Hi, within this lecture, we're going to continue working on the Sedol, and also we're going to show
you some other technique called unshowered.
OK, so I have talked about this before and we have seen we cannot chat DHC shadow file.
So in this lecture, we're going to see if we can get this out, how we can actually crack the password
of the root and become RWD in a way that we want.
So when we ran CEDO that well we have seen Apache too is in this list.
So if you actually search for a patch or two, you can see this we can use a patch to in order to chat
something out.
So how do we do that?
Let me show you, you can't run pseudo user Espina Panchita.
And if you can use Desh F like this, you can check this out.
As you can see, we managed to get the ETSI password over here.
So even though it's not ideal to use this, we managed to get the first line right.
So if I do Kedzie Password, I can just see whole thing.
OK, so there is no point using Apache to to just get the first line of the ETSI password file.
Right, because I can already get all of it.
But in this case we already had the permission of Azzi password, but we don't have the permission of
Etsi Shadow, for example, as user.
Right.
So rather than doing this on ETSI password, maybe we can do this on its shadow.
Right, because since we are using this with pseudo with an escalated privilege, then it means that
we can get the first line.
And here you go.
This is the shadow file, this is the ETSI Shadow.
So you can try this on your own calendar as well in order to see your own ETSI shadow if you become
route and if you just cut the azzi shadow, you can see what kind of things that you get and this is
the thing that you get.
OK, so let me show you one more time.
If we do that C password, we have this over here.
So this is route and this is the password of the route.
OK, so this is the password of the route represented by X in the ATSE password.
So now we know that this is the password and there are a couple of other parameters over here.
OK, like this.
So these are for the expiry of the password and for other parameters as well.
But we are actually interested in the password itself.
So I'm going to copy this and I'm going to show you something that you should do.
Even though we know the hash right now, it's very obvious.
I'm going to show you a proper way of doing this.
I'm going to copy this, OK?
And I'm going to open a new tab over here so that I can go into the documents and into the CTF folder
that we have been previously working on.
And I'm going to create a new directory over here.
And you can call this anything you want.
I'm going to call this try help me get the CD into that to just create a new file over here.
So I'm going to say NENO not static and I'm going to actually not not start.
Let me just do this one more time because we need a very explicit name over here.
So I'm going to come back and see.
Yep, it didn't create that.
So I'm going to call this something like shadow, OK, shadow of the text and I'm going to paste this
in.
So this is the shadow output.
So I'm going to save this with control or interim control x and here we have the shadow that texte.
So I'm going to create a password that the steps that we did at the exterior here and I'm going to copy
the pasta with Deol put over there like this.
OK, I'm going to copy this and just pasted over here.
So here you go.
I'm going to save this as well.
So what have I have I done?
I have two files right now, one of which contains the password file and other one contains the shadow
file.
Now, since I have only one line, I can actually skip the step, but I want to show you this and shadow
command.
So this is a way to combine these files and put it together to see the whole picture.
Right now, since we have one line, it's.
Easy, but if you had, like, maybe 50 lines for password file and 50 lines for the shadow file, it
might be hard for you to combine them and put the passwords in the right place to match, make it match
them together.
So Unshattered Command does this for you.
All you have to do is just write this unscheduled password and shadow that text.
And here you go.
We have the output.
So it combines the two file together and here we have the output.
So as you can see, we actually have an output very similar to Shadow that you see.
But again, since we have only one line, it seems very easy for us.
But if we had multiple lines, then it would get hard for us to do that.
Once we do this, once we get the Unshattered file or Unshattered output over here, we can try and
attempt to decrypt this hash over here in order to find the passwords of the route.
So this is the password.
Of course, it is hashed and we need a way to decrypt this.
So what we can do, we can use a lot of different tools in order to try and decrypt this.
OK, I'm going to show you, of course, the most popular one so that you can try this on your own as
well.
And once you get this, it would be incredibly easy for you to become root.
All you have to do is just run through route or through the route or pseudo through in order to give
the route password and escalate your privilege.
So maybe you can you may want to just take in all of this, just save this, copy this and save it into
a file.
The shadow output.
Since I already have a very simple line, I'm just going to get this password over here and work with
that, OK?
Because this is the same thing eventually that I get from carrying the shadow that text.
So I'm going to come back to Google dot com and I'm going to say crack root password or crack password
hash Linux.
OK, like this.
So if if you just search for it, you will be presented with some kind of tutorials like one hundred
and fifty five hundred thousand resize, one million and 500000 results over a year.
So if you go to medium dot com, for example, any of the tutorials, you can see some kind of alternatives.
