Now in our challenge we were tasked with identifying the actual hash type and the actual
string of text that represents the actual password inside of an account on Ubuntu,
specifically learners. So inside of our lab, bam there it is, sorry I thought I already had it
pulled up. First way we could do this is by using the one we've learned throughout the skill itself
with sudo cat etsy shadow. So we go ahead and type that and we can see and it will ask you for
your password for sudo. We can see here that learner is using dollar sign six dollar sign
and that tells us what type of hashing algorithm this is using. Specifically and if you scroll
back up in the actual skill itself this will be identified as SHA-512. Now I will highlight that
for you here that right there and scroll back in there we go dollar sign six dollar sign. Now if
you remember the last dollar sign is the actual string of text that we're actually looking for
to represent the actual password itself. So you would skip past the dollar sign to the
right there which is the salt and start with the uppercase U and go to the end of the password
itself and I'm having to squint my eyes here the welder squint to go in and identify the entirety
of the actual password and I'll zoom in for you here real quick and you could see there that
that's the actual password itself minus the salt that we kind of glossed over for a second.
So if we were able to take this password that we know with a salt and sha that we identified
we should be able to get this in return. Let's test that theory. Now I got yet another website
for you link below and I'm also going to take the salt string and put it in the code box below this
video as well to make things a little bit easier because what we're taking a look at here is a SHA
512 generator with salt input. Now we know the user we know the salt and we also know the password
what we're doing is a trust but verify step here to make sure that we've properly identified not
only the hash the salt but the fact that we identified the whole string of text that is the
actual password itself. So taking a look at this I haven't hit determined yet we let me zoom in for
you we input the user's name the password that we know is password here for our verification purposes
and the salt and over here gives us a simulated output for what it would look like in a terminal
so to speak. So now let me go ahead and hit determine real quick and highlight the actual
password itself and you can see here that that's the actual password text of the output. So hash
plus salt using password outputs this right here and the last four characters are B4P0.
If we hop on over to our lab here right here boom and now I'll zoom in for you we have B4P0.
So there are unlimited resources for us to be able to determine not only the hashing type
the salt being used and also the actual string of text that is the actual password itself.
Question next is can that information be used to reverse engineer or essentially brute force
a password out of not only POSIX based systems but also Windows. Since we already know that
older versions of Windows use hashing like we've discussed earlier in this skill and some of them
use symmetric and asymmetric type of encryptions we might be able to identify some ways to be able
to reverse engineer some passwords and start breaking some of them as we begin to do attacks
but that's going to come up in the actual next portion of this skill.
I hope this has been informative for you and I'd like to thank you for viewing.