8

I'm doing some hacking exercices and I have to gain access to a site's database so I can delete all records.

The way of getting into the administrator panel is through a password (no username). I've tried some ways of getting in (SQLi, SSI, cookies) but didn't succeed. But, reading through some of the site's pages, I found something on the "news" talking about Google crawling some links it shouldn't and that they fixed it, so checking the robots.txt file gives me a /secret directory in which there is a php file called admin.php (the one that checks for correct password) and admin.bak.php. When opened the backup one, it returned:

error matching hash dc2240d8ee745db929a6944ae7a8d016

That hash is MD4 as I found a file on one of the server's hidden directories where they were trying to generate a MD4 hash.

I've tried:

findmyhash -h dc2240d8ee745db929a6944ae7a8d016

and

hashcat -m 900 -a 0 dc2240d8ee745db929a6944ae7a8d016

but none of them were able to crack it. How could I do this?

Improve this question
11
  • @sysfired I'd simply call it MD4-hashing. For one, encrypting suggests that it's reversible which hashing is not.
    – Arminius
    Commented Aug 20, 2017 at 19:14
  • "how you could do this" is too broad to answer - 'cracking' hashes requires a wordlist to compare against: you will need that wordlist.
    – schroeder ♦
    Commented Aug 20, 2017 at 19:16
  • @sysfiend still confused: both commands appear to be improperly formed
    – schroeder ♦
    Commented Aug 20, 2017 at 19:18
  • Alright, so I was just aproaching it the wrong way. You are right @schroeder I would need a word list but you can actually gain access to the admin panel just by finding a collision, which is way easier and faster. I'll answer asap to clarify. Thanks for help
    – sysfiend
    Commented Aug 20, 2017 at 19:21
  • @sysfiend How would finding a collision help you?
    – CodesInChaos
    Commented Aug 20, 2017 at 19:26

2 Answers 2

Reset to default
4

How can I crack this hash?

John and Hashcat will both do this, but try not to be dependent on one password-cracking program.

Hashcat (Windows Example)

With hashcat, you will either need a wordlist and/or rule that contains/generates the password, or you'll need to start from nothing with no wordlist (brute force). This may take a while depending on many factors (hardware, algorithms, etc).

Your hashcat format is almost correct. You'll want to brute-force it with the '-a 3' switch:

hashcat32.exe -m 900 dc2240d8ee745db929a6944ae7a8d016 -a 3 -o cracked.txt

dc2240d8ee745db929a6944ae7a8d016:3b452

Try the --help switch or, if you want to view more attack modes:

hashcat32.exe --help | findstr "\-a":

Wordlist: hashcat -a 0 -m 400 example400.hash example.dict

Wordlist + Rules: hashcat -a 0 -m 0 example0.hash example.dict -r rules/best64.rule

Brute-Force: hashcat -a 3 -m 0 example0.hash ?a?a?a?a?a?a

Combinator hashcat -a 1 -m 0 example0.hash example.dict example.dict

John The Ripper (Linux Example)

John's requirements are the same as above, but with different command switches. John also finds this quickly without need for a wordlist:

echo dc2240d8ee745db929a6944ae7a8d016 > test.md4 && john test.md4 --format=Raw-MD4 --show

?:3b452

1 password hash cracked, 0 left

Password is 3b452.

Improve this answer
3

Found something with john the ripper within 1 min,

try john --show --format=Raw-MD4 File-Containing-The-Hash

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .