search

Extracting Passwords from Linux Systems

hashtag
Linux Authentication Process

The pam_unix.so module uses standardized API calls from system libraries to update account information. The primary files it reads from and writes to are /etc/passwd and /etc/shadow. PAM also includes many other service modules, such as those for LDAP, mount operations, and Kerberos authentication.

hashtag
Passwd file

The /etc/passwd file contains information about every user on the system and is readable by all users and services. Each entry in the file corresponds to a single user and consists of seven fields, which store user-related data in a structured format. These fields are separated by colons (:). As such, a typical entry may look something like this:

Linux Authentication Process

htb-student:x:1000:1000:,,,:/home/htb-student:/bin/bash
Field
Value

Username

htb-student

Password

x

User ID

1000

Group ID

1000

GECOSarrow-up-right

,,,

Home directory

/home/htb-student

Default shell

/bin/bash

The most relevant field for our purposes is the Password field, as it can contain different types of entries. In rare cases (generally on very old systems) this field may hold the actual password hash. On modern systems, however, password hashes are stored in the /etc/shadow file, which we'll examine later. Despite this, the /etc/passwd file is world-readable, giving attackers the ability to crack the passwords if hashes are stored here.

Usually, we will find the value x in this field, indicating that the passwords are stored in a hashed form within the /etc/shadow file. However, it can also be that the /etc/passwd file is writeable by mistake. This would allow us to remove the password field for the root user entirely.

eldeim@htb[/htb]$ head -n 1 /etc/passwd

root::0:0:root:/root:/bin/bash

This results in no password prompt being displayed when attempting to log in as root.

Although the scenarios described are rare, we should still pay attention and watch for potential security gaps, as there are applications that require specific permissions fon entire folders. If the administrator has little experience with Linux (or the applications and their dependencies), they might mistakenly assign write permissions to the /etc directory and fail to correct them later.

hashtag
Shadow file

Since reading password hash values can put the entire system at risk, the /etc/shadow file was introduced. It has a similar format to /etc/passwd but is solely responsible for password storage and management. It contains all password information for created users. For example, if there is no entry in the /etc/shadow file for a user listed in /etc/passwd, that user is considered invalid. The /etc/shadow file is also only readable by users with administrative privileges. The format of this file is divided into the following nine fields:

Field
Value

Username

htb-student

Password

$y$j9T$3QSBB6CbHEu...SNIP...f8Ms

Last change

18955

Min age

0

Max age

99999

Warning period

7

Inactivity period

-

Expiration date

-

Reserved field

-

If the Password field contains a character such as ! or *, the user cannot log in using a Unix password. However, other authentication methods—such as Kerberos or key-based authentication—can still be used. The same applies if the Password field is empty, meaning no password is required for login. This can lead to certain programs denying access to specific functions. The Password field also follows a particular format, from which we can extract additional information:

  • $<id>$<salt>$<hashed>

As we can see here, the hashed passwords are divided into three parts. The ID value specifies which cryptographic hash algorithm was used, typically one of the following:

ID
Cryptographic Hash Algorithm

1

MD5arrow-up-right

2a

Blowfisharrow-up-right

5

SHA-256arrow-up-right

6

SHA-512arrow-up-right

sha1

SHA1cryptarrow-up-right

y

Yescryptarrow-up-right

gy

Gost-yescryptarrow-up-right

7

Scryptarrow-up-right

Many Linux distributions, including Debian, now use yescrypt as the default hashing algorithm. On older systems, however, we may still encounter other hashing methods that can potentially be cracked. We'll discuss how the cracking process works shortly.

hashtag
Opasswd

The PAM library (pam_unix.so) can prevent users from reusing old passwords. These previous passwords are stored in the /etc/security/opasswd file. Administrator (root) privileges are required to read this file, assuming its permissions have not been modified manually.

Looking at the contents of this file, we can see that it contains several entries for the user cry0l1t3, separated by a comma (,). One critical detail to pay attention to is the type of hash that's been used. This is because the MD5 ($1$) algorithm is significantly easier to crack than SHA-512. This is particularly important when identifying old passwords and recognizing patterns, as users often reuse similar passwords across multiple services or applications. Recognizing these patterns can greatly improve our chances of correctly guessing the password.

hashtag
Cracking Linux Credentials

Once we have root access on a Linux machine, we can gather user password hashes and attempt to crack them using various methods to recover the plaintext passwords. To do this, we can use a tool called unshadowarrow-up-right, which is included with John the Ripper (JtR). It works by combining the passwd and shadow files into a single file suitable for cracking.

This "unshadowed" file can now be attacked with either JtR or hashcat.

Note: This is the exact scenario that JtR's single crack mode was designed for.

hashtag
Lab - Questions

https://academy.hackthebox.com/storage/modules/147/linux-authentication-process.zipacademy.hackthebox.comchevron-right

  • Download the attached ZIP file (linux-authentication-process.zip), and use single crack mode to find martin's password. What is it?

Fristly unzip the .zip getted -->

Now, unshadow it -->

To conclude, crack it -->

hashtag
Credential Hunting in Linux

  • Files including configs, databases, notes, scripts, source code, cronjobs, and SSH keys

  • History including logs, and command-line history

  • Memory including cache, and in-memory processing

  • Key-rings such as browser stored credentials

hashtag
Searching for configuration files

The most crucial part of any system enumeration is to obtain an overview of it. Therefore, the first step should be to find all possible configuration files on the system, which we can then examine and analyze individually in more detail. There are many methods to find these configuration files, and with the following method, we will see we have reduced our search to these three file extensions.

