7

I'm doing some hacking exercices and I have to gain access to a site's database so I can delete all records.

The way of getting into the administrator panel is through a password (no username). I've tried some ways of getting in (SQLi, SSI, cookies) but didn't succeed. But, reading through some of the site's pages, I found something on the "news" talking about Google crawling some links it shouldn't and that they fixed it, so checking the robots.txt file gives me a /secret directory in which there is a php file called admin.php (the one that checks for correct password) and admin.bak.php. When opened the backup one, it returned:

error matching hash dc2240d8ee745db929a6944ae7a8d016

That hash is MD4 as I found a file on one of the server's hidden directories where they were trying to generate a MD4 hash.

I've tried:

findmyhash -h dc2240d8ee745db929a6944ae7a8d016

and

hashcat -m 900 -a 0 dc2240d8ee745db929a6944ae7a8d016

but none of them were able to crack it. How could I do this?

| improve this question | | | | |
  • @sysfired I'd simply call it MD4-hashing. For one, encrypting suggests that it's reversible which hashing is not. – Arminius Aug 20 '17 at 19:14
  • "how you could do this" is too broad to answer - 'cracking' hashes requires a wordlist to compare against: you will need that wordlist. – schroeder Aug 20 '17 at 19:16
  • @sysfiend still confused: both commands appear to be improperly formed – schroeder Aug 20 '17 at 19:18
  • Alright, so I was just aproaching it the wrong way. You are right @schroeder I would need a word list but you can actually gain access to the admin panel just by finding a collision, which is way easier and faster. I'll answer asap to clarify. Thanks for help – sysfiend Aug 20 '17 at 19:21
  • @sysfiend How would finding a collision help you? – CodesInChaos Aug 20 '17 at 19:26
4

How can I crack this hash?

John and Hashcat will both do this, but try not to be dependent on one password-cracking program.

Hashcat (Windows Example)

With hashcat, you will either need a wordlist and/or rule that contains/generates the password, or you'll need to start from nothing with no wordlist (brute force). This may take a while depending on many factors (hardware, algorithms, etc).

Your hashcat format is almost correct. You'll want to brute-force it with the '-a 3' switch:

hashcat32.exe -m 900 dc2240d8ee745db929a6944ae7a8d016 -a 3 -o cracked.txt

dc2240d8ee745db929a6944ae7a8d016:3b452

Try the --help switch or, if you want to view more attack modes:

hashcat32.exe --help | findstr "\-a":

Wordlist: hashcat -a 0 -m 400 example400.hash example.dict

Wordlist + Rules: hashcat -a 0 -m 0 example0.hash example.dict -r rules/best64.rule

Brute-Force: hashcat -a 3 -m 0 example0.hash ?a?a?a?a?a?a

Combinator hashcat -a 1 -m 0 example0.hash example.dict example.dict


John The Ripper (Linux Example)

John's requirements are the same as above, but with different command switches. John also finds this quickly without need for a wordlist:

echo dc2240d8ee745db929a6944ae7a8d016 > test.md4 && john test.md4 --format=Raw-MD4 --show

?:3b452

1 password hash cracked, 0 left


Password is 3b452.

| improve this answer | | | | |
3

Found something with john the ripper within 1 min,

try john --show --format=Raw-MD4 File-Containing-The-Hash

| improve this answer | | | | |
0

This hashcat command cracks your hash:

hashcat64.exe -a 0 -m 900 hash.txt rockyou.txt -r rules/dive.rule

Either these John the Ripper (JtR) commands cracks your hash:

john.exe --format=Raw-MD4 --wordlist=rockyou.txt --rules=hashcat hash.txt
john.exe --format=Raw-MD4 hash.txt
| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.