Saturday, October 6

Recover Your GPG Passphrase using 'John the Ripper'

John the Ripper is a free and Open Source password cracker. Its primary purpose is to detect weak Unix passwords and It is one of the most popular password testing and breaking programs. It combines a number of password crackers into one package, autodetects password hash types, and includes a customizable cracker. JTR is available in official Ubuntu repositories.

I forgot my GPG key passphrase recently and I was having a tough time remembering it. Thanks to JTR I was able to recover it again. 

For recovering the GPG key passphrase, I used a custom JTR build by magnumripper. It includes a nice gpg2john binary that converts your key file into a format that JTR understands. 

JTR uses many types of attack including single crack mode, dictionary and incremental brute force. In dictionary mode, you have to supply a text file containing all possible passwords and JTR checks all of them against the hash.

If you remember some parts of your password, then you can use dictionary mode which is the fastest way to crack password. If you think your password list is not enough then you can customize JTR's default dictionary mode using rules to suit your needs.

If you remember nothing at all then you have to use incremental brute force method which can take days to crack depending on type of hash, strength of your password, customization and a number of other factors.

Thankfully for me, dictionary mode was enough to recover the passphrase. I supplied a list of around 100 passwords which I obtained by using permutation method from Python itertools. Below is the entire process I followed and John took less than a second to crack the passphrase. Hopefully it will be useful for someone.

Get the JTR build by magnumripper from GitHub.

Make sure you have the following package installed on your system: libssl-dev.

Extract the source code archive and from src folder run make command. It will give you all possible build options. I used linux-x86-any  to compile JTR. So the full command to run now: make linux-x86-any.

Once the process has finished, compile gpg2john by running make gpg2john. Go the run folder to find compiled binaries for JTR.

Now run gpg2john on private key file. Example: gpg2john mykey.asc > hash

Create a text file including all possible passwords, one on each line.

Supply both password list and hash file to John to crack password. Example: 

john --wordlist=pass.txt hash

If all went well, your password will be displayed in terminal. It will be added to john.pot file in run folder as well. You can also display your password by running command: john --show hash.

If everything fails for you then the only option is to revoke your old key and generate a new one.

0 comments:

Post a Comment

Preload Image 1 Preload Image 2 Preload Image 3 Preload Image 4 Preload Image 5