0

on immersivelabs lab Password Hashes II

https://dca.immersivelabs.online/labs/password-hashes-ii/

there is a question:

What is the plaintext password of 'hash part 1' in the shadow file?

shadow.txt conains:

part1:$6$WJ9Y7LHr$S3SdnPsXhCzHetPz0CL6TL7gZdeVK/8DZjWvWuKss7gh8CR1VHkwbJyBufg19.4igURrZ6KkZ1rpErbmRnErl0:1001:1001::/home/part1:/bin/bash

part2:$6$OiSz6xnZ$ajXWPNxlLIKlxxoQJrOPnY/YvY7b2HXK9AMF.vbUiRsd4Gj717XGI2XWVIG1IQ5/kk3wG5RNnzck4nZObvrXn.:1002:1002::/home/part2:/bin/bash

part3:$6$hv6ZhFAI$KPhisFWkOD0YNzseYrp6A0FJUqGn1eeOGV6iZ97GBCrfgb9Dhm.8O96WMiftKJG4VZBSQfXvYJoRHRhdpEM4j1:1003:1003::/home/part3:/bin/bash

I've tried

root@password-hashes-2:~/Desktop# john --format=Raw-MD5 --wordlist=/usr/share/wordlists/rockyou.txt shadow.txt 
Using default input encoding: UTF-8
No password hashes loaded (see FAQ)
root@password-hashes-2:~/Desktop# 

to no avail

any advice?

should I reference https://null-byte.wonderhowto.com/how-to/crack-shadow-hashes-after-getting-root-linux-system-0186386/

========

from immersivelabs

it says:

Password Hashes II Quick Summary Salting is an extra step during hashing that adds an additional value to the end of the password, thereby changing the hash value produced. Salting can drastically reduce the chances of an attacker cracking your passwords. In this lab, you will learn about the benefits of password salting, as well as attempt to crack salted hashes.

What is a hash? A hash is just a way to represent any data as a unique string of characters. You can hash anything: music, movies, even your name. Hashing is often used on passwords, especially when logging into web applications. Visit the lab below for more information on hashes.

What is salting When a fixed value is prepended or appended to a plaintext password before hashing, the resulting hash will be unique. Even with the smallest variation in the string, the hash will always be unique. The salting function would essentially look like this: Hash(salt | password). This is useful when users have repeated passwords across multiple applications. For example, you have a password you want to salt that looks like this: Passw0rd

The salt in this instance would be added at the start of the plaintext password: SALTPassw0rd

The following Python script hashes a password and prepends it with a bcrypt salt.

#!/usr/bin/env python3
import bcrypt
passwd = b'asdf'
salt = bcrypt.gensalt()
hashed = bcrypt.hashpw(passwd, salt)
print(hashed)
iml@IML:~$ python hash.py                                                       
b'$2b$12$vMV/47cseSFqec9eNgPG9ebZT4E4D2QNmSS8aX0dXmpJwH0AdLnqS'                 
iml@IML:~$                                                                    
              

                                                             

Is salt better than sugar? The premise of salting is to protect and prevent precomputed hash attacks. Salting adds another barrier for attackers, essentially complicating the password cracking process. Salts can be stored in a database beside the hashes.

Once a hacker has compromised a database that stores salted hashed user credentials, cracking the salted hashes can be a costly operation. The time taken for an attacker to execute a successful dictionary attack is drastically increased with salted hashes, thus proving the attacker's attempts to crack the hashes to be ineffective. However, salting can be essentially worthless if the attacker knows the salt, as they could add it to their wordlists at the start or end of every password. The benefit of salts is that they don't need to be memorised by humans, so the rainbow table required to successfully crack a set of passwords would have to be very large.

In this lab In this lab, you must crack the three salted hashes contained within ‘shadow.txt’, located on the desktop. There are many tools available for hash cracking; one such tool is John The Ripper (John). To crack the hashes using John, you need to use the ‘rockyou’ wordlist, found within ‘/usr/share/wordlists’. The following syntax can be used to crack the hashes with John, using a wordlist. Follow the link below for more information on John The Ripper.

john --wordlist=/usr/share/wordlist/mywordlist.txt --format=raw-md5 Downloads/hashes.txt
1

I think the problem is that you're setting the --format to raw-MD5, while the$6$ at the beginning of the hash tells you it is a hash of type SHA512 crypt .

Here is what the numbers at the beginning of the hash mean:

$1$ is MD5
$2a$ is Blowfish
$2y$ is Blowfish
$5$ is SHA-256
$6$ is SHA-512

john should be able to detect this automatically if you do not use the --format option, but if it does not work set --format=sha512crypt

1
  • OMG silly me ... it worked !!! >john --wordlist=/usr/share/wordlists/rockyou.txt shadow.txt – Data Flow Oct 7 '20 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.