The full list of administrator accounts whose password hashes were cracked by John can be listed by running pwdumpstats with the “-A” flag. This indicates a serious problem with the example organisation’s password policies or security culture, as it shows that the majority of staff, including high-privileged administrators, set weak and easily guessable passwords. In the example case above, nearly 80% of total passwords and nearly 70% of administrator passwords were cracked. These respectively describe the total number and percentage of password hashes and administrator password hashes cracked by John. The statistics most likely to stand out immediately from the pwdumpstats results are “Cracked passwords” and “Cracked admin passwords”.

pwdumpstats allows auditors and IT staff to obtain useful metrics from a pwdump.txt file (ideally one generated using NtdsAudit) and a John the Ripper pot file.Īt the most basic level, pwdumpstats can be run as follows:ģ10 64F12CDDAA88057E06A81B54E73B949B Password1ġ31 30C3F921B4A69289FE7E752E0E3BAEAB Monday10Ĥ9 31D6CFE0D16AE931B73C59D7E0C089C0 ģ8 DA7A992199887B5652528077CDD049CC October2017ģ5 A4258E2B5D7D7FBB04531A89177B5E22 November2017 In order to acquire useful and actionable information then, we may need to perform some processing on the John the Ripper (John) pot file that contains the cracked password hashes.įor this purpose we have developed a python script, pwdumpstats, that is available on Dionach’s GitHub repository. While a large list of cracked password hashes can be interesting to glance through, it can be difficult to identify patterns or systemic issues with an organisation’s password policy. In this blog post, we’ll learn how to obtain useful metrics from cracked password hashes in order to determine improvements to a password policy. In parts one and two we discussed how to dump password hashes from a Domain Controller and how to crack these hashes to obtain a list of clear text passwords.

Crack hash password