Let me see one.
Let me just show you what it's going on over here.
So as you can see, it shows the output of the ATSE password and it's the shadow file.
And it says that you can use the John the Ripper and the hash cat.
So if you took the complete article hacking, I believe we have seen hash cat over there.
So here you go.
There is one example over here.
So it says that cracking hashes with John the Ripper.
So if you come over here, you can see all the steps in order to crack the hash.
It does the eyeshadow thing.
We have already done that.
So it actually saved the output into something called password that maybe we can do that as well.
So this is the output of the shadow file.
Maybe you remember that.
OK, so as you can see, John the Ripper, John, is a tool that comes preinstalled with colors.
So you can actually use this.
So you can say John Dash, Dash, wordlist and provide the word list and just run this against the password
of Texte.
It will try and break the password if, if and only if your list contains the password.
Since this is hashed with a very secure algorithm, you need to actually use a word.
You cannot actually reverse it.
You can use a word list and you can get the real password out of it and this is a way to do it.
OK, so John Wordlist just provide our list and provide text file that you have saved that.
And then later on, you can say John Dashty show, and it will show you the result.
So over here we have the hash cat version over here as well.
So in order to do that, it says that hash cat dash five 500 and dash a zero dash.
Oh, this is for the output cracked out and hashes that you see.
And again, you need to provide the wordlist over here as well.
So as you can see, there are two ways, too many great ways in order to solve this problem.
So over here we see the parameter explanation of the hash cat as well.
That simple black flag specifies the mode that we want to use over here so the flag determines the attack
type, yada, yada, yada.
I believe you get the idea.
You can use either the hash cat and you can use the or the john the wrapper in your color, Linux,
depending on your choice.
So let's try one of these in our system and see if we can actually crack the password over here.
So I'm going to go for the John the Ripper over there.
You can try yourselves, but I'm going to go for this one.
OK, so we have the output, but we didn't put it into any kind of text over here.
As you can see, that's what it's doing in this line.
So I'm going to go back and let's see.
I'm going I'm going to go into my CTF folder one more time.
So try hack me.
So we have the password and the shadow so we can just run the command one more time.
So I shadow password, shadow texte.
It gives us this output.
If we actually just put this into any other text file like password Slutsky, then it will be put over
there.
So if I get this out I will get the exact same result back like this a year ago.
Now it's contained in our passwords or text.
So let's go to the next level over here.
So it says that just around the john with wordlist parameter over there and then run it against a password
that you see now since we know the password, I'm going to cut it, so I'm going to cut it easy, OK,
because I don't want to run this against like one million password wordlist.
OK, we already know the password and you understood how it works.
And of course, you know, there are a lot of berglas under user share wordlist folder.
OK, so I'm going to create a list of my own.
I'm going Ananova Wordless and I'm going to write some of the passwords that we're working with so we
know the real password.
I'm just going to go for these two are the four of the options over here.
Even though we made it too easy, it's just not worth the wait.
Right.
Because we need to understand how this works because we already know the password over here.
So I'm going to come up with this one and come over here and just pasted over there.
So rather than providing the square map or school map, however, you may want to pronounce this, I'm
going to just go for the world, start and run it against the password that you see.
So here you go.
It says that loaded one password hash.
And if you say, John, that dishdasha password files required by the non-specified.
So, yeah, we have to say John Dashty show passwords that texte and here you go.
It says that route is James.
One, two, three.
So it managed to crack this, as you can see.
So this was the let me come over here to the root and just give James one, two, three over here and
he'd enter.
If you if you see nothing is happening, it's fine.
It's for security purposes.
Just type it and hit enter.
Let me try this one more time.
OK, James.
One, two, three.
Yeah.
It says that password.
Try again.
Let me just run Tudorza and try one more time.
Let me give James one, two, three.
Yeah.
It doesn't work for some reason.
I believe we have to go for cheroot rather than pseudo root.
So I'm going to go for Cheroot and I'm just going to give the password.
And here you go now.
Re-route Yeah.
It was asking for the pseudo password, which is.
The user password, so if you're on the Who am I now via route?
Now, we managed to crack this by getting that see shadow and most of the time you won't actually get
to get that see shadow.
But if you see something like this in pseudo dash, Alice, then you can cut it out.
So I, I didn't even know we can cut things out with Apache to.
Of course, it's a quick Google search.
Right.
So while they were using the pseudo dash l'Est, make sure you Google it out and make sure you search
for ultra privileged how to do privacy escalation using this binary and it will give you the results.
So far, so good.
I believe this is time for us to stop here and continue within the next lecture with privilege escalation
as well.