Before we start going in cracking passwords, since we already know about salting and other
different methodologies of password hashing and encryption now, it's good to know and have a
baseline understanding of what it is that we're actually cracking. See, we can know the hash and
we can reverse engineer that hash and do best guess estimates and go through brute force attacks
and things like that. But let's say for instance that our password requirements don't involve
complexity things like special characters and whatnot. And we actually have a password that
is required to be in all lowercase. Just as an example, you wouldn't test it against passwords
that involved anything with uppercase characters. You would keep that possibility range down to
those within the actual rule set of what the password requirements are on that particular
system or domain. Well, I'm glad you asked about this kind of thing because I want to show you a
couple of things real quick on Windows and POSIX based systems. And what we're taking a look at
here is net accounts. And this can be done by a regular user inside of Windows using PowerShell
or Command Prompt. I'm in PowerShell. And what this does, it allows us to be able to go through
and see what those password requirements are on this particular Windows 10 system.
And as you can see here, that yes, we have a minimum password age, maximum password age,
so we know that they're required to change their password every 42 days. We have a minimum password
length of zero, which means that a password could be absolutely nothing or one character or 200.
So whenever we're calibrating our different password cracking systems and software suites,
we keep this in mind because there may be a user out there that takes advantage of this and doesn't
have a password. Length of password history maintained, none. So they could use the same
password over and over. Lockout threshold, lockout duration, and lockout observation window. And these
times right here are really good to know because they allow us to tune those different software
solutions for password cracking based on that time. So you don't want to make a lot of noise
on the network. This right here is really good to know. Now, what this doesn't tell us is whether
password complexity is enabled or not inside of our local security policy. And all that does is
just add in the requirement that we have to use special characters and numbers. So uppercase,
lowercase, numbers, special characters. This right here is a good way to get us started on
understanding what it is that we're required to crack. Because for instance, if that minimum
password length is eight, then we know that we're not going to be wasting time on passwords that are
nothing or seven characters. So we can already start off at eight and work beyond that. Now,
this can be done on group policy as well for those clients that are added to an Active Directory
domain. And I have the code for that below. And what it does is allows us to be able to take group
policy output of what policy is being applied to this particular system. Once we start getting into
those Active Directory skills in the course, we'll be taking a deeper dive into that. And it outputs
it to an HTML file so you can browse through and do a control F for password. And like I said,
once we get in those skills later on in the course, we'll dive more into that as far as
setting those requirements for those users. But let's hop on over to the Kali box real quick.
Now, as you can see here, I'm in terminal and I'm using cat without sudo, which means a regular user
can do this as well, just like the one in Windows. And we're taking a look at the slash etsy slash
login.defs, which is a configuration file for the Kali system and also Ubuntu and a couple of other
versions of POSIX based systems. This is kind of the general one. And we're doing a grep of the
phrase pass. So this login.defs file is the same configuration file that we would get out of that
account. This is just the POSIX based version of it. And what we're doing is we're using grep to
be able to tell us, skip all the other stuff because there's a lot of stuff in that file,
and tell us what's pertaining to the actual password itself. Now, as you can see here,
I just did that and highlighted in red is the actual phrase that was grepped. And I'm going to
zoom back in for us. And you can see that we have a lot of comments in here. But that first line,
for example, that says pound sign pass underscore max underscore days, you could remove that pound
sign and make it to where that's the actual configuration for it and maximum number of days
the password may be used. So delete that text and have it be pass max days space five. So the
password would only be good for a maximum of five days. Now, as you can see right below there where
it says max number of login retries if password is bad. If set to MD5, MD5 based algorithm will
be used for encryption password or encrypting password. They're skipping lines here because
they're only pulling out the stuff that's being gripped. So you can even assign based on the
configuration in login.devs how the password is either going to be hashed or encrypted,
because it does use DES and there are other versions of positive space systems out there
that even use AES. So this right here will give you a better starting point on what encryption
or hashing algorithm to use in order to try and reverse engineer that actual password of the user
that you got. And that ties into understanding this string right here when we were going over
salt earlier in the skill. As we take a look at this, we can see that this is identified as a
specific type of salt based on the dollar signs and that Y there. And we know the salting that
was assigned to it. You can't really do anything with that, but we know that it was salted.
And then we actually have the password phrase itself. So we would take the actual password
phrase and the algorithm that was used along with the password requirements that we know of out of
the login.devs file and be able to kind of have a good starting point other than not knowing
all together.