# Crack the Hash {% embed url="" %} ## ## Task 1: Level 1 ### 48bb6e862e54f2a795ffc4e541caed4d * Before we crack the hash we have to find its type. * Using `hash-identifier` we can identify the possible hash type. ``` $ hash-identifier 48bb6e862e54f2a795ffc4e541caed4d -------------------------------------------------- Possible Hashs: [+] MD5 [+] Domain Cached Credentials - MD4(MD4(($pass)).(strtolower($username))) ``` * Let's save the hash to a file. ``` $ echo "48bb6e862e54f2a795ffc4e541caed4d" > hash1.txt ``` * Now we have to find the hash-mode for a MD5 hash.

* We are now ready to crack the hash using `hashcat`. ``` $ hashcat -a 0 -m 0 hash1.txt /usr/share/wordlists/rockyou.txt 48bb6e862e54f2a795ffc4e541caed4d:easy ``` * We can also crack the hash using `john`. ``` $ john --format=Raw-MD5 --wordlist=/usr/share/wordlists/rockyou.txt hash1.txt Using default input encoding: UTF-8 Loaded 1 password hash (Raw-MD5 [MD5 128/128 SSE2 4x3]) Warning: no OpenMP support for this hash type, consider --fork=3 Press 'q' or Ctrl-C to abort, almost any other key for status easy (?) 1g 0:00:00:00 DONE (2023-12-08 21:44) 5.000g/s 862080p/s 862080c/s 862080C/s erinbear..eagames Use the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably Session completed. ``` ### Answer ``` easy ``` ### ### CBFDAC6008F9CAB4083784CBD1874F76618D2A97 * Let's identify the hash type using `hash-identifier`. ``` $ hash-identifier CBFDAC6008F9CAB4083784CBD1874F76618D2A97 -------------------------------------------------- Possible Hashs: [+] SHA-1 [+] MySQL5 - SHA-1(SHA-1($pass)) ``` * The mode for SHA-1 in `hashcat` is `100`.

``` $ hashcat-a 0 -m 100 hash2.txt /usr/share/wordlists/rockyou.txt cbfdac6008f9cab4083784cbd1874f76618d2a97:password123 ``` * We can crack the hash now using the `Raw-SHA1` format for `john`. ``` $ john --format=Raw-SHA1 --wordlist=/usr/share/wordlists/rockyou.txt hash2.txt Using default input encoding: UTF-8 Loaded 1 password hash (Raw-SHA1 [SHA1 128/128 SSE2 4x]) Warning: no OpenMP support for this hash type, consider --fork=3 Press 'q' or Ctrl-C to abort, almost any other key for status password123 (?) 1g 0:00:00:00 DONE (2023-12-08 21:49) 7.142g/s 9885p/s 9885c/s 9885C/s liberty..password123 Use the "--show --format=Raw-SHA1" options to display all of the cracked passwords reliably Session completed. ``` ### Answer ``` password123 ``` ### ### 1C8BFE8F801D79745C4631D09FFF36C82AA37FC4CCE4FC946683D7B336B63032 * We can crack the hash using `hash-identifier`. ``` $ hash-identifier 1C8BFE8F801D79745C4631D09FFF36C82AA37FC4CCE4FC946683D7B336B63032 -------------------------------------------------- Possible Hashs: [+] SHA-256 [+] Haval-256 ``` * Let's save it to a file. ``` $ echo "1C8BFE8F801D79745C4631D09FFF36C82AA37FC4CCE4FC946683D7B336B63032" > hash3.txt ``` * The mode for SHA-256 in `hashcat` is `1400`.

