Dumping Linux password hashes.
All right.
So this is the final section of this course.
We will be exploring the process of dumping Linux password
hashes.
And again, we've already done the same for Windows.
And of course, in the we-- in the case of Windows,
we were able to utilize the NTLM hashes
for authentication or legitimate authentication,
for that matter.
However, with Linux, we really cannot do much with password
hashes apart from cracking them, which is something that I will
be exploring in a password cracking course.
So do stay tuned for that.
But again, in this video, I'm really
just going to be focusing on the actual Linux password
hashes, where they're stored, and the different hash formats
or algorithms that are used to encrypt the Linux passwords.
So let's get started, firstly, by getting an understanding
of how Linux stores passwords.
So it's very important to know that Linux has
multi-user support, of course.
And as a result, multiple users can access the system
simultaneously.
This can be seen as both an advantage and disadvantage
from a security perspective, in that multiple accounts offer
multiple access vectors for attackers
and therefore increase the overall risk of the server.
So again, this is something that is also
common on Windows systems, where you
can create more than one user.
And if you create too many users,
these are all access vectors that attackers can use.
So in the case of Linux, all the account information is stored
in the passwd file located under /etc/passwd.
And of course, you can display the contents of this file using
the cat command.
And you can essentially get a rundown
of the list of user accounts that are currently
on the system, their user IDs, their home directories,
as well as the shell that has been configured for that user
account.
All right.
Now, we cannot view the passwords for the users
in the passwd file because they are encrypted,
and the passwd file is readable by any user on the system.
So you can essentially access the passwd file
as a non-privileged user.
All the encrypted passwords for the users
are stored in the shadow file.
So if you remember, in the previous set of videos
during the Linux ex--
the Linux privilege escalation section, I actually
displayed the shadow file.
And you may have noticed that we can only access the shadow
file as the root user.
Now, as I said, the shadow file can be accessed under
the /etc/shadow or rather the ETC directory.
And the name of the file is simply shadow.
And the shadow file can only be accessed by the root account.
And this is a very important security feature
as it prevents other accounts on the system
from accessing the hashed password.
So if you list out of the shadow--
if you list out of the shadow file or the contents
of the shadow file after you've elevated your privileges,
you'll actually get a list of user accounts
and their password hashes in encrypted format.
Now, whenever you list out the contents of the shadow file,
you'll get the actual hashed password.
But the hashed password will have
a prefix that is going to be encapsulated,
or rather, it's going to be a prefix that
contains the dollar symbol.
And then after that, there's going
to be a value that will actually tell you
what type of hashing algorithm was
used to encrypt that password.
And it's different, really based on many distributions
or on the type of distribution that you're dealing with.
However, modern systems or modern Linux distributions
typically utilize the strongest hashing algorithm,
which is SHA-512.
All right.
So the passwd file gives us information in regards
to the hashing algorithm that is used.
And the password hash, this is very helpful
as we're able to determine the type of hashing algorithm that
is being used and its strength, consequently telling
us or giving us an idea as to whether or not
we can actually crack that particular hash successfully.
And as I said, we can determine this by looking at the number
after the username encapsulated by the dollar symbol.
So whenever you open up the passwd file,
you'll be able to see or rather the shadow file,
you'll be able to see the actual password hash as well
as the actual dollar symbol.
And then, the value that comes after the dollar symbol tells
you what hashing algorithm is being used.
So again, if you take a look at the value $1, for example,
that's typical on older distributions
and on older versions of Linux.
That is the MD5 hashing algorithm.
That is relatively easy to crack.
You then have your value $2, which
is Blowfish, which, again, is relatively easy to crack.
And then when it gets to $5 and $6,
this is where you get into the really, really complex
or powerful hashing algorithms like SHA-256 and SHA-512.
Now, that doesn't mean that they cannot be cracked.
It just means that it's going to be even more
difficult than, say, MD5.
So on modern Linux systems, you will typically
find that the hashing algorithm being used
is either SHA-256 or SHA-512.
All right.
So let's actually take a look at how we can dump hashes,
the various Linux password hashes,
through the use of just displaying
the contents of the shadow file as well
as a few other utilities within the Metasploit framework.
So this video has a lab environment attached to it.
All you need to do is fire it up and just follow along
with my actual demonstration.
So I'll fire up my lab environment,
and I'll see you within the lab environment.
All right.
So I'm back within the lab environment.
And in this case, we will need to exploit a target in order
to gain initial access.
So again, the first step will involve
identifying the target IP, which you can identify
by typing in ifconfig and then taking a look at the IP address
or the subnet associated with the interface Ethernet 1.
So this is the IP address of our Kali Linux system,
and the target IP or the target system
is going to be on the next IP within this particular subnet.
And of course, in your case, the subnet
is going to be different.
However, you can see that the Kali Linux
system is on the IP address 2.
The target system is going to be on the IP address 3.
All right.
So just copy the subnet there, and just remember
to change the 2 to a 3, and that's the target IP.
All right.
We can then perform an Nmap scan to identify
what vulnerable service is running on it
that we can exploit.
So I'm going to just type in nmap -sV
to perform some service version detection,
and I'll, of course, change the 2 to a 3 there.
And I'll hit Enter.
And you can see the Nmap scan is complete relatively quickly.
