GSEC · Question #342
Use Hashcat to crack a local shadow file. What Is the password for the user account AGainsboro? - The shadow file (shadow) and Hashcat wordlist (gsecwordlist.txt) are located in the directory /home…
The correct answer is E. QX689PJ688. Hashcat run in straight mode (-a 0) with MD5crypt hash type (-m 500) against the shadow file and wordlist reveals QX689PJ688 as the cracked password for AGainsboro.
Question
Use Hashcat to crack a local shadow file. What Is the password for the user account AGainsboro?
- The shadow file (shadow) and Hashcat wordlist (gsecwordlist.txt) are located in the directory
/home /giac /PasswordHashing/
- Run Hashcat in straight mode (flag -a 0) to crack the MD5 hashes (flag -m 500) In the shadow
file.
- Use the hash values from the Hashcat output file and the shadow file to match the cracked
password with the user name.
- If required, a backup copy of the original files can be found in the shadowbackup directory.
Options
- A52345234
- BYOuRF ether?
- Csymbiote
- DVolcano
- EQX689PJ688
- FLlqMM@qe
- GNoregrets2
- HLearn2Write
- ITh 3D5@60n
- Jjason66
How the community answered
(41 responses)- B5% (2)
- C7% (3)
- D2% (1)
- E83% (34)
- F2% (1)
Why each option
Hashcat run in straight mode (-a 0) with MD5crypt hash type (-m 500) against the shadow file and wordlist reveals QX689PJ688 as the cracked password for AGainsboro.
52345234 is the cracked password for a different user account in the shadow file, not AGainsboro.
YOuRF ether? is the cracked password for a different user account in the shadow file.
symbiote corresponds to a different account's hash in the shadow file.
Volcano is the cracked password belonging to a different user account, not AGainsboro.
Running 'hashcat -a 0 -m 500 shadow gsecwordlist.txt' processes each MD5crypt ($1$) hash in the shadow file against the wordlist; the hash entry associated with the AGainsboro account is successfully cracked to QX689PJ688. Matching the cracked hash in the Hashcat output file back to the corresponding username line in the shadow file confirms this association.
LlqMM@qe is the cracked result for a different username entry in the shadow file.
Noregrets2 is the cracked password for a different account in this particular shadow file.
Learn2Write corresponds to a different user's MD5crypt hash in the shadow file.
Th 3D5@60n is the cracked password for a different account in the shadow file.
jason66 is the cracked result for a different user account, not AGainsboro.
Concept tested: Hashcat dictionary attack on MD5crypt shadow hashes
Source: https://hashcat.net/wiki/doku.php?id=hashcat
Topics
Community Discussion
No community discussion yet for this question.