how to HACK a password // password cracking with Kali Linux and HashCat — Transcript

Full transcript

1. 0:00password hacking in this video i'm going
2. 0:02to show you how to hack into a server
3. 0:03by cracking its password and this is
4. 0:05real world you'll get a chance to do
5. 0:07this yourself on my server
6. 0:09also this is for educational purposes
7. 0:10only please don't go hack somebody else
8. 0:12without the permission
9. 0:13only hack me you need to learn learn
10. 0:16learn hacking
11. 0:30[Music]
12. 0:35okay the goal here is to hack into this
13. 0:37server the coffee server
14. 0:38why because once we do we get free
15. 0:41coffee and coffee is awesome
16. 0:42although you might need coffee for this
17. 0:43so go ahead and get it now the good news
18. 0:45is that we already have a username the
19. 0:46username is dwight.schrute
20. 0:49which is a great start but what we don't
21. 0:51have is the password
22. 0:53this is our mission we're going to hack
23. 0:55dwight schrute's password
24. 0:56and when i say hack i also mean crack oh
25. 0:59and by the way this is a real server
26. 1:00that i want you to try and break into
27. 1:02watch until the end i've got a challenge
28. 1:03and the first five people to complete
29. 1:04that challenge will win free coffee
30. 1:06legit all right here we go i want also a
31. 1:08huge shout out to it pro tv the sponsor
32. 1:10of this video and my hacking journey
33. 1:12they're my primary learning source for
34. 1:13learning things like this so if you want
35. 1:15to dive deeper
36. 1:16check it out link below if you use my
37. 1:17code network chuck you get 30
38. 1:19off forever so yeah so how do we hack
39. 1:22this password how do we crack it well we
40. 1:23can do it the old-fashioned way right
41. 1:24the good old dwight schrute method try
42. 1:26zero zero zero
43. 1:28zero zero zero no okay
44. 1:31now try zero zero zero zero zero
45. 1:34one ssh dwight dot schrute
46. 1:38at my host and i just start trying
47. 1:40passwords
48. 1:41zero zero zero zero zero one no let's
49. 1:44try it again zero zero zero zero two
50. 1:46no that's not right let's try it again
51. 1:47zero zero zero zero three oh let's try
52. 1:50it again
53. 1:51no why would you keep doing that there
54. 1:53are better ways and we can even automate
55. 1:54this process to make it killer check
56. 1:56this out so what we were just doing is
57. 1:57traditionally called a brute force
58. 1:59attack
59. 2:00we were gonna sit there and try every
60. 2:01password under the sun until we found
61. 2:02out dwight's password
62. 2:04even if it took us five years not the
63. 2:05most efficient use of our time
64. 2:07now to be fair every attack i'm going to
65. 2:09show you is technically a brute force
66. 2:11attack but we refer to them in different
67. 2:12ways but there are so many better ways
68. 2:14and we're going to open up some hacking
69. 2:15tools right now and they're amazing
70. 2:16check this out the first tool i want to
71. 2:18show you is called hydra so fire up kali
72. 2:20linux
73. 2:20launch your terminal and we'll get going
74. 2:22we're going to use hydra for an online
75. 2:24attack
76. 2:24which basically means we're going to be
77. 2:26trying our passwords on a live system
78. 2:28we'll be entering those passwords in the
79. 2:29prompt and getting denied as we keep
80. 2:31trying them now hydra is going to do all
81. 2:32the work for us we'll
82. 2:33enter our command in step away and done
83. 2:35but she's not going to do what we just
84. 2:36saw
85. 2:37just trying every password under the sun
86. 2:39001 002
87. 2:41no no no we're going to give her a list
88. 2:43a list of passwords that we think
89. 2:44might be it what we're doing here
90. 2:46providing hydra with a list of passwords
91. 2:48is called a dictionary attack
92. 2:49and this is crazy effective because it
93. 2:51has a list of common passwords that a
94. 2:53lot of people might use
95. 2:54and we have a lot of passwords at our
96. 2:56disposal one list we have that's already
97. 2:57built into kali linux is called the
98. 2:59roku password list this company rock you
99. 3:01got hacked
100. 3:02back in 2009 and these hackers released
101. 3:04all their passwords they found which
102. 3:06were stored in plain text
103. 3:07so now we get to use it and this list is
104. 3:08massive let's take a look right now if i
105. 3:10open another terminal here
106. 3:11if you're on cali you can find it in
107. 3:13user share
108. 3:14word lists and there it is right there
109. 3:16rockyu.txt
110. 3:18and we'll just unzip that real quick
111. 3:20sudo gzip
112. 3:22d the file name rock u dot txt dot gz
113. 3:25and let's take a look at it i'll cap the
114. 3:27file right now
115. 3:32look at that so many passwords i better
116. 3:34stop before my computer has a heart
117. 3:36attack
118. 3:37there we go now i will not be using that
119. 3:38list that list has 14 million
120. 3:40passwords but i do have my own list here
121. 3:43is my word list
122. 3:44things i think dwight might use so let's
123. 3:46try it out first i'll specify my
124. 3:48username now i could do dash uppercase
125. 3:50l to specify a file name like
126. 3:53usernames.txt
127. 3:54and look through a list of names now i
128. 3:56already know it's dwight so i can just
129. 3:57do a lowercase l and put in
130. 3:59dwight dot shroot and then i'll specify
131. 4:02my password file do dash
132. 4:04uppercase p and my file which i have
133. 4:05named word
134. 4:07list dot txt
135. 4:10i'll do a backslash to move to the next
136. 4:12line here and then my host which is 45.
