~/apparatus/the-words-and-the-hashes.md

The words and the hashes

These pages are props, not lessons. No tier, no order, no exercise of their own. A lesson that names this page owes you the means, and this page pays.

The law travels with the props. Every hash on this page came from a lab account on a box its reader owns, and every wordlist is aimed at lab hashes. A hash from a machine you do not own is not a puzzle, it is evidence, and evidence belongs in a report.

The accounts, made

The exercise needs hashes, and hashes need accounts. Two commands, as root on the target:

# useradd -M -N l1a_weak
# echo 'l1a_weak:summer2024' | chpasswd

The -M skips the home directory because the account exists to carry a hash, not to log in. Repeat for a second account with a different password so the census has more than one line to find. On a modern Kali these hash with yescrypt. On an older box they hash with sha512crypt. Neither is a mistake, and which one you got is written in the line itself, next.

The hash, read

The shadow line tells you what it is before any tool asks. The tag between the first two dollar signs names the scheme:

$6$    sha512crypt, the long standing Linux default
$y$    yescrypt, the new default on current Debian and Kali
$1$    md5crypt, old, and every wordlist beats it
$2b$   bcrypt, common in application databases

Reading the tag first is the whole trick. It decides the tool invocation, and an old tool meeting a new tag loads nothing while sounding like it worked. When a crack loads zero hashes, the tag is the first thing to check.

The wordlist

On Kali the standard list is rockyou, and it ships as an archive, because the plain file is one hundred thirty nine million bytes. Find where the box keeps it, then unpack:

$ ls /usr/share/wordlists/
# gunzip /usr/share/wordlists/rockyou.txt.gz

Some installs carry it at that path, some carry a wordlists package that has to be installed first, and the listing is how you tell which box you are on. Nothing in the tree says gunzip, and the absent file is a wall that looks like a missing prop. It is not. The archive, or the package that carries it, is the prop. For a first run, a hand written list of ten likely passwords teaches the same lesson in seconds instead of minutes:

$ printf 'password\nletmein\nsummer2024\ntrustno1\n' > words.txt

The exercise is the ratio between finding and cracking. A small list keeps the ratio honest and the receipt fast.

The crack, two lanes

John runs on any box and wants the passwd and shadow joined:

# unshadow /etc/passwd /etc/shadow > hashes.txt
# john --wordlist=words.txt hashes.txt
# john --show hashes.txt

The unshadow step joins what the split of lesson 035 separated. --wordlist points at the list. --show prints what cracked, as user colon password lines. If the target hashes are yescrypt and the box's john predates yescrypt, john --list=formats says so, and the fix is a newer john, not a longer wordlist.

Hashcat is the fast lane and it wants a mode number, not a name. The mode follows the hash format, never the tool that made it. The format follows where the hash came from:

/etc/shadow, $6$      mode 1800
a Windows NTLM dump   mode 1000
a Kerberos roast      mode 13100

That is a rule with three worked rows, not a lookup table to memorize. The format is named by the source you pulled it from, the mode is named by the format, and a row for a source nobody listed is derived the same way the three above were.

$ hashcat -m 1800 -a 0 one.hash words.txt

On a laptop without an OpenCL runtime hashcat refuses to start and prints a message about drivers. That refusal is the moment john is the right answer, not a failure.

The success signal

A crack worked when --show or hashcat's status prints the password beside the user it belongs to. The receipt to write down for the ratio exercise is two timestamps: when the shadow line was found, and when the password printed. The first is the finding. The second is the confirmation. Everything this tier argues about defense lives in the gap between them, or in the absence of one.

Cleanup

The accounts were made for the exercise and they retire with it:

# userdel l1a_weak

A lab that accumulates practice accounts is a census that will confuse the next exercise. Delete what the lesson created, and the shadow file goes back to telling the truth about who belongs.