Password Cracking - nataneliezer/tech-journal GitHub Wiki

Password Cracking

How to grab password hashes, Can you extend the example to grab only those shadow accounts that have a hash? Some lines don't even have a hash.
Once access has been granted to the system a penetration tester can grab the user account names and hashes by accessing the /etc/shadow file. This contains the hashed passwords of all users and accounts.

The format of the shadow file is as follows
username: $ hash algorigthm $ # of times the hash is hashed $ salt $hash value
Using the unshadow tool a user can combine the passwd file and the shadow file so that it can be used by John the ripper or other password hash cracking tools.
##Cracking with john
John the ripper is a hash cracking tool that will calculate the hashing algorithm based on the shadow file and calculate the hashes of a large password list until one matches the provided hash.

Syntax is as follows
john passwd_file.txt shadow_file.exe

##Cracking with hashcat hashcat is a similar tool used for cracking passwords. However it offers many command line options to customize the execution. It includes a -m option for the method or algorithm of the hashes that will be calculated. hashcat -h can be used to view all of the options. The command used to crack passwords in week 6 can be found here:
hashcat -m 1800 -a 0 -o output.txt shadow.txt rockyou.txt
Documentation: https://hashcat.net/hashcat/

A useful resource on understanding the structure of the shadow file can be found here.