Optimize John the Ripper Performance

Introduction

In this lab, you will explore various techniques to optimize the performance of John the Ripper, a powerful password cracking tool. Efficient password cracking often requires leveraging available hardware resources effectively. You will learn how to configure John the Ripper to utilize multiple CPU cores, understand its GPU cracking capabilities, adjust benchmarking settings for accurate performance measurement, compare its GPU performance with Hashcat, and monitor system resources during cracking operations. These skills are crucial for anyone involved in cybersecurity, penetration testing, or system administration, enabling them to maximize the efficiency of their password auditing tasks.

Utilize Multiple CPU Cores

In this step, you will learn how to configure John the Ripper to utilize multiple CPU cores, which can significantly speed up the cracking process on systems with multi-core processors. By default, John the Ripper might not use all available cores. You can specify the number of CPU cores to use with the --fork option.

First, let's run a simple benchmark without specifying the number of cores to see the default performance.

john --test=0

You will see output similar to this, showing the performance for various hash types:

Benchmarking: Traditional DES [32/32 BS SSE2-i]... DONE
Many calculations will be done, please be patient.
Raw:    100000 c/s real, 100000 c/s virtual
Benchmarking: BSDI DES [32/32 BS SSE2-i]... DONE
Raw:    100000 c/s real, 100000 c/s virtual
...

Now, let's run the benchmark again, explicitly telling John the Ripper to use multiple CPU cores. To find out the number of CPU cores available on your system, you can use the nproc command.

nproc

This command will output the number of processing units available. For example, if it outputs 2, you have 2 CPU cores.

Now, use the --fork option with the number of cores you want to utilize. Replace $(nproc) with the actual number of cores if you prefer, but $(nproc) is dynamic.

john --test=0 --fork=$(nproc)

Compare the "Raw" performance numbers from the two benchmarks. You should observe an increase in the cracking speed when using multiple cores, especially for CPU-intensive hash types. The --fork option creates separate processes, each working on a portion of the cracking task, thus leveraging parallel processing.

Finally, let's try cracking a password file using multiple cores. We have a passwords.txt file in your ~/project directory.

john --wordlist=~/project/wordlist.txt --fork=$(nproc) ~/project/passwords.txt

After the cracking is complete, you can view the cracked passwords:

john --show ~/project/passwords.txt

This command will display any passwords that John the Ripper successfully cracked.

Configure John the Ripper for GPU Cracking (if applicable)

In this step, we will discuss configuring John the Ripper for GPU cracking. While the LabEx environment typically does not provide dedicated GPU resources for general labs, understanding this concept is crucial for optimizing John the Ripper on systems with compatible GPUs. John the Ripper supports GPU cracking through its OpenCL and CUDA implementations, which can offer significant speedups over CPU cracking for certain hash types.

To check if your John the Ripper build supports OpenCL or CUDA, you can run the following command:

john --list=opencl-devices

If OpenCL devices are detected, you will see output similar to this (though likely empty in this environment):

No OpenCL devices found.

If you were on a system with a compatible GPU and OpenCL drivers installed, you would see a list of available GPU devices. For example:

Device #0: NVIDIA GeForce RTX 3080, 10240MB, 1710MHz, 68CU

To utilize a specific GPU device for cracking, you would typically use the --format option with an OpenCL-enabled format (e.g., raw-md5-opencl) and potentially the --device option to select a specific GPU if multiple are present.

For example, on a system with a GPU, you might run:

john --format=raw-md5-opencl --wordlist=~/project/wordlist.txt ~/project/passwords.txt

Note: Since this LabEx environment does not have a GPU, the above command will likely fail or run on the CPU fallback if available. The purpose of this step is to illustrate the command and concept, not to perform actual GPU cracking in this specific environment.

To verify that John the Ripper is configured to attempt GPU cracking, you would look for messages indicating OpenCL or CUDA initialization when running a cracking command with a GPU-enabled format.

Adjust John the Ripper Benchmarking Settings

In this step, you will learn how to adjust John the Ripper's benchmarking settings to get more accurate and relevant performance metrics. The default benchmark (john --test=0) runs a quick test across various hash types. However, you can specify a particular hash type or a specific duration for the benchmark. This is useful when you want to measure performance for a specific cracking scenario.

First, let's list all available hash formats that John the Ripper supports. This can help you identify the specific format you want to benchmark.

john --list=formats

This command will output a long list of supported hash formats, for example:

raw-md5
raw-sha1
raw-sha256
...

Now, let's benchmark a specific hash format, for instance, raw-md5. You can specify the format using the --format option.

john --test=0 --format=raw-md5

You will see the benchmark results specifically for the raw-md5 format.

To get a more stable and accurate benchmark, especially for performance comparisons, you can increase the duration of the test using the --max-run-time option. This option specifies the maximum time in seconds for the benchmark to run.

Let's run a raw-md5 benchmark for 10 seconds:

john --test=0 --format=raw-md5 --max-run-time=10

Observe how the "Raw" performance numbers might stabilize or provide a more consistent average over a longer run time. This is particularly useful when comparing different hardware configurations or John the Ripper builds.

You can also combine this with the --fork option from Step 1 to benchmark multi-core performance for a specific hash type over a set duration.

john --test=0 --format=raw-md5 --fork=$(nproc) --max-run-time=10

By adjusting these benchmarking settings, you can obtain more precise performance data relevant to your specific cracking needs, helping you make informed decisions about hardware upgrades or configuration changes.

