nerdexam
GIAC

GPEN · Question #487

You have obtained the hash below from the /etc/shadow file. What are you able to discern simply by looking at this hash?

The correct answer is C. A4XDsB4COGqWaEpFjLLDe. is an MD5 hash that was created using the salt uWeOhL6k. The Linux /etc/shadow hash format uses $ delimiters to encode the algorithm ID, salt, and hash value, allowing an analyst to identify the hash type and salt by visual inspection.

Exploitation & Post-Exploitation Techniques

Question

You have obtained the hash below from the /etc/shadow file. What are you able to discern simply by looking at this hash?

Options

  • AA4XD$B4COCqWaEpFjLLDe. is a SHAI hash that was created using the salt $1
  • BA4XD$B4COCqWaEpFjLLDe. is an MD5 hash that was created using the salt $1
  • CA4XDsB4COGqWaEpFjLLDe. is an MD5 hash that was created using the salt uWeOhL6k
  • DA4XDsB4COCqWaEpFjLLDe. is a SHAI hash that was created using the salt uweohL6k

How the community answered

(39 responses)
  • A
    5% (2)
  • B
    5% (2)
  • C
    77% (30)
  • D
    13% (5)

Why each option

The Linux /etc/shadow hash format uses $ delimiters to encode the algorithm ID, salt, and hash value, allowing an analyst to identify the hash type and salt by visual inspection.

AA4XD$B4COCqWaEpFjLLDe. is a SHAI hash that was created using the salt $1

SHA1 is not represented by the $1$ identifier in /etc/shadow; $1$ is the POSIX crypt designator specifically for MD5, not SHA1.

BA4XD$B4COCqWaEpFjLLDe. is an MD5 hash that was created using the salt $1

While MD5 is correctly identified, stating the salt is $1$ is wrong - $1$ is the algorithm identifier field, not the salt; the salt is the separate uWeOhL6k value.

CA4XDsB4COGqWaEpFjLLDe. is an MD5 hash that was created using the salt uWeOhL6kCorrect

In the /etc/shadow crypt format, the structure is $id$salt$hash where $1$ is the algorithm identifier for MD5. The salt is the value between the second and third dollar signs - in this case uWeOhL6k - and the remaining portion A4XDsB4COGqWaEpFjLLDe. is the resulting MD5 hash of the password combined with that salt.

DA4XDsB4COCqWaEpFjLLDe. is a SHAI hash that was created using the salt uweohL6k

SHA1 is not a standard crypt algorithm identifier in the /etc/shadow format, and the salt value is case-sensitive so lowercasing it would produce an incorrect identification.

Concept tested: Linux /etc/shadow hash format algorithm and salt identification

Source: https://www.man7.org/linux/man-pages/man3/crypt.3.html

Topics

#/etc/shadow#MD5 crypt#password hash identification#Linux authentication

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GPEN Practice