5

I failed to answer a question in a CaptureTheFlag event, and the the question still bugs me. I want to share the question here and please help me if you know the solution.

Question: You have the shadow file form a linux machine. Please find the admin password. And the content of the shadow file is

root:*:17277:0:99999:7:::
daemon:*:17272:0:99999:7:::
bin:*:17272:0:99999:7:::
sys:*:17272:0:99999:7:::
sync:*:17272:0:99999:7:::
games:*:17272:0:99999:7:::
man:*:17272:0:99999:7:::
lp:*:17272:0:99999:7:::
mail:*:17272:0:99999:7:::
news:*:17272:0:99999:7:::
uucp:*:17272:0:99999:7:::
proxy:*:17272:0:99999:7:::
www-data:*:17272:0:99999:7:::
backup:*:17272:0:99999:7:::
list:*:17272:0:99999:7:::
irc:*:17272:0:99999:7:::
gnats:*:17272:0:99999:7:::
nobody:*:17272:0:99999:7:::
avahi:*:17272:0:99999:7:::
sshd:*:17272:0:99999:7:::
admin:$6$/iIQV39h$ZpQpavCJ5xo2GshqMtkSMsBxaGA9WBwqmtBwyszeE9zdy9546eBb45LdqKyF9/BE3nAS.w/26dJBZ74mDB2Kl/:17401:0:99999:7:::

From the available information, I figured out that the password is hashed using SHA512 with a salt.

Since SHA512 is a pretty strong one-way hash algorithm, I don't know to to reverse engineer the password.

(There must be a correct answer to this question, because some other event participants answered correctly.)

6

This challenge seems to be about bruteforcing the password. Probably you would need to run through a word list and hash all the passwords with the particular salt and then compare it to the hash.

E.g. mkpasswd -m sha-512 PASSWORD SALT

And you would for loop this with all your passwords and see if any matches.

3

A bruteforce attack using JTR shows the password as qwertyuiop.

root@pro5:~/hack# john file.txt 
Loaded 1 password hash (crypt, generic crypt(3) [?/32])
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:14 40% 1/3 0g/s 67.89p/s 67.89c/s 67.89C/s :99999..DrAdmin
qwertyuiop       (admin)
1g 0:00:01:15 100% 2/3 0.01325g/s 68.11p/s 68.11c/s 68.11C/s samsung..britney
Use the "--show" option to display all of the cracked passwords reliably
Session completed
root@proc5:~/hack#

It cracked the password in less than 5 minutes with my old Pc as it is a weak password. If the password is strong it will take more time to crack it.

  • 4
    I'm downvoting this comment because—while it isn't *wrong*—it's pretty obvious the entire point of the exercise was for the asker to learn something by trying to solve the task themselves. Guidance that brute-force might help would be appropriate. Flat-out solving this kind of challenge for someone just deprives that person of the learning (and the sense of accomplishment) that comes from putting all of the pieces together themselves. – Stephen Touset Apr 27 '18 at 10:26
  • 3
    @StephenTouset Completely agree with your point. Actually i am using this for the first time and i never thought i could crack it as i believed shadow passwords are uncrackable. I posted it with excitement. I could have improved the answer by not disclosing the exact steps. Will keep this in mind. thanks. – ran Apr 27 '18 at 12:13
  • I up voted, then I read Stephen comment, then I downvoted .. Seems legit. – Soufiane Tahiri Apr 27 '18 at 13:17
  • You can edit your answer if you want. – Neil Smithline Apr 27 '18 at 13:34
  • Thanks for the reply! I'm glad my comment was construed as constructive feedback and not as a personal attack. – Stephen Touset Apr 27 '18 at 20:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.