137. 4:15blah blah blah and then the service type
138. 4:17now right now i'm accessing the server
139. 4:19using ssh
140. 4:20so i'll specify ssh it could be ftp it
141. 4:22could be telnet whatever
142. 4:24and let's go oh password
143. 4:28it's all about passwords bam you see how
144. 4:30fast that was
145. 4:31i mean the list wasn't big right but it
146. 4:33found it check it out here's the
147. 4:34password
148. 4:35bears beats and went through my list
149. 4:37tried each one this is the one now this
150. 4:39method is fun
151. 4:40and useful but let me tell you if you're
152. 4:42trying a bunch of
153. 4:43login attempts a bunch of passwords
154. 4:45firewalls might find you you might get
155. 4:47blocked
156. 4:47plus you have timeouts the account
157. 4:49probably will get locked out not the
158. 4:51best method
159. 4:52but we have another way a better way
160. 4:53check this out let's take our password
161. 4:55hacking from online
162. 4:56to offline in this situation we're not
163. 4:58going to try and log into the server a
164. 4:59million times
165. 5:00but how does that work how do we know if
166. 5:02it's going to be the right password
167. 5:04if we can't actually try it one word
168. 5:07hashing
169. 5:08what is that let's talk about it you see
170. 5:10when mr dwight schrute created his
171. 5:11password
172. 5:12bears beats the server will take this
173. 5:14password and store it in its database
174. 5:16so that when dwight logs in they can go
175. 5:18oh that is dwight's password
176. 5:19come on in dwight but they don't store
177. 5:21it like this in plain text like you
178. 5:23won't log in and see
179. 5:24bears beats it won't be there actually
180. 5:26let me show you what it looks like right
181. 5:27now on that server it'll look like this
182. 5:31this right here is dwight's password
183. 5:33this crazy mess of numbers and letters
184. 5:35is called a hash
185. 5:36so when dwight created this password
186. 5:37bears beats the coffee server
187. 5:39hashed it basically put in his mouth
188. 5:41chewed it up and spit it out
189. 5:42looks like this now now it's a lot more
190. 5:44complex than just chewing it up and
191. 5:45spitting it out
192. 5:47for the server to turn bears beats into
193. 5:48this it uses these crazy hashing
194. 5:50algorithms
195. 5:51which without getting two in the weeds
196. 5:53on it is just a crazy math
197. 5:54problem function turning it into this
198. 5:57you might already be familiar with some
199. 5:58of the hashing algorithms out there
200. 6:00popular ones are md5 sha-256
201. 6:03you got ntlm on windows and if we were
202. 6:05to somehow hack into the server
203. 6:07via other means and get a list of all
204. 6:09the username and passwords
205. 6:10that look like this it would do us zero
206. 6:13good no good at all when dwight logs in
207. 6:16and he put this password in bears beats
208. 6:18the server takes this password
209. 6:20chews it up spits it out or in this case
210. 6:22runs it through its md5 algorithm
211. 6:24and if the hash matches the hash stored
212. 6:26in its database
213. 6:27you can go in you're good this should be
214. 6:29how most websites and services out there
215. 6:31are storing your passwords
216. 6:32not in plain text like the roku server
217. 6:35no no it's hashed so if they do get
218. 6:36hacked and hackers
219. 6:38get that list of usernames and passwords
220. 6:40they don't have your password
221. 6:41yet here's what we can do we may not
222. 6:43have dwight's password
223. 6:45but if we have his hash if we somehow
224. 6:47got that information we can do some
225. 6:48offline password cracking to figure out
226. 6:50what it is
227. 6:51now again we can't reverse engineer it
228. 6:53but we can
229. 6:54brute force our way into it we're going
230. 6:56to do what we did before we're going to
231. 6:57take our word list and we're going to
232. 6:59try and use each of these passwords
233. 7:00but instead of trying to log into the
234. 7:02server we're going to run that hashing
235. 7:04algorithm we're going to chew it up and
236. 7:05spit it out we're going to run
237. 7:07that md5 algorithm and see if it matches
238. 7:10the hash
239. 7:11we have for dwight schrute so we'll take
240. 7:12the first password salesman of the year
241. 7:14three
242. 7:15run it through it looks like this
243. 7:17doesn't match we move on
244. 7:18we try password one two three and we get
245. 7:20this not a match we move on and we keep
246. 7:22going until we find a hash that matches
247. 7:24and we'll try bears beats and boom this
248. 7:27one does match
249. 7:28a plus let's go we got the password
