)
• ?a full 'printable' ASCII
• ?A all valid characters in the current code page
• ?h all 8-bit (0x80-0xff)
• ?H all except the NULL character (which is currently not supported by core)
• ?L non-ASCII lower-case letters
• ?U non-ASCII upper-case letters
• ?D non-ASCII "digits"
• ?S non-ASCII "specials"
• Placeholders that are custom defined, so we can eg. define ?1 to mean [?u?l] ?1 .. ?9 user-defined place-holder 1 .. 9
• Placeholder for Hybrid Mask mode ?w is a placeholder for the original word produced by the parent mode in Hybrid Mask mode.

Mask Mode alone produces words from the mask, for example ?u?l?l will generate all possible three-letter words, with first character uppercased and the remaining in lowercase.

Hybrid Mask means we use eg. a wordlist with or without rules (or some other cracking mode), and then apply the mask to each word. So with a mask of ?w?d?d and an input word (from the parent cracking mode) of "pass", it will produce "pass00", "pass01" and so on until "pass99". Hybrid Mask can be stacked upon Incremental, Markov, Wordlist and External modes.

External Filters currently can't be applied to Hybrid Mask output.

You can define custom placeholders for ?1 .. ?9 using command line eg. -1=?l?u or in john.conf section [Mask].

There is a default mask in john.conf too (defaulting to same as Hashcat: ?1?2?2?2?2?2?2?3?3?3?3?d?d?d?d). This should be used with -max-len and possibly -min-len.

The -max-len=N option will truncate the mask so no words longer than N are produced.

The -min-len=N option will skip generation of words shorter than N, and more importantly in this case, it will iterate length from -min-len to -max-len (or format's max length, if -max-len was not given). So to produce all possible words from 3 to 5 letters, use -mask=?l?l?l?l?l -min-len=3 -max-len=5. For this to work, the mask must have at least 5 positions defined.

You can escape special characters with \. So to produce a literal "?l" you could say \?l or ?\l and it will not be parsed as a placeholder. Similarly you can escape dashes or brackets to prevent them from being parsed as specials. To produce a literal backslash, use \\.

There is also a special hex notation, \xHH for specifying any character code. For example, \x41 is "A" and \x09 is the code for TAB.

Examples:

**Mask        custom mask / hybrid input  example output  num candidates**

 pass                                 pass                    1 

 pw%d                                 pw3                     10

 ?w?d?d?d     password                password123            1000x 

 ?w?s?w           bozo                 bozo#bozo              33x

 0x?1?1:?1?1:?1?1 -1=[0-9a-f]         0xde:ad:ca           16777216

 ?3?l?l?l     -3=?l?u                 Bozo, hobo            913952

 [Pp][Aa@][Ss5][Ss5][Ww][Oo0][Rr][Dd]     P@55w0rD           1296

Even you can use external program to pass the generated passwords to John:

Like this: crunch 1 6 abcdefg | ./john hashes -stdin -session=s1

Answer 3

One simple method would be to just generate the wordlist as there's only 26*26*26*26*10*10*10 possibilities, so your wordlist would be about 3.4 GB (8 bytes per password; the seven characters and a line break).

This would be trivial to do in any programming language; e.g., in python I would use:

import string
uppers = string.ascii_uppercase # 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'
lowers = string.ascii_lowercase # 'abcdefghijklmnopqrstuvwxyz'
with open('wordlist.out', 'w') as f:
    for c1 in uppers:
        for c2 in lowers:
            for c3 in lowers:
                for c4 in lowers:
                    for d in range(1000):
                        f.write('%s%s%s%s%03d\n' % (c1, c2, c3, c4, d))

This method will try every password in alphabetical order -- e.g., Aaaa000 first then Aaaa001, ..., Aaaa999, Aaab000, Aaab001, ..., Azzz999, ... Baaa000. You can rearrange the nesting of the for-loops if you want to traverse in a different order.