You would have seen the command cat /etc/shadow - On a Linux system the shadow file contains all user account details. Its broken down into the following format:

username:$hash_algorithm$hash_salt$hash_data:other_data..

In this challenge, we’re only really interested in the users hashed password. Firstly, what is a hash?

Hashing and encrypting are not the same. If you encrypt something, you can decrypt it again to get the original plain text data. With a hash, it only works one way. You can turn it into another not-human readable form and it cannot be reversed. With a hash, the only way to tell the value of the hash is, taking characters, hashing them and comparing them to see if both hashes are the same.

We can try and Crack The Hash by taking a word list, using a hashing algorithm and hashing each word from the list, comparing it to the original. If it’s the same hash, we have the word that was originally hashed, if its different we can move onto the next word to compare.

Let’s take an example hash and crack it together! Let's say we have the following data:

testuser:$6$/5K3q7L0$XsNMzp37s0Q8/sAX0NXtQQjsy6a2f5tvKn2ZJSGWwE8uL9JLhXKpR7.pCbu/WoZa4LXIPYe7k18Z3Nohymk5T0:18233:0:99999:7:::

Blue shows the username, the green shows all the hash information, and the red color shows the rest of the data.

Lets separate the user and the hash:

Linux username:

testuser

Hash Information:

$6$/5K3q7L0$XsNMzp37s0Q8/sAX0NXtQQjsy6a2f5tvKn2ZJSGWwE8uL9JLhXKpR7.pCbu/WoZa4LXIPYe7k18Z3Nohymk5T0

Using the first $6, we can look up what type of hash algorithm was used. To look this up, check this page: https://hashcat.net/wiki/doku.php?id=example_hashes ****and view the Hash-mode. We can search for $6 and see the hash-mode for Hashcat is 1800 and the type is using sha512crypt.

OR USE

hashid in terminal or hashidentifier

Hashcat is a a very popular password cracking tool. You can download it from the official hashcat website: https://hashcat.net/hashcat/. Alternatively, if you’re using the virtual Kali machine on TryHackMe ****it will be pre-installed for you - simply open up a terminal and type ‘hashcat’.

We now need a wordlist to hash and compare to the original, for this we’re going to use a password list called rockyou.txt. Download this here: https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt - again, if you’re using the virtual Kali machine, its already downloaded and can be found: /usr/share/wordlists (you will need to run gunzip /usr/share/wordlists/rockyou.txt.gz to decompress it).

First things first, lets save the Hash Information into a file (so, just copy all the green text under the Hash Information section above).