Hack Like a Pro: How to Crack User Passwords in a Linux System « Null Byte :: WonderHowTo

Welcome back, my eager hackers!In recent blogs, I've demonstrated how to grab password hashes remotely usingMetasploit'smeterpreterandpwdump. Once we have the Windows passwords from the SAM file, we can then crack these hashes using tools such as Cain and Abel.In this article, we'll look at how to grab the password hashes from a Linux system and crack the hashes using probably the most widely used password cracking tool out there,John the Ripper.Let's boot upBackTrackand get hacking!Where Linux Passwords Are StoredLinux passwords are stored in the/etc/passwdfile in cleartext in older systems and in/etc/shadowfile in hash form on newer systems. We should expect that the passwords on anything other than old legacy systems to be stored in/etc/shadow.Step 1: Create Some User AccountsSince our BackTrack system probably doesn't have many users on it other than our root account, let's go ahead and create a couple more accounts.Let's createuser1with password "flower" anduser2with a password of "hacker".I've purposely chosen dictionary words as the complexity of the password is inversely related to the time necessary to crack it. One of the nice features of John the Ripper is that it will try to use a dictionary attack first. If that fails, it will try a hybrid attack. And only if that fails will it attempt a brute-force attack, which is the most time consuming.Step 2: Open John the RipperNow that we have a couple of regular users in our system with simple passwords, we now need to open John the Ripper. John the Ripper is a simple, but powerful password cracker without a GUI (this helps to make it faster as GUIs consume resources).We can access it from BackTrack by going to theBackTrackbutton on the bottom left, thenBacktrack,Privilege Escalation,Password Attacks,Offline Attacks, and finally selectJohn the Ripperfrom the multiple password cracking tools available.If you selected the correct menu item, it will open a terminal that looks like this.By the way, feel free to close our previous terminal as we're finished with it.Step 3: Test John the RipperAt the prompt, type:bt > john -testThis command will send John the Ripper through a variety of benchmark tests to estimate how long it will take to break the passwords on your system. Your terminal will look something like this.Now that John has estimated how long each of the encryption schemes will take to crack, let's put him to work on cracking our passwords.Step 4: Copy the Password Files to Our Current DirectoryLinux stores its passwords in/etc/shadow, so what we want to do is copy this file to our current directory along with the/etc/passwdfile, then "unshadow" them and store them in file we'll callpasswords. So, let's type both:bt > cp /etc/shadow ./bt > cp /etc/passwd ./In Linux, thecpcommand means copy and the./represents our current directory. So this command says, copy the contents of /etc/shadow to my current directory. We do the same for the /etc/passwd file.Step 5: UnshadowNext we need to combine the information in the /etc/shadow and the /etc/passwd files, so that John can do its magic.bt > ./unshadow passwd shadow > passwordsStep 6: Crack!Now that we have unshadowed the critical files, we can simply let John run on our password file.bt > john passwordsJohn the Ripper will proceed to attempt to crack your passwords. As you can see, it cracked all three of ours in a matter of seconds! Of course, more complex passwords will take significantly more time, but all we need is just one user with a simple password and we have access to the account in seconds.It's also important to note that any password cracker is only as good as its word list. For more complex or hybrid passwords, you probably want to use a password list containing far more passwords, including hybrid passwords such "p@$$w0rd" that combine special characters into words.We'll be doing more password cracking among numerous other hacks, so keep coming back! And if you have any questions, feel free to comment below or head to theNull Byte forumfor help.Cut lock photoby Fristle,Lock cutters photoby MortenMyksvollWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHack Like a Pro:How to Grab & Crack Encrypted Windows PasswordsHack Like a Pro:How to Crack Passwords, Part 1 (Principles & Technologies)How To:Recover Passwords for Windows PCs Using OphcrackHow To:Crack Shadow Hashes After Getting Root on a Linux SystemHack Like a Pro:How to Hack Facebook (Facebook Password Extractor)How to Hack Wi-Fi:Selecting a Good Wi-Fi Hacking StrategyNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)Hack Like a Pro:How to Remotely Grab Encrypted Passwords from a Compromised ComputerHack Like a Pro:How to Crack Passwords, Part 2 (Cracking Strategy)Hack Like a Pro:Finding Potential SUID/SGID Vulnerabilities on Linux & Unix SystemsHow to Hack Like a Pro:Getting Started with MetasploitHow To:Crack WPA & WPA2 Wi-Fi Passwords with PyritHack Like a Pro:Metasploit for the Aspiring Hacker, Part 6 (Gaining Access to Tokens)How to Hack Wi-Fi:Cracking WPA2-PSK Passwords Using Aircrack-NgHack Like a Pro:How to Crack Passwords, Part 3 (Using Hashcat)How To:Hack a Windows 7/8/10 Admin Account Password with Windows MagnifierHack Like a Pro:How to Hack Remote Desktop Protocol (RDP) to Snatch the Sysadmin PasswordHack Like a Pro:How to Crack Passwords, Part 4 (Creating a Custom Wordlist with Crunch)How To:Hack WPA WiFi Passwords by Cracking the WPS PINHack Like a Pro:How to Crack Online Passwords with Tamper Data & THC HydraHow To:Hack Mac OS X Lion PasswordsHow To:How Hackers Take Your Encrypted Passwords & Crack ThemRainbow Tables:How to Create & Use Them to Crack PasswordsHow To:Recover WinRAR and Zip PasswordsHow To:Remove a Windows Password with a Linux Live CDHow To:Bypass Windows and Linux PasswordsHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterHow To:GPU Accelerate Cracking Passwords with HashcatHow To:Make an Unbreakable Linux Password Using a SHA-2 Hash AlgorithmSecure Your Computer, Part 2:Password-Protect the GRUB Bootloader on Dual-Booted PCsNews:Advanced Cracking Techniques, Part 1: Custom DictionariesSecure Your Computer, Part 1:Password-Protect your BIOS Boot ScreenHow To:Fix the Channel -1 Glitch in Airodump on the Latest KernelNews:Get the Perfect Cup of Java with a DIY Linux-Powered Coffee RoasterHow To:Run Windows from Inside LinuxHow To:How Hackers Steal Your Internet & How to Defend Against ItHow To:Recover a Windows Password with Ophcrack