Instructor: Testing credential security. 2 2
In this lesson I'm going to show you 3 3
how you can test credential security on your network. 4 4
Now, in this demonstration I'm going to do it locally 5 5
using a Kali Linux machine 6 6
and looking at the hashes on that particular machine. 7 7
But if you want to test it across your network 8 8
you could gather those hashes 9 9
using some method like network sniffing 10 10
or using other tools on your network devices 11 11
and then putting those hashes through this tool. 12 12
And so we're going to use John the Ripper 13 13
which is one of the most common password crackers out there. 14 14
Now to do this, we're going to try to crack the password 15 15
for this Kali Linux machine. 16 16
Now, I'll tell you right now the password is t-o-o-r 17 17
which is a very standard password that's used 18 18
by Kali Linux by default when you install it. 19 19
But we're going to go ahead and go through the process 20 20
of trying to crack that now. 21 21
So before we can try to crack those hashes 22 22
we have to gather those hashes from the Kali Linux machine. 23 23
Now by default inside Kali Linux 24 24
these passwords are stored inside the password file 25 25
and as a shadow inside this shadow file. 26 26
So we're going to grab both of those 27 27
and put those into a file for us called My Password. 28 28
So we'll do that by typing unshadow / etc/password 29 29
and then /etc/shadow. 30 30
And then we'll pipe that over 31 31
to the file password.txt and it's done. 32 32
So now if I hit ls 33 33
you'll see that there is the password.txt file. 34 34
So what does that password file look like now? 35 35
Well, let's go ahead and print it to the screen 36 36
so that you can see it. 37 37
And I'm just going to do more password.txt. 38 38
And you'll see here you have your usernames on the left, 39 39
and then what group they're associated with it, 40 40
and how they're going to be logging on. 41 41
Now under root you'll see that long hash there at the top, 42 42
that $6$u all the way through across the top. 43 43
That is the shadowed password the hash of it 44 44
that we've captured. 45 45
Now how do we crack that? 46 46
Well, that's where John the Ripper's going to come in handy. 47 47
So let me go ahead and clear my screen here. 48 48
And what we're going to do is type john password.txt 49 49
and hit enter. 50 50
And John's going to go through and try to crack that password. 51 51
Now it already says it found it. 52 52
It was very, very quick. 53 53
And so to show that password 54 54
we'll just type in john -show, 55 55
and then the file that we had used, which was password.txt. 56 56
and so you can see that root was the username 57 57
and toor was the password. 58 58
You can see just how quickly John can go through 59 59
and decrypt these hashes back into something 60 60
that's usable for us, which is the password. 61 61
And now I could log into the system 62 62
as root with password toor with no problem.