Github

Crack Password Hashes (Sites) 🤡

hashcat -m 160 'e5d8870e5bdd26602cab8dbe07a942c8669e56d6:tryhackme' /usr/share/wordlists/rockyou.txt

  • -m option is the kind of hash you are trying to break

    git clone https://github.com/noraj/haiti.git 
sudo gem install fpm 
cd haiti/packages/debian/ruby-docopt 
fpm -s gem docopt 
cd ../haiti 
fpm -s gem haiti-hash
cd ..
sudo dpkg -i ruby-docopt/ruby-docopt_0.6.1_all_debian11.deb
sudo dpkg -i haiti/haiti_2.1.0_all_debian11.deb
cd ../../
rm -rf haiti

  • Wordlists of hashes:

    • SecLists

    • tool: wordlistctl, for searching all leaked or composed wordlists (around 6300)

      • Example usage: wordlistctl search rockyou

      • Download one you find: sudo python3 wordlistctl.py fetch malenames-usa-top1000

  • Tools:

  • Rule mode: consists on using a wordlist by adding it some pattern or mangle the string. For example, adding the current year or appending a common special character

  • Creating a custom rule for john:

# This rule appends at the end, beginning and both up to 5 digits and symbols
[List.Rules:CRACK1]
cAz"[0-9~!@#$%^&*()_+]"
cAz"[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]"
cAz"[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]"
cAz"[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]"
cAz"[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]"
cA0"[0-9~!@#$%^&*()_+]"
cA0"[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]"
cA0"[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]"
cA0"[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]"
cA0"[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]"

# This rule reverses all word on a wordlist
[List.Rules:CRACK5]
r

# This rule appends numbers to a string
[List.Rules:CRACK6]
Az"[0-9][0-9][0-9][0-9][0-9][0-9][0-9]"

  • Command to extract necessary data of a wordlist and piping it to what we need:

sudo cat /usr/share/wordlists/misc/city-state-country.txt | dos2unix | grep 'Mexico*' | cut -f 1 -d ',' | uniq > mexico.txt

  • Examples with john

john hash.txt --wordlist=/usr/share/wordlists/passwords/rockyou.txt rules=norajCommon02

john /home/gitblanc/TryHackMe/crackthehashlevel2/hash1.txt --format=Raw-Md5 --wordlist=/usr/share/wordlists/usernames/malenames-usa-top1000.txt --rules=CRACK1

  • Consult John The Ripper Wordlist rules syntax

  • Ideas of mutation rules, of course several can be combined together.

  • Border mutation - commonly used combinations of digits and special symbols can be added at the end or at the beginning, or both

  • Freak mutation - letters are replaced with similarly looking special symbols

  • Case mutation - the program checks all variations of uppercase/lowercase letters for any character

  • Order mutation - character order is reversed

  • Repetition mutation - the same group of characters are repeated several times

  • Vowels mutation - vowels are omitted or capitalized

  • Strip mutation - one or several characters are removed

  • Swap mutation - some characters are swapped and change places

  • Duplicate mutation - some characters are duplicated

  • Delimiter mutation - delimiters are added between characters

  • Depending of your distribution, the John configuration may be located at /etc/john/john.conf and/or /usr/share/john/john.conf. To locate the JtR install directory run locate john.conf, then create john-local.conf in the same directory (in my case /usr/share/john/john-local.conf) and create our rules in here.

  • Add a new rule on the new john file:

[List.Rules:THM01]
$[0-9]$[0-9]

  • Generate mutations on wordlists with Mentalist

  • Generate specific wordlists with Cewl

    • Example cewl command: cewl -d 2 -w $(pwd)/example.txt https://example.org

    • The -d option is the depth (number of link level the spider will follow)

  • Craft wordlists from scratch with TTPassGen

    • Example command to create a wordlist containing all 4 digits PIN code value: ttpassgen --rule '[?d]{4:4:*}' pin.txt

    • Example command to generate a list of all lowercase chars combinations of length 1 to 3: ttpassgen --rule '[?l]{1:3:*}' abc.txt

    • Example to create a wordlist that is a combination of several wordlists (PIN + - + letter): ttpassgen --dictlist 'pin.txt,abc.txt' --rule '$0[-]{1}$1' combination.txt

    • ==Be warned combining wordlists quickly generated huge files, here combination.txt is 1.64 GB.==

  • Use the tool lyricpass to download the lyrics of all the songs made by a group or musician.

    • Example: lyricpass.py -a "Adele"

  • For stego challenges, if you do not find anything with common methods (like cracking with john or hashcat) try this web: md5hashing.net

Rooms

Last updated

Was this helpful?