There are two important files which we need when we
want to crack Linux passwords,
the first being the passwd file and the second being the shadow file.
The passwd file stores essential information, which is required during login.
It is a plain‑text file and contains a list of system accounts,
and it holds some useful information.
This file should have general read permission,
as many command utilities use it to map user IDs to usernames.
Each field in the password entry is separated with the colon character.
Let's navigate now through each of these fields,
the first being the username field.
Next, we have the password field, and generally in the password file,
this is represented by an x.
Proceeding that, we have the user ID and group ID.
Following that, we have the full name of the user,
and then we have the user's home directory,
and the user's shell account.
Next, we have the shadow file,
which stores the passwords of the various user accounts in an encrypted format.
It contains additional properties related to the user's password,
which we will explore.
In this file, all fields are separated by the colon symbol,
similar to the password file.
The first piece we have is the username.
Next, we have the hashing algorithm salt, which is used in the password.
For example, if a SHA512 hash was used, the salt would represent $6$,
which I will show you in the demo.
Following this, we have the password hash.
Next, we have the number of days since the password was last changed,
and then we have the number of days before the password may be changed.
In this case, the 0 indicates that the password may be changed at any time.
Following this, we have the number of days until the password expires.
If there's a value of multiple 9's,
this indicates that the user can keep his password unchanged for many years,
which really is not a good practice.
Following this,
we have the number of days to warn a user of an expiring password.
If values were present after this field,
it would represent a number of days after the password
expiry that the account is disabled,
the number of days that the account has been disabled,
and any reserved fields for possible future use.
In this demonstration,
we will take a look now at how we can use the password
and shadow files of our Linux machine,
and leverage John to crack those password hashes.
Let's dive in.
I have already copied both the shadow and password
file to my Kali Linux machine.
In order to make it usable with John, I need to first merge the two,
and to do this, I'm going to use the command unshadow,
followed by the passwd file and the shadow file,
and I'm going to output this to a file called linuxhashes.txt.
Now I can view this file by typing more linuxhashes.txt,
and you can see it has merged both the username and the
password hash into one single file.
You will notice that the specific system has encrypted the
passwords using two different hash types,
as depicted by the $1$ and the $6$.
Now let's use John to crack these hashes.
I'll issue the command john, followed by a pot file of linuxhashes.pot,
I'm going to define my word list,
which is a custom word list I have used called rockyou,
and I have pre‑mangled this word list with a couple of rules from John,
and I'm going to define the linuxhashes.txt file,
which we've used previously.
You will notice that just one password was cracked,
and this is the MD5 password that was cracked.
There are additional passwords, which are SHA512,
and in order to crack those, we will need to issue the format SHA512crypt.
So I'm going to issue the same command, and this time,
I'm going to define a format of SHA512crypt.
And this time, I've got a lot more success,
I'm able to crack the passwords for both Jeffblue,
remote_admin, and the samiraa and helpdesk account.
If I issue the command john, followed by show linuxhashes.txt,
and I will come to define the pot file,
I will now be able to see all of the passwords that have been
cracked and that are stored in the pot file.
In this demonstration,
you have learned how to leverage John to crack multiple types
of password hashes within a Linux machine.