I totally forgot to show you another way to do this and I have the code for this below.
So let's hop on back over to our lab real quick and here you can see I already have a string of
text for us. The getent of the actual shadow file itself for the user of learner and the getent
command is actually pretty powerful inside of POSIX based systems because what this is doing
is allowing us to be able to query databases, not the traditional type of database that you
would get in SQL, but more along in lines of inside the actual POSIX based system itself.
Now for instance we're using getent here against the actual shadow and for the user of learner.
Now when we go ahead and press enter on this we get the output that we normally get in the actual
cat of a shadow file learner and then the string of text and everything that goes with it.
It's essentially a very fancy grep but specified for system files and databases and information
and stuff like that inside of the operating system. Now you could use this for other
commands as well too and this is more this command is more for actual users and groups
on the system itself and you could say for instance a pseudo getent password
and you could see here that it outputs everything else like we would see in the password file
itself. Now you could also go up and type in learner and it would give you the information
for that as well. So this is a way of us to be able to evade if you will because if you go through
and start using the getent command and there let's say there's an IPS on the actual system
itself that you're pen testing against. People are going to expect for us to be able to go in
and pseudo cat the actual etsy shadow if we have those permissions and to be able to see what else
is on the actual system itself. We could use getent on the system and it may not be something
that the organization is really familiar with. You could use it in non-pseudo form by getent
group root and you can see that root is the actual name of the group itself. So you could
test and see if a user's involved in it or not and so you could also type dash dash help and give
you more information on here as well but it's another way for us to be able to check and see
if there's anything else on the system that we could use just in case that the cat command has
been restricted or access to the shadow file has been even further restricted on the system.
Because there are security settings specifically inside of POSIX based systems
that can circumvent different types of commands for different types of users whether they're
logged on or through a session of let's say like SSH. And so there I was refreshing myself on CCNA
with Keith and Jeff link below to that course and I'm inside of one of their labs here real quick
taking a look at basic router configuration. You may be asking yourself where is this going?
Bear with me here for a second. So inside of the actual packet tracer inside of the Keith's lab
here I can type in user well first I need to type config T to go into config mode and then username
Eric the actual user that I'm creating here and then followed by a secret. Now if I hit question
mark here real quick and I'll zoom in for you real quick you can see here that we have a couple
of different options. 0 specifies an unencrypted password, 5 specifies MD5 hashed, 8 is PBKDF2 and
9 is scrypt hashed. So it's really unfair to say encrypted it's more hash and this may look very
familiar to you. For example let's take a look at creating a user with MD5 hash. So we would say
right here 5 and then type in the password of password is what we're going to be using
and see this is exactly why I'm going through the refresher for them because I messed up. It's
actually 0 as the unencrypted and then the actual password itself and when that command is ran you
can do a I'm in the regular now show run and as you see the config there we go I'm going to go to
next one right here if you remember 5 was for MD5 and I'll zoom in for you real quick
right there username Eric secret 5 and then the actual hash itself and you may see something that
also looks very familiar the dollar signs the dollar signs right here translate over into
Cisco and other networking devices from POSIX based systems. So everything that we've been
doing in the skill up until now also helps us on the networking side of the house understand
and get ready for password attacking on that network device level as well. So dollar sign
one dollar sign MD5 and then the rest of that you'll notice that there's no other dollar signs
there meaning that Cisco does not salt. So here you could actually take that string starting with
the lowercase i and go to a reverse MD5 hasher and figure out what the actual password is using
some of the links that we have above in this course or in this particular skill. But I wanted
to show you the crossover here and that we're not just dealing with operating systems we're moving
on into the actual networking devices themselves for that password attacking methodology that we're
going to be exploring in the next couple of skills.