WEBVTT 00:00:00.040 --> 00:00:02.540 There are two important files which we need when we 00:00:02.540 --> 00:00:04.300 want to crack Linux passwords, 00:00:04.640 --> 00:00:08.550 the first being the passwd file and the second being the shadow file. 00:00:09.030 --> 00:00:12.630 The passwd file stores essential information, which is required during login. 00:00:12.630 --> 00:00:17.230 It is a plain‑text file and contains a list of system accounts, 00:00:17.280 --> 00:00:19.130 and it holds some useful information. 00:00:19.300 --> 00:00:21.520 This file should have general read permission, 00:00:21.520 --> 00:00:25.950 as many command utilities use it to map user IDs to usernames. 00:00:26.500 --> 00:00:30.280 Each field in the password entry is separated with the colon character. 00:00:30.690 --> 00:00:33.060 Let's navigate now through each of these fields, 00:00:33.510 --> 00:00:35.450 the first being the username field. 00:00:36.120 --> 00:00:40.250 Next, we have the password field, and generally in the password file, 00:00:40.250 --> 00:00:42.460 this is represented by an x. 00:00:42.750 --> 00:00:45.920 Proceeding that, we have the user ID and group ID. 00:00:45.920 --> 00:00:48.550 Following that, we have the full name of the user, 00:00:49.040 --> 00:00:51.250 and then we have the user's home directory, 00:00:51.800 --> 00:00:53.650 and the user's shell account. 00:00:54.650 --> 00:00:56.050 Next, we have the shadow file, 00:00:56.300 --> 00:01:00.950 which stores the passwords of the various user accounts in an encrypted format. 00:01:01.110 --> 00:01:04.450 It contains additional properties related to the user's password, 00:01:04.560 --> 00:01:05.470 which we will explore. 00:01:05.470 --> 00:01:08.980 In this file, all fields are separated by the colon symbol, 00:01:09.170 --> 00:01:10.560 similar to the password file. 00:01:10.970 --> 00:01:13.000 The first piece we have is the username. 00:01:13.770 --> 00:01:17.960 Next, we have the hashing algorithm salt, which is used in the password. 00:01:18.190 --> 00:01:24.490 For example, if a SHA512 hash was used, the salt would represent $6$, 00:01:24.690 --> 00:01:25.980 which I will show you in the demo. 00:01:26.380 --> 00:01:28.670 Following this, we have the password hash. 00:01:29.280 --> 00:01:32.520 Next, we have the number of days since the password was last changed, 00:01:33.040 --> 00:01:36.700 and then we have the number of days before the password may be changed. 00:01:36.740 --> 00:01:41.310 In this case, the 0 indicates that the password may be changed at any time. 00:01:42.090 --> 00:01:45.610 Following this, we have the number of days until the password expires. 00:01:45.680 --> 00:01:48.200 If there's a value of multiple 9's, 00:01:48.840 --> 00:01:52.980 this indicates that the user can keep his password unchanged for many years, 00:01:53.390 --> 00:01:55.030 which really is not a good practice. 00:01:55.290 --> 00:01:56.150 Following this, 00:01:56.160 --> 00:02:00.300 we have the number of days to warn a user of an expiring password. 00:02:00.550 --> 00:02:02.570 If values were present after this field, 00:02:02.680 --> 00:02:05.330 it would represent a number of days after the password 00:02:05.330 --> 00:02:07.430 expiry that the account is disabled, 00:02:07.430 --> 00:02:10.320 the number of days that the account has been disabled, 00:02:10.320 --> 00:02:13.880 and any reserved fields for possible future use. 00:02:14.420 --> 00:02:15.200 In this demonstration, 00:02:15.200 --> 00:02:18.520 we will take a look now at how we can use the password 00:02:18.520 --> 00:02:20.730 and shadow files of our Linux machine, 00:02:20.790 --> 00:02:23.850 and leverage John to crack those password hashes. 00:02:24.260 --> 00:02:25.050 Let's dive in. 00:02:25.710 --> 00:02:28.190 I have already copied both the shadow and password 00:02:28.190 --> 00:02:29.920 file to my Kali Linux machine. 00:02:30.910 --> 00:02:34.390 In order to make it usable with John, I need to first merge the two, 00:02:34.840 --> 00:02:37.590 and to do this, I'm going to use the command unshadow, 00:02:37.590 --> 00:02:40.810 followed by the passwd file and the shadow file, 00:02:40.810 --> 00:02:45.500 and I'm going to output this to a file called linuxhashes.txt. 00:02:45.500 --> 00:02:50.540 Now I can view this file by typing more linuxhashes.txt, 00:02:50.540 --> 00:02:54.540 and you can see it has merged both the username and the 00:02:54.540 --> 00:02:56.810 password hash into one single file. 00:02:56.880 --> 00:02:59.900 You will notice that the specific system has encrypted the 00:02:59.900 --> 00:03:02.630 passwords using two different hash types, 00:03:02.630 --> 00:03:07.040 as depicted by the $1$ and the $6$. 00:03:07.390 --> 00:03:09.850 Now let's use John to crack these hashes. 00:03:09.850 --> 00:03:14.730 I'll issue the command john, followed by a pot file of linuxhashes.pot, 00:03:14.730 --> 00:03:18.160 I'm going to define my word list, 00:03:18.310 --> 00:03:21.620 which is a custom word list I have used called rockyou, 00:03:21.680 --> 00:03:25.870 and I have pre‑mangled this word list with a couple of rules from John, 00:03:25.880 --> 00:03:29.260 and I'm going to define the linuxhashes.txt file, 00:03:29.260 --> 00:03:30.770 which we've used previously. 00:03:32.040 --> 00:03:34.360 You will notice that just one password was cracked, 00:03:34.980 --> 00:03:37.650 and this is the MD5 password that was cracked. 00:03:38.270 --> 00:03:41.480 There are additional passwords, which are SHA512, 00:03:42.020 --> 00:03:45.690 and in order to crack those, we will need to issue the format SHA512crypt. 00:03:45.690 --> 00:03:49.690 So I'm going to issue the same command, and this time, 00:03:49.690 --> 00:03:53.390 I'm going to define a format of SHA512crypt. 00:03:53.390 --> 00:03:56.290 And this time, I've got a lot more success, 00:03:56.300 --> 00:03:58.710 I'm able to crack the passwords for both Jeffblue, 00:03:58.710 --> 00:04:02.550 remote_admin, and the samiraa and helpdesk account. 00:04:02.940 --> 00:04:07.330 If I issue the command john, followed by show linuxhashes.txt, 00:04:07.340 --> 00:04:10.580 and I will come to define the pot file, 00:04:12.580 --> 00:04:15.190 I will now be able to see all of the passwords that have been 00:04:15.190 --> 00:04:17.980 cracked and that are stored in the pot file. 00:04:18.170 --> 00:04:19.120 In this demonstration, 00:04:19.200 --> 00:04:22.140 you have learned how to leverage John to crack multiple types 00:04:22.140 --> 00:04:24.550 of password hashes within a Linux machine.