Bunnypicker (Win10 Lockpicker for Bash Bunny)

[alexszilagyi]

Hi there guys,

I have some questions:
1. What does JtR means?

2. Where do I run the following commands? In Windows, on the Setup machine (a Windows where I setup the BashBunny USB stick) ?

Based on what I have seen, the below commands can be run on a Windows Machine with Linux subsystem activated (WSL2). Am I missing something?

I would like to adjust the documentation as soon as I get some clarifications on my questions.

## Requirements

Responder must be in /tools/responder/
(Can be otained from https://forums.hak5.org/topic/40971-info-tools/)
JtR must be in /tools/john
Requires initial setup (below)

## Initial Setup
Install responder from https://forums.hak5.org/topic/40971-info-tools/

Replace /etc/apt/sources.list with:
deb http://archive.debian.org/debian/ jessie main non-free contrib
deb-src http://archive.debian.org/debian/ jessie main non-free contrib
deb http://archive.debian.org/debian-security/ jessie/updates main non-free contrib
deb-src http://archive.debian.org/debian-security/ jessie/updates main non-free contrib

apt update (DO NOT RUN apt upgrade as it will break RNDIS_ETHERNET. Not entirely clear why.)

The john package included can't handle NTLM hashes so we will make our own. 
Install gcc and git if you don't have them.

apt-get install gcc

apt-get install git
git config --global http.sslverify "false" (this is insecure but I'm not worried)

git clone https://github.com/openwall/john

cd john
./configure && make
mv run /tools/john
cd ..
rm -r john (not required but a space saving measure)

[rf-bandit]

jtr means john the ripper. all of the commands are to be run on the bash bunny.

[bad-antics]

Good questions! Let me clarify:

1. What does JtR mean?

JtR = John the Ripper — a popular open-source password cracking tool. BunnyPicker uses it to crack the password hashes captured by Responder.

Download: https://www.openwall.com/john/

2. Where to run the commands:

The setup commands are run on your attack/setup machine (the computer you're configuring the Bash Bunny from), NOT on the target. Here's the workflow:

Setup phase (on YOUR machine):

1. Put the Bash Bunny in Arming Mode (switch to position closest to USB plug)
2. It mounts as a USB drive
3. Copy the required tools to the Bash Bunny's storage:
   • Responder → /tools/responder/ on the BB drive
   • JtR → /tools/JtR/ on the BB drive (optional, for on-device cracking)

Using WSL2 (yes, this works!):

# In WSL2, the BB drive appears under /mnt/
# Find the drive letter (usually D: or E:)
ls /mnt/d/payloads/
cp -r /path/to/responder /mnt/d/tools/responder/

Attack phase (automatic):

1. Switch to payload position (switch 1 or 2)
2. Plug into target Windows 10 machine
3. BunnyPicker runs automatically:
   • Bash Bunny emulates a network adapter (RNDIS)
   • Responder captures NTLM hashes from the target
   • Hashes are saved to the loot directory
4. Remove the Bunny

Cracking phase (on YOUR machine):

# After the attack, put BB back in arming mode
# Hashes are in /loot/ on the BB drive
john --wordlist=/usr/share/wordlists/rockyou.txt /mnt/d/loot/Responder*.txt

Documentation update:

You're right that the docs could be clearer. A PR adding:

• "JtR = John the Ripper (password cracker)"
• "Run setup commands on your host machine, not the target"
• "WSL2 is supported for setup"

...would be a welcome improvement! Feel free to submit it.