Skip to content

Other password crack

Jump to bottom
lethanhtung01011980 edited this page Jun 19, 2020 · 21 revisions

Goals

  • To crack password of zip and rar files

To extract hash from various data format

  • To extract hash
  • And to use john to crack using wordlist
  • ls /usr/sbin/*john*
  • /usr/sbin/dmg2john /usr/sbin/john /usr/sbin/keyring2john /usr/sbin/putty2john /usr/sbin/rar2john
  • /usr/sbin/gpg2john /usr/sbin/keepass2john /usr/sbin/kwallet2john /usr/sbin/pwsafe2john /usr/sbin/ssh2john
  • /usr/sbin/hccap2john /usr/sbin/keychain2john /usr/sbin/pfx2john /usr/sbin/racf2john /usr/sbin/zip2john

For example

  • ssh2john id_rsa.key > hash
  • john hash --fork=25 -w=/usr/share/wordlists/rockyou.txt
  • john --show hash => id_rsa.key:gustateamo

To convert binary to base64 for simple copy

  • To convert binary to base64: base64 keys.rar
  • To convert back from base64 to binary: echo UmFyIRoHAM+gApIEAAHJvb3RhdXRob3JpemVkc3Noa2V5LnB1YnI+qg+QiYZnpO86O3+rX46ki9CMd7+qCC09p9xDL5gF8Wgwc7mZK9wkiTpvXO4vmmM50barFVJi55jD3l9J8var5iMCb8+Lrpn2e79rXFKzktBJ2e3/cSLUZRSv33cQFk2+9b43PDDjUD6IQ6FVbjc72sy6/8bMu7k8MYtJWFRHsLTwIXi0ZMrd/vydVFq7vQiUPYbt7H0SscXY4crEf9ann9iQyl6V034tluMZ9VQ6DmkXk53ekSbb3/Ck5/1hb9qj2RpBQUNTW70fQIbDXjcOp+qKerl8cfpDdo7JDRZbmJBuYd5zgFEASKHrew3spqQ/gZrNO6m/VvI/ZUa6DTmqhguHYKC838c9JzzDmW52daeuPMZtdTz2B0Enz5eBdV2XLbofx6ZA3nIYco6DJMvU9NxOfaLgnTj/JWRVAgUjoEgQUdcyWDEWoDYh+ARbAfG+qyqRhF8ujgUqYWNbXY8FxMsrTPdcWGz8348OZsMWH9NS5S8/KeIoGZU1YhfpP/6so4ihWCnWxD17AEAHAA== | base64 -d > keys.rar

Crack zip

  • cd /usr/share/wordlists
  • gunzip rockyou.txt.gz
  • fcrackzip -u -D -p '/usr/share/wordlists/rockyou.txt' bank-account.zip
  • unzip bank-account.zip

Crack rar

  • rar2john keys.rar > keys.hash
  • john --wordlist=jail-wlist.txt keys.hash OR john --format=rar --wordlist=jail-wlist.txt keys.hash
  • john --show keys.hash
  • To unrar: unrar x keys.rar

Crack weak public key

To install in Kali

  • git clone https://github.com/Ganapati/RsaCtfTool.git

  • cd RsaCtfTool

  • sudo apt-get install libgmp3-dev libmpc-dev

  • apt-get install python3-venv

  • python3 -m venv .

  • . bin/activate

  • apt-get install python3-dev

  • pip install -r "requirements.txt"

  • python RsaCtfTool.py --publickey ../rootauthorizedsshkey.pub --private > root.key

  • chmod 600 root.key

  • ssh root@victim-ip -i root.key

Cryptogram solver

Online hash crack

Secret in images

  • strings image.png

Steganography

  • apt-get install steghide
  • steghide info htb2.jpg
  • steghide extract -sf htb2.jpg

