Password cracking is part of the penetration tester job but is rarely taught on challenges platforms. In this room you will learn to how to crack hashes, identify hash types, create custom wordlists, find specific wordlists, create mutations rules, etc.

This room is a spiritual successor to Crack the Hash.

I recommend you to have done the room Crack the hash before attempting this one, which is harder and will use more advanced techniques.

However this room include a course about hash cracking before you have to face the cracking challenges, it may be a good idea to read the course part before doing Crack the hash if you are a new comer.

Often the first thing you will need when you encounter a hash, is trying to identify which kind of hash it is.
There are a lot of hash types, some are very famous like MD5 or SHA1 but other are less and there are several hash types possible for a given character set and length.

For hash cracking you will often need some custom or specialized dictionaries called wordlists.

SecLists is a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

wordlistctl is a script to fetch, install, update and search wordlist archives from websites offering wordlists with more than 6300 wordlists available.

Rawsec's CyberSecurity Inventory is an inventory of tools and resources about CyberSecurity. The Cracking category will be especially useful to find wordlist generator tools.

Note: On the exercise below we will see how to use how to use wordlistctl to download a list, for the example I took rockyou which is a famous wordlist but if you use TryHackMe AttackBox or Kali Linux you should already have it under /usr/share/wordlists/, so you don't need to download it again, this is just an example to show you how wordlistctl works.

Finally you'll need a cracking tool, the 2 very common ones are:

• Hashcat
• John the Ripper (jumbo version)

There are several modes of cracking you can use:

• Wordlist mode, which consist in trying all words contained in a dictionary. For example, a list of common passwords, a list of usernames, etc.
• Incremental mode, which consist in trying all possible character combinations as passwords. This is powerful but much more longer especially if the password is long.
• Rule mode, which consist in using the wordlist mode by adding it some pattern or mangle the string. For example adding the current year, or appending a common special character.

There are 2 ways of performing a rule based bruteforce:

1. Generating a custom wordlist and using the classic wordlist mode with it.
   
2. Using a common wordlist and tell the cracking tool to apply some custom mangling rules on it.

The second option is much more powerful as you wont waste gigabytes by storing tons of wordlists and waste time generating ones you will use only one time. Rather having a few interesting lists and apply various mangling rules that you can re-use over different wordlist.

John the Ripper already include various mangling rules but you can create your owns and apply them the wordlist when cracking:

$ john hash.txt --wordlist=/usr/share/wordlists/passwords/rockyou.txt rules=norajCommon02

You can consult John the Ripper Wordlist rules syntax for creating your own rules.

I'll give you the main ideas of mutation rules, of course several can be combined together.

• Border mutation - commonly used combinations of digits and special symbols can be added at the end or at the beginning, or both
• Freak mutation - letters are replaced with similarly looking special symbols
  
• Case mutation - the program checks all variations of uppercase/lowercase letters for any character
• Order mutation - character order is reversed
• Repetition mutation - the same group of characters are repeated several times
• Vowels mutation - vowels are omitted or capitalized
• Strip mutation - one or several characters are removed
• Swap mutation - some characters are swapped and change places
• Duplicate mutation - some characters are duplicated
• Delimiter mutation - delimiters are added between characters

As I said in the previous task mangling rules avoid to waste storage space and time but there are some cases where generating a custom wordlist could be a better idea:

• You will often re-use the wordlist, generating one will save computation power rather than using a mangling rule
• You want to use the wordlist with several tools
• You want to use a tool that support wordlists but not mangling rules
• You find the custom rule syntax of John too complex

You will have to crack several hashes. For each hash you will be given a short scenario that will help you to create a mangling rules, build a wordlist or finding some specialized data you'll need to crack the hash.

The scenarios are located on the website: Password advisor (http://MACHINE_IP), each piece of advice matches one of the following hashes (in the same order).

I hoped you enjoyed the room.
To find out more on me (noraj) check pwn.by/noraj.
You can find my other THM rooms on my THM profile.