Ubuntu 24.04 Brute-Forcing a Forgotten kpcli .kdbx Passphrase

Kpcli Basics Tut page

So you forgotten your keepass password, well ..... there is no one to call.

If you really want to try and force it open, here is a simple tut for completenoobs:

Step 1 - creating a kpcli database with password

Install Kpcli

sudo apt install kpcli

Open Kpcli

kpcli

Create passworded database on kpcli

• Will be Prompted for a master password

saveas noobs.kdbx

• You should now have a file called noobs.kdbx in same directory you run the kpcli command:
• You can save find in another path: saveas /home/$USER/Documents/mepasswords.encrypted
• NOTE: extension can be called anything, does not have to be name.kdbx

Step 2 - install john the ripper

• Ubuntu’s package might be slim—let’s grab the latest “jumbo” version from source, which includes `keepass2john`.

The `john` package in Ubuntu’s repositories (like 1.9.0-jumbo-1 in 24.04) includes John the Ripper, but `keepass2john`—a helper tool to pull hashes from KeePass `.kdbx` files—might be missing or not linked properly. Older versions or slimmed-down installs skip these extras. We’ll either find it or build a full version!

• Install Build Tools: You’ll need these to compile:

sudo apt install git build-essential libssl-dev

• Clone the Repo: Get the latest from GitHub:

git clone https://github.com/openwall/john -b bleeding-jumbo ~/john

• This downloads it to `~/john` (your home folder).

• Build It: Go there and compile:

cd ~/john/src

./configure && make -s clean && make -sj4

• Takes a minute—grab a snack! `-sj4` uses 4 CPU cores for speed.

• Find keepass2john: It’s in the `run` folder:

ls ~/john/run/keepass2john

• If it’s there, you’re golden!

Step 3 - get hash of kdbx file

Now, extract that hash:

• Test It: From your testdb folder (e.g., `~/Downloads`):

~/john/run/keepass2john noobs.kdbx > myhash.txt

• Check the output:

cat myhash.txt

• See a `$keepass$` line? Awesome—it worked!

My OutPut:

noobs:$keepass$*2*6000*0*aac404cda6fa0ea22da21cef0de9ca2f592be89f1441dd3a05315d7d43db62ef*11aef515929792aaa2e0f045749527bfef04d9ebcd874835a8d4a687b638b592*3b218e2cde618500ef223aaee6383290*9fbc2e6a830db09d6007816335b08ef25d045afdba50b50f10a85a9e3f07258b*c2c2e65427d5bb09a3d3e80b6dbcd6f4cffd2b35e3f3c219e00f2a95b33f0756

• NOTE: If using hashcat you need to remove noobs: (database_name:) from front of line, or you will get error.

Step 4 - create/download a list of passwords file

Download a names list

Install some Wordlists or create your own.

• https://github.com/brannondorsey/naive-hashcat/releases

sudo mkdir -p /usr/share/wordlists

sudo wget -O /usr/share/wordlists/rockyou.txt https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt

• NOTE: john already comes with a very good password list password.lst which i found in ~/john/run/password.lst

Create a list

make_wordlist.sh Bash script for Ubuntu 24.04 creates a `.txt` file with password guesses based on your choices:

$EDITOR make_wordlist.sh

#!/bin/bash
# Custom Password List Generator for Ubuntu 24.04 with Max Limit

# Function to check if input is a positive integer
is_positive_integer() {
    [[ $1 =~ ^[0-9]+$ ]] && [ "$1" -gt 0 ]
}

# Ask what to include
echo "Let’s build your password list!"
read -p "Include lowercase letters (a-z)? (y/n): " lower
read -p "Include uppercase letters (A-Z)? (y/n): " upper
read -p "Include numbers (0-9)? (y/n): " nums
read -p "Include special chars (!@#$%^&*)? (y/n): " special

# Get password length with validation
while true; do
    read -p "How long should each password be? (e.g., 8): " length
    if is_positive_integer "$length"; then
        break
    else
        echo "Please enter a positive integer."
    fi
done

# Set character sets and count size
chars=""
charset_size=0
if [ "$lower" = "y" ]; then
    chars="${chars}a-z"
    charset_size=$((charset_size + 26))
fi
if [ "$upper" = "y" ]; then
    chars="${chars}A-Z"
    charset_size=$((charset_size + 26))
fi
if [ "$nums" = "y" ]; then
    chars="${chars}0-9"
    charset_size=$((charset_size + 10))
fi
if [ "$special" = "y" ]; then
    chars="${chars}!@#$%^&*"
    charset_size=$((charset_size + 8))
fi

# Check if any chars were selected
if [ $charset_size -eq 0 ]; then
    echo "Oops! Pick at least one character type."
    exit 1
fi

# Calculate max possible passwords (charset_size^length)
max_passwords=$(echo "$charset_size ^ $length" | bc)
echo "With $charset_size chars and length $length, max possible passwords: $max_passwords"