Base64 decode

Sidebar

HOME

0. COMMON exploits

0.1 Quick scan

0.2 Windows exploits

0.3 Linux exploits

1. Scan Info

1.1 nmnap Scan

1.1.1 nmnap scripts

1.2 Passive Gathering

1.2.1 Info harvesting

1.3 Active Gathering

1.3.1 DNS Enumeration

1.3.2 Port Scanning

1.3.3 SMB Enumeration

1.3.4 SMTP Enumeration

1.3.5 SNMP Enumeration

1.3.6 Web Enumeration

1.3.7 NFS Enumeration

1.3.8 File Enumeration

2. Pre-attack

2.1 Scan for Vuls

2.2 OpenVAS

2.2 File transfer

2.2.1 Windows victims

2.2.2 Linux victims

2.2.3 TFTP

2.2.4 FTP

2.2.5 VBScript

2.2.6 PowerShell

2.2.7 Debug.exe

2.2.8 Base64

2.2.9 nc

3. Get Reverse Shell

3.1 Create reverse shell listener

3.2 Create reverse shell payload

3.3 Upload reverse shell payload

3.4 Execute reverse shell payload

3.5 PowerShell Reverse Shell

4. Exploits

4.1 Use exploit scripts

4.2 Windows Exploits

4.2.1 ms17-010 - cve2017-0143

4.2.2 ms09-050 - cve2009-3103

4.3 Linux Exploits

4.3.1 Login via private key

4.3.2 Knockd to open SSH port

4.4 Password crack

4.4.1 Password file / hash

4.4.2 Brute force networked services

4.4.3 Password hash attack

4.4.4 Mimikart crack Win hash

4.4.5 Other password crack

4.5 Buffer Overflow

4.5.1 BO Attack Steps

4.5.2 Windows BO Example

4.5.3 Linux BO Example

4.6 Web attacks

4.6.0 Injected codes

4.6.1 Tools

4.6.2 XSS

4.6.3 LFI

4.6.4 RFI

4.6.5 MySQL Injection

4.6.6 Web application proxies

4.6.7 Automated SQL Injection Tools

4.6.8 Client-side attacks

4.6.9 PHPInfo attacks

4.6.10 WordPress attacks

6. Escalate Privilege

6.1 Escalate in Windows

6.1.1 Overview

6.1.2 EoP WinXP

6.1.3 accesschk

6.1.4 sc-Service Control

6.1.5 Add admin user

6.1.6 Migrate process

6.1.7 Runas attack

6.1.8 Change permission

6.2 Escalate in Linux

6.2.1 Overview

6.2.2 Escalate steps

6.2.3 Escape restricted shell

6.2.4 Hijack cronjobs

6.2.5 Writable passwd

7. Access and further attacks

7.1 Access servers and get proofs

7.2 Disable Firewall

7.3 Enable RDP & SSH

8. Port redirection and Tunnelling

8.1 Port Forwading & Redirection

8.2 SSH Tunneling

8.3 Proxychains

8.4 HTTP Tunneling

8.5 Traffic Encapsulation

9. Metasploit

9.1 UI+Basic commands

9.2 Aux scans

9.3 Exploit attacks

9.4 MSF payloads

9.5 DIY MSF Module

9.6 Post exploit

10. Kali

10.1 Common commands

10.2 Useful directories

10.3 Meterpreter

10.4 Nc

10.5 Ncat

10.6 Wireshark

10.7 TCPDump

10.8 John

10.9 Access DB mdbtools

10.10 Email readpst

10.11 Unzip 7z

11. Thirdparty scripts

11.1 Useful tools

11.2 nmapAutomator

11.3 Impacket MS17-010

11.4 pwntools

11.5 PowerShell

11.6 PowerSploit

11.7 HackTheBox

11.8 nishang PowerShell

11.9 Sherlock PowerShell

11.10 Watson PowerShell

11.11 Empire PowerShell

11.12 Win Exp Suggester

11.13 Linux Pri Checker

11.14 NFS Shell

12. References

14. Exam

Clone this wiki locally