Creating password linux cracker with python (☞ ͡° ͜ʖ ͡°)☞ (day 21)

Ever since 2017, python programming language had a steady increased of popularity not just in the area of data analysis but in penetration testing. If you try to look into one of the famous websites for penetration testing, "exploit DB" you can sense that programming language that usually used to create ax exploit is either ruby, c or python.

So in this post, I'm going to show you how you can implement python into your pentesting project. We are going to create your own password Linux cracker with python.

Background:

Before we go to the actual coding, let me explain it to you about some fundamental concepts:

• First, we need to know how Linux stored its password. Originally, Linux stored its own password in two different file one is located at "/etc/provides" which is contained the username (every user inside the operating system can see inside of the file ) and the other one which is located at "/etc/shadow" contained the actual password but it stored in sha512 hash. You can see the format of the Linux password below

 $ID$SALT$ENCRYPTED

• The ID is for what type of encryption do you use:
• $1 = MD5
• $2a = blowfish 
• $2 = blowfish
• $5 = SHA-256
• $6 = SHA-512 
• The SALT random strings (8 <= n <= 16 char)
• $ENCRYPTED, the encrypted string

• For quick testing, you can use "I" utility from Linux to generate your own password

Getting your hand dirty:

we need to import some important libraries, crypt for doing the hashing process and sys to add some command line functionality in the program:

import crypt
import sys



Next is to create a function that will return the hash:

def crack_password(salt,plain_text):
        return crypt.crypt(plain_text,"$6$%s" % salt)

The functionality of the crypt library is almost the same as mkpasswd you need to provide three value, the id, the salt, and the plain text. The rest of the source code is like this:

file = open(sys.argv[1])
result = []

for x in file.readlines():
        temp = x.rstrip("\n")
        salt = temp.split("$")[2]
        dictionary = open(sys.argv[2])
        for y in dictionary.readlines():
                temp2 = y.rstrip("\n")
                if crack_password(salt,temp2) == temp:
                        result.append(temp2)
                else:
                        print "try:" + y.rstrip("\n")
print "----------------result----------------"
print result

file.close()
dictionary.close()

the program i create assume that the user provide two files, first is the file contain a string of Linux password that will be decrypted and the second file is the dictionary file that will use to match the hash (https://github.com/danielmiessler/SecLists/tree/master/Passwords)

that's why for usablity i use the sys function so all you have to do is to write the name of the two files in front of the program and it will automatically do the decryption.

example: python password_decryptor.py file_contain_linux_password file_contain_dictionary_list

the first loop deal with iterating through the encrypted word inside the file, don't forget to strip the "\n" at the end of every line

the second loop will try to match the result of the dictionary list with the encrypted word. Once the program got a match result it will append to the result variable.

Result:

The file contains Linux password(first file):

$6$nnghqtzilxdhtkfk$CD0wgI..IQSGKobZ/PNW8zxW.VYKdU700rk9rILxrOR.M9yBntu1PrYEzzxLsiDyyjsISlSm.mkhh239X2ROc0
$6$aevmjnyzbrnqrxkq$TUbMkd34Gvk87s5iiF5VBveNIDsy/MNPyGCMTAPyYZjEPI100RUdwbY6K.WV83oqPBq7B7wlWqaW2ZtZtbvW01
$6$ysuucnvahyhnutcg$8g8MHX.Uh2FGaig6lAFOijcM8zXf4.7Ui0zp9l04ECZeP.5OIeukp0JNPZSipDkDSCLrP4LfzUXSSVemNXDwJ/
$6$kunaekvqyhyouoqu$DClxoXyV8BmkaV0q8zd4otc5aUZDdPWVNlIRwqDWZ2MtM7Sya156CpD/vVqaIyjPeKCJmmFvsn5DNHyJWGzKl0

The file contains dictionary list(second file):

Run it:

 Yea we got the string, that's all have a great weekend guys