``` $ hashcat -a 0 -m 1400 hash3.txt /usr/share/wordlists/rockyou.txt 1c8bfe8f801d79745c4631d09fff36c82aa37fc4cce4fc946683d7b336b63032:letmein ``` * The format for `john` will be `Raw-SHA256`. ``` $ john --format=Raw-SHA256 --wordlist=/usr/share/wordlists/rockyou.txt hash3.txt Using default input encoding: UTF-8 Loaded 1 password hash (Raw-SHA256 [SHA256 128/128 SSE2 4x]) Warning: poor OpenMP scalability for this hash type, consider --fork=3 Will run 3 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status letmein (?) 1g 0:00:00:00 DONE (2023-12-08 21:53) 16.66g/s 409600p/s 409600c/s 409600C/s 123456..280789 Use the "--show --format=Raw-SHA256" options to display all of the cracked passwords reliably Session completed. ``` ### Answer ``` letmein ``` ### ### $2y$12$Dwt1BZj6pcyc3Dy1FWZ5ieeUznr71EeNkJkUlypTsgbX1H68wsRom * `hash-identifier` is not able to identify the type of this hash. * We will have to use another tool called Hash Analyzer.

* The hash-mode for Bcrypt is `3200`. * We know that the password is four characters long, so let's filter the `rockyou.txt` file. ``` $ egrep -x '.{4}' /usr/share/wordlists/rockyou.txt > filtered.txt ``` * Our filtered list only has passwords that are 4 characters long. * We can now use this filtered list to crack the hash. ``` $ hashcat -a 0 -m 3200 hash4.txt filtered.txt -w 4 -S $2y$12$Dwt1BZj6pcyc3Dy1FWZ5ieeUznr71EeNkJkUlypTsgbX1H68wsRom:bleh ``` ### Answer ``` bleh ``` ### ### 279412f945939ba78ce0758d3fd83daa * Let's identify the type using Hash Analyzer.

* This time let's use CrackStation to crack the hash.

### Answer ``` Eternity22 ``` ## ## Task 2: Level 2 ### Hash: F09EDCB1FCEFC6DFB23DC3505A882655FF77375ED8AA2D1C13F640FCCC2D0C85 * Let's use `hash-identifier` to get the hash type. ``` $ hash-identifier F09EDCB1FCEFC6DFB23DC3505A882655FF77375ED8AA2D1C13F640FCCC2D0C85 -------------------------------------------------- Possible Hashs: [+] SHA-256 [+] Haval-256 ``` * Since we know that the mode for SHA-256 is `1400`, let's just try that first. ``` $ hashcat -a 0 -m 1400 hash6.txt /usr/share/wordlists/rockyou.txt f09edcb1fcefc6dfb23dc3505a882655ff77375ed8aa2d1c13f640fccc2d0c85:paule ``` ### Answer ``` paule ``` ### ### Hash: 1DFECA0C002AE40B8619ECF94819CC1B * CrackStation gives us the password.

### Answer ``` n63umy8lkf4i ``` ### ### Hash: $6$aReallyHardSalt$6WKUTqzq.UQQmrm0p/T7MPpMbGNnzXPMAXi4bJMl9be.cfi3/qxIf.hsGpS41BqMhSrHVXgMpdjS6xeKZAs02. Salt: aReallyHardSalt * The `$6$` tells us that this is a SHAcrypt512 hash the mode for which is `1800`.

* This time we have to filter for passwords that six characters long. ``` $ egrep -x '.{6}' /usr/share/wordlists/rockyou.txt > filtered.txt ``` * Let's run `hashcat` with the correct mode. ``` $ hashcat -m 1800 hash7.txt filtered.txt -w 4 -S $6$aReallyHardSalt$6WKUTqzq.UQQmrm0p/T7MPpMbGNnzXPMAXi4bJMl9be.cfi3/qxIf.hsGpS41BqMhSrHVXgMpdjS6xeKZAs02.:waka99 ``` ### Answer ``` waka99 ``` ### ### Hash: e5d8870e5bdd26602cab8dbe07a942c8669e56d6 Salt: tryhackme * Let's identify the hash using `hash-identifier`. ``` $ hash-identifier e5d8870e5bdd26602cab8dbe07a942c8669e56d6 -------------------------------------------------- Possible Hashs: [+] SHA-1 [+] MySQL5 - SHA-1(SHA-1($pass)) ``` * For SHA-1, the mode we will be using is `160`. ``` $ hashcat -a 0 -m 160 'e5d8870e5bdd26602cab8dbe07a942c8669e56d6:tryhackme' /usr/share/wordlists/rockyou.txt e5d8870e5bdd26602cab8dbe07a942c8669e56d6:tryhackme:481616481616 ``` ### Answer ``` 481616481616 ```