TryHackMe — AOC2024: Day 23

Hello and Welcome!

Story Overview:

As the holiday of SOC-mas drew near, Glitch was knee-deep in an investigation targeting the shady dealings of Mayor Malware. The Mayor’s latest suspicious activity involved disposing of old electronic equipment, including a cracked and hazy tablet. Despite its condition, Glitch discovered the tablet held a password-protected PDF that might reveal the source of the Mayor’s questionable funding. Determined to uncover the truth, Glitch embarked on a journey through password hashing, cracking, and bypassing data protection barriers.

Learning Objectives:

• Hash functions and hash values
• Saving hashed passwords
• Cracking hashes
• Finding the password of a password-protected document

Introduction To Hash Cracking:

Password cracking is an essential skill in cybersecurity, often used in both offensive and defensive contexts. It involves identifying or bypassing authentication mechanisms to access protected resources. This walkthrough demonstrates practical techniques for cracking hashed passwords and decrypting password-protected files using tools like John the Ripper and personalized wordlists.

The challenge showcases key concepts such as:

• Hash functions and their role in authentication systems.
• Identifying hash types and their vulnerabilities.
• Cracking hashes using pre-built wordlists and custom rules.
• Creating and utilizing personalized wordlists for targeted attacks.
• Converting protected file formats into crackable hash formats.

Challenges:

This task focuses on cracking hashes using John the Ripper. First we have to identify the type of the hash and then decide on a wordlist. John also allows us to use rules to improve its working by modifying the words in the wordlist in common ways like altering a character for a similar looking number, changing the case etc.

1. Crack the hash value stored in hash1.txt. What was the password?

• Identifying the Hash Type Using hash-id.py, I determined the hash format to be SHA-256. Identifying the type is crucial because tools like John the Ripper need this information to work correctly. * Trying the Usual Suspects I used the infamous rockyou.txt wordlist with this command: john — format=raw-sha256 — wordlist=/usr/share/wordlists/rockyou.txt hash1.txt !!No luck!!
• The Mayor clearly put a little effort into his password this time. Adding Rules for Transformation To increase the chances of success, I applied the — rules=wordlist option, which modifies wordlist entries by adding common substitutions (like replacing a with @ or adding numbers). Command: john — format=raw-sha256 — rules=wordlist — wordlist=/usr/share/wordlists/rockyou.txt hash1.txt!!Success! The password turned out to be:
• Answer:fluffucat12

2. What is the flag at the top of the private.pdf file?

• Generating the Hash Using pdf2john.pl, I converted the password-protected PDF into a hash format that John the Ripper could understand: pdf2john.pl private.pdf > pdf.hash * Creating a Custom Wordlist* Knowing the Mayor’s fondness for his cat, Fluffy, I created a personalized wordlist with words like Fluffy, MayorMalware, and FluffyCat. Cracking the PDF Password Using the custom wordlist, I cracked the hash with this command: john — rules=single — wordlist=wordlist.txt pdf.hash !!The password? fluffycat12** again! (I guess the Mayor’s creativity was limited).!! * Uncovering the Flag Inside the PDF, at the very top, was a flag that read:
• Answer: THM{do_not_GET_CAUGHT}.

Key Takeaways:

• Gained a deeper understanding of how John the Ripper can be used to crack password hashes efficiently by leveraging wordlists and mutation rules.
• Learned how to extract password hashes from protected files, such as PDFs, and process them into a format suitable for cracking.
• Realized the importance of crafting personalized wordlists based on contextual information, which can significantly improve cracking success rates.