Understand Hashcat vs. John the Ripper for GPU

In this step, we will discuss the differences between Hashcat and John the Ripper, particularly concerning their GPU cracking capabilities. While both are powerful password cracking tools, they have different strengths and weaknesses, especially when it comes to leveraging GPUs.

John the Ripper (JtR):

• Strengths: Excellent for CPU-based cracking, highly versatile with many built-in formats, good for single-user systems, and has a strong focus on dictionary and brute-force attacks. Its GPU support (OpenCL/CUDA) is integrated but historically less optimized than Hashcat for raw GPU power.
• Weaknesses: GPU performance, while present, might not always match Hashcat's raw speed for certain hash types. Configuration for GPU can sometimes be less straightforward.

Hashcat:

• Strengths: Widely regarded as the fastest and most efficient GPU-based password cracker. It is highly optimized for parallel processing on GPUs (both NVIDIA CUDA and AMD OpenCL). Supports a vast array of hash types and attack modes.
• Weaknesses: Primarily GPU-focused, so CPU performance is not its main strength. Can be more complex to learn for beginners due to its extensive options and attack modes.

Key Differences for GPU Cracking:

1. Optimization: Hashcat is purpose-built for GPU acceleration and often achieves higher hashes per second (H/s) rates on GPUs compared to John the Ripper for the same hash type.
2. Ease of Use: John the Ripper's GPU options are integrated into its existing command-line interface. Hashcat has its own distinct syntax and options, which can be more granular for GPU control.
3. Community Focus: Hashcat's development and community are heavily centered around maximizing GPU cracking performance.

When to use which:

• Use John the Ripper for general-purpose CPU cracking, when you need a versatile tool with many built-in features, or when you are working on systems without powerful GPUs.
• Use Hashcat when you have access to powerful GPUs and need the absolute fastest cracking speeds for a wide range of hash types, especially in professional penetration testing or auditing scenarios.

To illustrate, if you had Hashcat installed (which is not by default in this environment), a typical command to crack MD5 hashes using a GPU would look like this:

## This command is for illustration only and will not work without Hashcat installed
## hashcat -m 0 -a 0 ~/project/passwords.txt ~/project/wordlist.txt

Where -m 0 specifies MD5 hash type and -a 0 specifies a dictionary attack.

Understanding these differences helps you choose the right tool for the job, maximizing your efficiency in password auditing tasks based on available hardware.

Monitor System Resources During Cracking

In this step, you will learn how to monitor system resources while John the Ripper is performing cracking operations. Monitoring CPU usage, memory usage, and disk I/O can help you identify bottlenecks and ensure that your system is being utilized efficiently. This is crucial for optimizing performance and troubleshooting issues.

First, let's start a John the Ripper cracking process in the background. We will use a simple dictionary attack on our passwords.txt file.

john --wordlist=~/project/wordlist.txt ~/project/passwords.txt &

The & at the end sends the process to the background, allowing you to continue using the terminal. Note the process ID (PID) that is displayed, for example: [1] 12345.

Now, let's monitor the CPU and memory usage of the system using the top command. top provides a dynamic real-time view of a running system.

top

In the top output, look for the john process. You will see its CPU usage (%CPU) and memory usage (%MEM). When John the Ripper is actively cracking, you should see its %CPU value high, especially if you are using multiple cores (it might exceed 100% for multi-core processes). Press q to exit top.

Another useful command for monitoring processes is htop. If htop is not installed, you can install it:

sudo apt install -y htop

Once installed, run htop:

htop

htop provides a more user-friendly and interactive view than top, showing CPU usage per core, memory usage, and process trees. You can easily sort processes by CPU or memory usage. Look for the john process and observe its resource consumption. Press F10 or q to exit htop.

To monitor disk I/O, you can use the iotop command. This is particularly useful if your wordlists or hash files are very large, as disk access can become a bottleneck. If iotop is not installed, install it:

sudo apt install -y iotop

Then run iotop:

sudo iotop

iotop shows real-time disk I/O activity. Look for john or related processes to see if they are heavily reading from or writing to disk. Press q to exit iotop.

Finally, let's bring the background john process back to the foreground and stop it, or simply kill it if it's still running.

fg
## Press Ctrl+C to stop the process

If fg doesn't work or you want to kill it by PID:

killall john

By regularly monitoring system resources, you can identify if John the Ripper is fully utilizing your hardware or if there are other processes consuming resources that could be allocated to cracking. This helps in fine-tuning your cracking setup for optimal performance.

Summary

In this lab, you have gained practical experience in optimizing John the Ripper's performance. You learned how to leverage multiple CPU cores using the --fork option to accelerate cracking. We discussed the principles of GPU cracking with John the Ripper, even in environments without dedicated GPUs, emphasizing the importance of OpenCL/CUDA support. You also mastered adjusting benchmarking settings to obtain precise performance metrics for specific hash types and durations. Furthermore, you understood the key differences between John the Ripper and Hashcat for GPU-accelerated cracking, enabling you to choose the most suitable tool for various scenarios. Finally, you learned to monitor system resources like CPU, memory, and disk I/O during cracking operations, which is vital for identifying bottlenecks and ensuring efficient hardware utilization. These skills are fundamental for anyone looking to maximize the efficiency of password auditing and security testing.