Optionally, we can save the result in a text file and use it to examine the individual files one after the other. Another option is to run the scan directly for each file found with the specified file extension and output the contents. In this example, we search for three words (user, password, pass) in each file with the file extension .cnf.

hashtag
Searching for databases

We can apply this simple search to the other file extensions as well. Additionally, we can apply this search type to databases stored in files with different file extensions, and we can then read those.

hashtag
Searching for notes

Depending on the environment we are in and the purpose of the host we are on, we can often find notes about specific processes on the system. These often include lists of many different access points or even their credentials. However, it is often challenging to find notes right away if stored somewhere on the system and not on the desktop or in its subfolders. This is because they can be named anything and do not have to have a specific file extension, such as .txt. Therefore, in this case, we need to search for files including the .txt file extension and files that have no file extension at all.

hashtag
Searching for scripts

Scripts are files that often contain highly sensitive information and processes. Among other things, these also contain credentials that are necessary to be able to call up and execute the processes automatically. Otherwise, the administrator or developer would have to enter the corresponding password each time the script or the compiled program is called.

hashtag
Enumerating cronjobs

Cronjobs are independent execution of commands, programs, scripts. These are divided into the system-wide area (/etc/crontab) and user-dependent executions. Some applications and scripts require credentials to run and are therefore incorrectly entered in the cronjobs. Furthermore, there are the areas that are divided into different time ranges (/etc/cron.daily, /etc/cron.hourly, /etc/cron.monthly, /etc/cron.weekly). The scripts and files used by cron can also be found in /etc/cron.d/ for Debian-based distributions.

hashtag
Enumerating history files

All history files provide crucial information about the current and past/historical course of processes. We are interested in the files that store users' command history and the logs that store information about system processes.

In the history of the commands entered on Linux distributions that use Bash as a standard shell, we find the associated files in .bash_history. Nevertheless, other files like .bashrc or .bash_profile can contain important information.

hashtag
Enumerating log files

An essential concept of Linux systems is log files that are stored in text files. Many programs, especially all services and the system itself, write such files. In them, we find system errors, detect problems regarding services or follow what the system is doing in the background. The entirety of log files can be divided into four categories:

  • Application logs

  • Event logs

  • Service logs

  • System logs

Many different logs exist on the system. These can vary depending on the applications installed, but here are some of the most important ones:

File

Description

/var/log/messages

Generic system activity logs.

/var/log/syslog

Generic system activity logs.

/var/log/auth.log

(Debian) All authentication related logs.

/var/log/secure

(RedHat/CentOS) All authentication related logs.

/var/log/boot.log

Booting information.

/var/log/dmesg

Hardware and drivers related information and logs.

/var/log/kern.log

Kernel related warnings, errors and logs.

/var/log/faillog

Failed login attempts.

/var/log/cron

Information related to cron jobs.

/var/log/mail.log

All mail server related logs.

/var/log/httpd

All Apache related logs.

/var/log/mysqld.log

All MySQL server related logs.

Covering the analysis of these log files in detail would be inefficient in this case. So at this point, we should familiarize ourselves with the individual logs, first examining them manually and understanding their formats. However, here are some strings we can use to find interesting content in the logs:

hashtag
Memory and cache

hashtag
Mimipenguin

Many applications and processes work with credentials needed for authentication and store them either in memory or in files so that they can be reused. For example, it may be the system-required credentials for the logged-in users. Another example is the credentials stored in the browsers, which can also be read. In order to retrieve this type of information from Linux distributions, there is a tool called mimipenguinarrow-up-right that makes the whole process easier. However, this tool requires administrator/root permissions.

hashtag
LaZagne

An even more powerful tool we can use that was mentioned earlier in the Credential Hunting in Windows section is LaZagne. This tool allows us to access far more resources and extract the credentials. The passwords and hashes we can obtain come from the following sources but are not limited to:

  • Wifi

  • Wpa_supplicant

  • Libsecret

  • Kwallet

  • Chromium-based

  • CLI

  • Mozilla

  • Thunderbird

  • Git

  • ENV variables

  • Grub

  • Fstab

  • AWS

  • Filezilla

  • Gftp

  • SSH

  • Apache

  • Shadow

  • Docker

  • Keepass

  • Mimipy

  • Sessions

  • Keyrings

For example, Keyrings are used for secure storage and management of passwords on Linux distributions. Passwords are stored encrypted and protected with a master password. It is an OS-based password manager, which we will discuss later in another section. This way, we do not need to remember every single password and can save repeated password entries.

hashtag
Browser credentials

Browsers store the passwords saved by the user in an encrypted form locally on the system to be reused. For example, the Mozilla Firefox browser stores the credentials encrypted in a hidden folder for the respective user. These often include the associated field names, URLs, and other valuable information.

For example, when we store credentials for a web page in the Firefox browser, they are encrypted and stored in logins.json on the system. However, this does not mean that they are safe there. Many employees store such login data in their browser without suspecting that it can easily be decrypted and used against the company.

The tool Firefox Decryptarrow-up-right is excellent for decrypting these credentials, and is updated regularly. It requires Python 3.9 to run the latest version. Otherwise, Firefox Decrypt 0.7.0 with Python 2 must be used.

Alternatively, LaZagne can also return results if the user has used the supported browser.

hashtag
Lab - Questions

  • Examine the target and find out the password of the user Will. Then, submit the password as the answer.

SSH to 10.129.112.31 (ACADEMY-PWATTACKS-NIX01) with user "kira" and password "L0vey0u1!"

Fristly, see the bash history-->

There is nothing... but have a hint about the management of this user, go to download firefox decrypt -->

Fristly, in us machine, git clone the repo and weak up a web server -->

PreviousCredential Hunting in WindowsNextExtracting Passwords from the Network

Last updated