And we have an FTP server running,
and the service version is ProFTPD version 1.3.3c.
So we can actually identify or take a look at--
we can actually check whether this specific version
of ProFTPD is vulnerable to an exploit that can provide us
with the Meterpreter session.
So I'll just use the searchsploit utility.
And we can then say ProFTPD, and we can hit Enter.
And we're looking for 1.3.3c.
And it looks like we have a backdoor command
execution module available within the Metasploit
framework.
So what I'll do is I'll just start up the PostgreSQL
Database Service.
So there we are.
Service postgresql start and msfconsole.
And we'll give that a couple of seconds to start up.
After which, we can search for the appropriate exploit module.
So we'll give this a couple of seconds.
There we are.
It's starting up the Metasploit framework.
I'm going to set the global variable for the RHOSTS option
to the target IP.
So let me just get rid of that panel there.
And let me copy the target IP.
So I'll just type in ifconfig, and I'll just
copy the subnet there.
So I'll set the global variable for the RHOSTS option
to the target IP so that I don't have
to keep on typing the target IP whenever I load a module.
So I'll hit Enter.
All right.
So if I search for proftpd, we'll
look for the appropriate module.
And we are looking for the ProFTPD 1.3.3c backdoor command
execution module.
So I'll copy that there, and I'll
say, use, and paste in the module name there.
If I show the options here, you can
see that the target IP has already been specified.
That's because I set up the global variable for the RHOSTS
option, and I set it to the target IP.
All right.
So we really don't need to do much here.
You can change the target port if the target system is running
FTP on a different port.
However, in this case, it's running it on the default port.
So I'll just hit Exploit.
We'll give this a couple of seconds.
There we are.
It's going to send it backdoor command,
and we should obtain a command shell
session, which we can then upgrade to a Meterpreter
session.
There we are.
So we get a command shell session.
So I can say /bin/bash -i to obtain a bash session.
And we already have elevated privileges.
So this particular exploit essentially
provided us with elevated privileges,
and of course, I can verify that there.
So I can put this in the background,
and I can then list out my sessions here.
And I can upgrade that session to a Meterpreter session
using the command sessions upgrade 1.
That's the session ID.
I'll hit Enter, and let's see whether we're
able to upgrade it to a Meterpreter session
as that will make things much easier.
All right, so we'll give that a couple of seconds.
All right.
So it looks like we obtained a Meterpreter session,
and we got an error.
But I guess that is fine as long as we obtain
the actual Meterpreter session.
So I'm going to say sessions, and as you can see,
we have a Meterpreter session--
there we are-- on session 2.
So I can say sessions 2.
There we go, and I sysinfo.
This is running Ubuntu 18.04, and it's a 64-bit operating
system.
I can say get user ID to verify that we have root access.
The user ID is set to 0, which is the root user, which
is fantastic.
So, as I said, the first technique that we can use
is the ability to dump the actual
or to actually display the contents of the shadow file.
So I'll just open up a shell session,
or we can utilize the Meterpreter session directly.
So I'll say cat /etc/shadow.
And because we're the root user, we
should be able to dump the actual hashes.
And you can see because the root user account is the only user
account on the system--
the rest of them are service accounts--
the root user account is really the only account
with a password hash.
And this is the password hash right over here.
And you can see that I mentioned that it will
be encapsulated in symbols.
The hashing algorithm value will be encapsulated in symbols.
And in this case, it is 6.
The value is 6, which tells us that this particular password
has been encrypted using the SHA-512 hashing algorithm.
All right.
So that's one way of dumping the hashes.
And of course, you can save this directly.
In the password cracking course, I
will be covering the process of cracking
these hashes irregardless of their hashing algorithm
or the hashing algorithm used to encrypt the password.
So that's one technique.
The other technique that we can use with the Metasploit
framework is the hashdump module.
So what I'll do is I'll just put this in the background.
There we go.
And I can search for the hashdump module.
There we go.
And we are looking for the Linux hashdump module.
So there we are.
That's the one there.
So post-- this is a post exploitation module,
and I'll copy the name there.
And I'll say use and paste that in there.
We can show the options here.
And we can set the session to session 2, which
is our Meterpreter session, and we just Hit Run.
All right, and this will automatically
get the-- all the user accounts that have passwords,
and it'll essentially provide you with the hashed passwords.
And it'll save them for you within the following file here.
So it's going to unshadow the password file.
As I said, I'll be explaining what unshadowing
is in the password cracking-- in the password cracking course.
For now, just know that the unshadowed password
file essentially means that this module has set up the--
it has essentially formatted this particular hashed password
into a format that can be cracked
or that is ready to be cracked.
All right.
So that-- these really are the two
techniques that you can use.
And as I said, if you have an Meterpreter session,
you can utilize the hashdump module
as it is very, very helpful, or you can dump the hashes
manually by simply displaying the contents of the shadow
file.
All right.
So that is going to conclude the practical demonstration
side of this video.
All right.
So that concludes the final section of this course.
And we've essentially gone through the process
of exploiting inherent vulnerabilities in both Windows
and Linux and taking a look at how
we can use these vulnerabilities to gain access
to elevate our privileges and of course, to dump credentials,
so on and so forth.
So this is the last video within this course.
And hopefully, I'll be seeing you in the next course.