# Calculate file size (bytes = max_passwords * (length + 1 for newline))
bytes_per_line=$((length + 1))
total_bytes=$(echo "$max_passwords * $bytes_per_line" | bc)
mb_size=$(echo "scale=2; $total_bytes / 1048576" | bc)  # Bytes to MB
gb_size=$(echo "scale=2; $total_bytes / 1073741824" | bc)  # Bytes to GB

# Show size warning
echo "Full list size: $mb_size MB ($gb_size GB)"

# Set a practical max (e.g., 1 billion or disk space)
disk_free=$(df -B1 ~ | tail -1 | awk '{print $4}')  # Free bytes in home dir
max_by_disk=$(echo "$disk_free / $bytes_per_line" | bc)
practical_max=$((1000000000))  # 1 billion default cap
if [ $max_by_disk -lt $practical_max ]; then
    practical_max=$max_by_disk
fi
if [ $max_passwords -lt $practical_max ]; then
    practical_max=$max_passwords
fi
echo "Practical max for your disk: $practical_max passwords"

# Get number of passwords with validation and capping
while true; do
    read -p "How many passwords to generate? (max $practical_max, e.g., 100): " count
    if is_positive_integer "$count"; then
        if [ "$count" -gt "$practical_max" ]; then
            echo "Whoa! That’s too many—capping at $practical_max."
            count=$practical_max
        fi
        break
    else
        echo "Please enter a positive integer."
    fi
done

read -p "Output file name (e.g., mylist.txt): " outfile

# Generate the list
echo "Generating $count passwords of length $length into $outfile..."
for ((i=1; i<=count; i++)); do
    tr -dc "$chars" < /dev/urandom | head -c "$length" >> "$outfile"
    echo "" >> "$outfile"  # New line for each password
done

echo "Done! Check $outfile for your custom list."

• How to Use It:

bash make_wordlist.sh

• Answer the prompts—e.g., y/n for options, 8 for length, and up to the max shown for count.

Example Run:

Let’s build your password list!
Include lowercase letters (a-z)? (y/n): y
Include uppercase letters (A-Z)? (y/n): n
Include numbers (0-9)? (y/n): n
Include special chars (!@#$%^&*)? (y/n): n
How long should each password be? (e.g., 8): 4
With 26 chars and length 4, max possible passwords: 456976
Full list size: 2.17 MB (0.00 GB)
Practical max for your disk: 456976 passwords
How many passwords to generate? (max 456976, e.g., 100): 5
Output file name (e.g., mylist.txt): testlist.txt
Generating 5 passwords of length 4 into testlist.txt...
Done! Check testlist.txt for your custom list.

Output (testlist.txt):

abcd
kjmn
pqrs
wxyz
efgh

How the Max Works:

• The script counts your character set (e.g., lowercase = 26, uppercase = 26, numbers = 10, special = 8).
  
• Max passwords = `charset_size ^ length` (e.g., 26^4 = 456,976).
  
• Size = `max * (length + 1)` bytes, shown in MB/GB (e.g., 456,976 * 5 = ~2.17 MB).
  
• Caps at 1 billion or your free disk space, whichever’s smaller—keeps it safe!
  

Tips for Noobs:

• Small counts (e.g., 1000) are quick—big ones (millions) take time and space!
  
• Check disk space first:

df -h ~

• If “bc” fails, install it:

sudo apt install bc

• Tweak special chars in the script (e.g., add `+-=` to `!@#$%^&*`) if you recall using others!
  
• WARNING File sizes can be VERY LARGE.

• The password i selected/created for this tut is just three numbers, so i just made a list containing numbers 0 to 999.
• The file is called mylist.txt

Step 5 - run list against your hash

• Syntax /path/to/john --wordlist=/path/to/wordlist.txt /path/to/myhash.txt

~/john/run/john --wordlist=mylist.txt myhash.txt

• OUTPUT

noob@noob-ThinkPad-X270:~/kpcli$ ~/john/run/john --wordlist=mylist.txt myhash.txt
Using default input encoding: UTF-8
Loaded 1 password hash (KeePass [AES/Argon2 256/256 AVX2])
Cost 1 (t (rounds)) is 6000 for all loaded hashes
Cost 2 (m) is 0 for all loaded hashes
Cost 3 (p) is 0 for all loaded hashes
Cost 4 (KDF [0=Argon2d 2=Argon2id 3=AES]) is 3 for all loaded hashes
Will run 4 OpenMP threads
Note: Passwords longer than 41 [worst case UTF-8] to 124 [ASCII] rejected
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
333              (noobs)     
1g 0:00:00:00 DONE (2025-03-20 18:06) 16.67g/s 12400p/s 12400c/s 12400C/s 057..438
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 

• It found my password 333

.pot file

• john will keep this passwd in a file called john.pot in dir ~/john/run/john.pot: or dir where john bin is.

cat ~/john/run/john.pot

• • john uses the .pot file to avoid re-cracking already-cracked passwords.

• Use /path/to/john --show myhash.txt to see password for your hash
• Delete john.pot to try cracking your password again rm ~/john/run/john.pot

No Room For Large List File - try piping

Could not get piping to work - turned out it was using password.lst in the john/run/password.lst directory
If you know how to pipe into john, please inform me - mine atempt is <!-- hidden -->