1

The error I'm getting is this: (I have to double-newline (press enter twice) these because it automatically attempts to write them straight out, and that makes it more confusing.)

Using default input encoding: UTF-8

No password hashes loaded (see FAQ)

I think the real problem is I'm not very adept in Linux. I'm not sure if there's something wrong with using this directory, must I use a different user account than root? Must that other user account have root or bash authority, I have no idea on most of this stuff. I'm sort of just following the instructions on the LAMPSecurity CTF exercise 7 PDF.

The password file I'm using was from a dump off of a CTF8 server's website is this:

rockyou.txt

The command I'm using is this:

john --wordlist=/usr/share/wordlists/rockyou.txt –-format=raw-MD5 /root/hashes.txt

And yes, both files are in those correct directories. rockyou.txt is the default common-passwords list that comes with Kali's default version of John the Ripper. I had to actually pull the rockyou.txt file out of the rockyou.txt.gz compressed file, and I merely left it in that same folder.

I have tried moving both files into the same directory, /usr/share/wordlists. I have even tried to use the unshadow command and point the command to create a myhashes.txt. The myhashes.txt didn't work at that point either.


Wait, am I supposed to actually copy all of the data from the hashes.txt to the myhashes.txt after using the unshadow command? I noticed that the myhashes.txt has only one line. I figured it pointed to the hashes.txt somehow. But now I'm thinking maybe it's simply a command to unshadow the data underneath.

*************** I just thought of this. I'm going to try it, but I suspect it won't work.

The command I'm attempting to use in which I'm getting those errors is this: OH, and as long as I point to the correct file, and the directory path is in the correct direction, it gives me the above errors, otherwise, it will say that the file isn't found.

VERSION INFORMATION:

Kali Linux. The download file says 2016.2, the lsb_release -a says kali-rolling.

I can't seem to figure out how to check my John the Ripper version. It's the one that comes default with Kali 2016.2.

The Gnome Terminal about option says: 3.20.2

BACKGROUND: So, I'm doing the LAMPSecurity CTF Exercise 7. I'm stuck on page 49 of the PDF instructions for hours doing internet searches and not being sure what to do. It has us using a CTF8 linux server and the instructions are for backtrack, but I'm using Kali Linux instead.

It has us run a version of the server before it's been updated and patched so that it has plenty of vulnerabilities. Using a vmware, I set the network cards to the host-only private network on both Kali linux and CTF8.

I was able to exploit the vulnerability as per instructions in the comment box in order to obtain a password hash dump file named hashes.txt.

I have the hashes.txt, and even tried using the unshadow command to make a myhashes.txt, but that file only has one line in it.

I tried to move that myhashes.txt into the /usr/share/wordlists directory with the rockyou.txt file, and then change to that directory in order so that I don't have to use paths. It still gives the same error.

I'm not really sure what to do next. I'm hoping someone else has done this exercise and knows what they did to solve it, or if you have more experience with Linux and can intuit what I'm doing wrong, that would be great as well.

Thank you.

EDIT UPDATE: Thanks a lot for your help, HAlmussajjen. HAlmussajjen helped me solve this in a chat. All of the hashes in the file were listed as username.number. "Number" of course meaning the actual hash value. Apparently, all stupid me needed to do was to delete the "username." before each hash number. Boy, was that an ordeal just for something simple

  • please do not place the answer in your question: if you need to create your own answer - you accepted an answer that is not an answer to your problem, which makes this whole post of little use to anyone else with the same problem – schroeder Oct 8 '17 at 16:57
0

well, just make sure the hashes is in the correct file and path and then I would recommend you to try the following command:

john --wordlist= /usr/share/wordlists/rockyou.txt –-format=raw-MD5 /root/hashes.txt

or

john --wordlist= /usr/share/wordlists/rockyou.txt /root/hashes.txt

if this didn't work and you're logged in as root, I think there is a problem in the tool it self, delete it and reinstall it

  • Let us continue this discussion in chat. – Progfram Jan 29 '17 at 0:29
  • Thanks a lot for your help. HAlmussajjen helped me solve this in a chat. All of the hashes in the file were listed as username.number. "Number" of course meaning the actual hash value. Apparently, all stupid me needed to do was to delete the "username." before each hash number. Boy, was that an ordeal just for something simple. – Progfram Jan 29 '17 at 1:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.