1 1 00:00:00,240 --> 00:00:02,190 Testing credential security. 2 2 00:00:02,190 --> 00:00:03,570 In this lesson I'm going to show you 3 3 00:00:03,570 --> 00:00:06,300 how you can test credential security on your network. 4 4 00:00:06,300 --> 00:00:08,040 Now, in this demonstration I'm going to do it locally 5 5 00:00:08,040 --> 00:00:09,390 using a Kali Linux machine 6 6 00:00:09,390 --> 00:00:12,000 and looking at the hashes on that particular machine. 7 7 00:00:12,000 --> 00:00:13,710 But if you want to test it across your network 8 8 00:00:13,710 --> 00:00:15,120 you could gather those hashes 9 9 00:00:15,120 --> 00:00:17,220 using some method like network sniffing 10 10 00:00:17,220 --> 00:00:19,350 or using other tools on your network devices 11 11 00:00:19,350 --> 00:00:22,050 and then putting those hashes through this tool. 12 12 00:00:22,050 --> 00:00:23,610 And so we're going to use John the Ripper 13 13 00:00:23,610 --> 00:00:26,850 which is one of the most common password crackers out there. 14 14 00:00:26,850 --> 00:00:29,820 Now to do this, we're going to try to crack the password 15 15 00:00:29,820 --> 00:00:31,920 for this Kali Linux machine. 16 16 00:00:31,920 --> 00:00:34,980 Now, I'll tell you right now the password is t-o-o-r 17 17 00:00:34,980 --> 00:00:36,840 which is a very standard password that's used 18 18 00:00:36,840 --> 00:00:39,690 by Kali Linux by default when you install it. 19 19 00:00:39,690 --> 00:00:41,340 But we're going to go ahead and go through the process 20 20 00:00:41,340 --> 00:00:43,020 of trying to crack that now. 21 21 00:00:43,020 --> 00:00:45,360 So before we can try to crack those hashes 22 22 00:00:45,360 --> 00:00:48,660 we have to gather those hashes from the Kali Linux machine. 23 23 00:00:48,660 --> 00:00:51,360 Now by default inside Kali Linux 24 24 00:00:51,360 --> 00:00:54,120 these passwords are stored inside the password file 25 25 00:00:54,120 --> 00:00:57,240 and as a shadow inside this shadow file. 26 26 00:00:57,240 --> 00:00:58,440 So we're going to grab both of those 27 27 00:00:58,440 --> 00:01:02,250 and put those into a file for us called My Password. 28 28 00:01:02,250 --> 00:01:07,050 So we'll do that by typing unshadow / etc/password 29 29 00:01:07,050 --> 00:01:09,393 and then /etc/shadow. 30 30 00:01:10,260 --> 00:01:11,730 And then we'll pipe that over 31 31 00:01:11,730 --> 00:01:16,230 to the file password.txt and it's done. 32 32 00:01:16,230 --> 00:01:17,490 So now if I hit ls 33 33 00:01:17,490 --> 00:01:20,520 you'll see that there is the password.txt file. 34 34 00:01:20,520 --> 00:01:23,100 So what does that password file look like now? 35 35 00:01:23,100 --> 00:01:25,110 Well, let's go ahead and print it to the screen 36 36 00:01:25,110 --> 00:01:26,910 so that you can see it. 37 37 00:01:26,910 --> 00:01:30,030 And I'm just going to do more password.txt. 38 38 00:01:30,030 --> 00:01:32,730 And you'll see here you have your usernames on the left, 39 39 00:01:32,730 --> 00:01:34,770 and then what group they're associated with it, 40 40 00:01:34,770 --> 00:01:36,390 and how they're going to be logging on. 41 41 00:01:36,390 --> 00:01:39,540 Now under root you'll see that long hash there at the top, 42 42 00:01:39,540 --> 00:01:43,440 that $6$u all the way through across the top. 43 43 00:01:43,440 --> 00:01:46,800 That is the shadowed password the hash of it 44 44 00:01:46,800 --> 00:01:48,030 that we've captured. 45 45 00:01:48,030 --> 00:01:49,350 Now how do we crack that? 46 46 00:01:49,350 --> 00:01:52,080 Well, that's where John the Ripper's going to come in handy. 47 47 00:01:52,080 --> 00:01:54,390 So let me go ahead and clear my screen here. 48 48 00:01:54,390 --> 00:01:58,740 And what we're going to do is type john password.txt 49 49 00:01:58,740 --> 00:02:00,150 and hit enter. 50 50 00:02:00,150 --> 00:02:03,510 And John's going to go through and try to crack that password. 51 51 00:02:03,510 --> 00:02:04,950 Now it already says it found it. 52 52 00:02:04,950 --> 00:02:06,240 It was very, very quick. 53 53 00:02:06,240 --> 00:02:07,950 And so to show that password 54 54 00:02:07,950 --> 00:02:11,190 we'll just type in john -show, 55 55 00:02:11,190 --> 00:02:15,270 and then the file that we had used, which was password.txt. 56 56 00:02:15,270 --> 00:02:17,580 and so you can see that root was the username 57 57 00:02:17,580 --> 00:02:19,500 and toor was the password. 58 58 00:02:19,500 --> 00:02:22,830 You can see just how quickly John can go through 59 59 00:02:22,830 --> 00:02:26,400 and decrypt these hashes back into something 60 60 00:02:26,400 --> 00:02:28,620 that's usable for us, which is the password. 61 61 00:02:28,620 --> 00:02:30,420 And now I could log into the system 62 62 00:02:30,420 --> 00:02:33,543 as root with password toor with no problem.