In this video, you will learn how to perform password hash
extractions from Lennox B systems.
I hope you excited. So let's dive on in.
To get started with this exercise. Please ensure you
have booted your metasploitable to virtual machine.
I'll ensure your Carly Linux virtual
machine is up and running.
Once already let's open our terminal
on cardi Linux and will perform
a network scan to determine the
IP address of our Target system, which is metasploitable, too.
To perform the scan we'll perform a ping scan. So
we'll type and map space Dash
SN followed by the network ID
or for pen test Network like
so the sky will take a few seconds to complete
and it will provide us with the targets
machine IP address.
Currently our Target system. It is 172 tt137.
So I'm going to copy this IP address.
And now let's start, Metasploit.
We'll type msf console like so and hit enter.
If you recall in the previous section, we had
found a FTP security flow within
all metasploitable 2 virtual machine. Therefore
will exploit that security flow. So
we'll gain access into that system. Once
we gain access then we'll try to extract the
passwords use accounts and then perform the password
cracking on those password hashes.
To exploit the target system will switch for vs.
Ftpd for any sort
of exploit module like so create and
this time we will type use like
so
exploit / Unix
FTP slash
vs. Ftpd
underscore two three, four underscore back
door and hit enter great.
Now we'll type set.
Our host like so followed by
the IP address of our Target system and
hit enter.
Once you are ready to exploit a system simply type exploit
and press enter create.
And we have successfully found a shell.
But we don't see anything.
Let's type.
ifconfig
Actually, let's type. Who am I under enter
we have sent who am I and we have gotten the
response that says root.
We can simply piece in this python code like so
and hit enter and now we have gotten a shell
that is a bit more recognizable to us since we
have got any shell with root privileges. We can
access a shadow file the shadow file will contain
a list of usernames and passwords that
are stored on this target system.
To find the shadow file we can simply type cut slash
Etc / Shadow like
Soo card will simply display the contents
of this file force on screen.
Simply hit enter.
And greet. We have a list of user accounts
together with their password hashes.
Let's copy all of these user accounts.
I'm going to open the text edit on
Kali Linux like so
and I'm going to piece all of these contents within it.
Next I'm going to save this file. I'm going to click on file.
Going to click on save us.
And let's see if this file.
as user
underscore
harshes like so the txt.
and simply click on see if
and it seems as do I have this already so I'm
going to replace it.
Great.
So not you have extracted a list
of users and the Apostle caches. Let's open
a new terminal.
We can use John the Ripper to perform
password cracking on these password hashes.
So therefore we can get a plain text password for
our Target system and we already have
the user accounts as well.
to use John let's type John like so
you can simply type user hashes.
followed by Dash Dash woodlist
followed by the rock you text
file. Remember we had extracted roku.txt
file a couple of
sections ago.
Once you're ready simply hit enter.
This will take a few minutes to complete.
Great after a few minutes.
John has finished.
To view the passwords we can simply type John like so
- shoe.
Followed by user hashes like
so on hit enter currently. It has Shooters
three password hashes were cracked.
So for the user call just call Sis. The password
is Batman.
For the user called which is key log. The password
is 1 2 3 4 5 6 7 8 9.
For the user account, which is service. The password is
also service.
Create you have learned how to use John to perform
offline password cracking of password hashes out
to extracted from a linux-b system.
In this video you have learned how to extract usernames
and passwords from Linux B systems. Furthermore.
You have learned how to perform password cracking
using John the Ripper.
In the next video, we'll discuss the importance on the
benefits of privilege escalation attacks. I hope
this video has been informative for you and thank you for viewing.