GSEC · Question #343
Use Hashcat to crack a local shadow file. What Is the password for the user account AGainsboro? - The shadow file (shadow) and Hashcat wordlist (gsecwordlist.txt) are located in the directory.home…
The correct answer is D. Noregrets2. Hashcat in straight mode (-a 0) with MD5crypt (-m 500) cracks the shadow file hashes; matching the output to AGainsboro's entry yields Noregrets2.
Question
Use Hashcat to crack a local shadow file. What Is the password for the user account AGainsboro?
- The shadow file (shadow) and Hashcat wordlist (gsecwordlist.txt) are located in the
directory.home giac PasswordHashing
- Run Hashcat in straight mod* (flag -a 0) to crack the MD5 hashes (flag -m 500) in the shadow
file.
- Use the hash values from the Hashcat output file and the shadow file to match the cracked
password with the user name.
- If required, a backup copy of the original files can be found in the shadowbackup directory.
Options
- AJ3@nGr3y
- BWwBoj25tT7
- CMsconfiG35
- DNoregrets2
- EHowAreWeToday?19
- FPrometheus
- G6dWalking8
- HIM-O-O-NI
- Iyoshiro392
- JMEWRULES
How the community answered
(28 responses)- B7% (2)
- D79% (22)
- G4% (1)
- J11% (3)
Why each option
Hashcat in straight mode (-a 0) with MD5crypt (-m 500) cracks the shadow file hashes; matching the output to AGainsboro's entry yields Noregrets2.
J3@nGr3y is the cracked password for a different user account in this shadow file instance.
WwBoj25tT7 corresponds to the hash of a different username entry in the shadow file.
MsconfiG35 is the cracked result for a different account, not AGainsboro.
Running 'hashcat -a 0 -m 500 shadow gsecwordlist.txt' iterates the wordlist against each $1$ hash in the shadow file; the hash linked to the AGainsboro account decrypts to Noregrets2. Cross-referencing the Hashcat output file with the original shadow file by hash value confirms Noregrets2 belongs to AGainsboro.
HowAreWeToday?19 is the cracked password belonging to a different user in this shadow file.
Prometheus corresponds to a different account's MD5crypt hash in the shadow file.
6dWalking8 is the cracked password for a different username in the shadow file.
IM-O-O-NI is the cracked result for a different account, not AGainsboro.
yoshiro392 is the cracked password for a different user account in the shadow file.
MEWRULES corresponds to a different user's hash in the shadow file, not AGainsboro.
Concept tested: Hashcat dictionary attack on MD5crypt shadow hashes
Source: https://hashcat.net/wiki/doku.php?id=hashcat
Topics
Community Discussion
No community discussion yet for this question.