250. 7:30let's hack into the system
251. 7:31let's do this right now okay here in
252. 7:32cali we're going to try out a tool
253. 7:34called
254. 7:34hashcat for this tool we're going to use
255. 7:36two things first
256. 7:38our word list our list of possible
257. 7:39passwords and two we'll need our file of
258. 7:41hashes
259. 7:42let's go and create this real quick
260. 7:43linux will store its hash passwords in
261. 7:45the
262. 7:46shadow file so i'll grab that right now
263. 7:49i'll just create that file paste all
264. 7:51that stuff in there
265. 7:53save that now let's crack a password the
266. 7:55command will be sudo
267. 7:57cat now real quick hash cat's pretty
268. 7:59crazy you can do a lot of stuff
269. 8:01i'm going to show you the basics real
270. 8:02quick first we'll start with the method
271. 8:03which we'll specify with dash a
272. 8:06let's go to the manual page of our
273. 8:07hashcat real quick so open up another
274. 8:08terminal window and go to man
275. 8:10and hashcat a lot of stuff going on let
276. 8:13me scroll through to where i'm talking
277. 8:14about
278. 8:15so we used dash a and here are the
279. 8:17options and if i talked about every one
280. 8:18of these options this video would be
281. 8:20like four hours long so i'm only going
282. 8:21to talk about
283. 8:22option zero the straight option which is
284. 8:25just going through a word list
285. 8:27and doing what we just talked about
286. 8:28these other options which i would ignore
287. 8:30brute force but combination hybrid word
288. 8:33list and mask hybrid mask with word list
289. 8:35and some crazy stuff it's not just going
290. 8:37through a word list but it's auto
291. 8:38generating
292. 8:39these crazy password lists and these
293. 8:41password combinations and what password
294. 8:42characters you can use
295. 8:43it can be intense and perhaps it's a
296. 8:45video for another time for now we're
297. 8:46going to talk about just a straight
298. 8:48dictionary attack option zero so we'll
299. 8:50put in
300. 8:51zero now next is our hashing type we'll
301. 8:53put in dash m to specify that
302. 8:55let's go back to our man page here we
303. 8:57have our hashing types and there's a
304. 8:59lot a lot of hashing types and this can
305. 9:01be based on what type of password you're
306. 9:03trying to hack
307. 9:04for example if you know you're gonna be
308. 9:05hacking cisco look at that you'll enter
309. 9:07the
310. 9:08code 5700 in that option for a plain
311. 9:10jane md5 it'll be zero
312. 9:121000 for ntlm which if you're hacking
313. 9:14windows based passwords
314. 9:15that's what you'll use and for our
315. 9:16example we're going to be using 1800 for
316. 9:18sha-512
317. 9:20unix passwords so we'll put in 1800
318. 9:23i'm also going to throw in a dash
319. 9:24lowercase o and specify a file name
320. 9:28crackpasswords.txt this is where it's
321. 9:29going to store
322. 9:30the information we find out and then
323. 9:32finally the two files we're going to be
324. 9:34using the first will be our hashes which
325. 9:35we named hashes
326. 9:37dot txt and then our word list we're
327. 9:39going to use which was word list
328. 9:41dot txt and that's all we need hash
329. 9:44cat's about to spit some words out let's
330. 9:46do it here we go
331. 9:49and that gum that was fast
332. 9:53now again the word list was not that big
333. 9:55and it found the password if you look
334. 9:56here at candidates dot number one
335. 9:58it gave us two options eminem and bears
336. 10:02beats now we know that bears beats is
337. 10:03the correct password so great job
338. 10:05hashgat now let's try one more let's try
339. 10:07a windows based password i'll do sudo
340. 10:09hash cat once more do a dash a specify
341. 10:12oh not dash one
342. 10:13dash a and specify my method which will
343. 10:16be zero
344. 10:17dash m this time i'm doing ntlm for
345. 10:19microsoft windows
346. 10:21i know this to be 1000 as the code by
347. 10:24looking at the manual page i'll do a
348. 10:25dash lowercase o
349. 10:26for correctpasswords.txt where i'm going
350. 10:28to store my stuff
351. 10:30and then my hash now i could specify a
352. 10:31file this time i'm going to specify the
353. 10:33hash
354. 10:34i'm just going to copy that in there so
355. 10:35i'll just put that in quotes so i got
356. 10:37the one hash i'm looking for
357. 10:38then i'll put my word list in right here
358. 10:41wordlist.txt
359. 10:43and go now it's a bit wonky because it
360. 10:46says the candidates right now are
361. 10:48bears beats which i know is not the
362. 10:49password but if i go to the top here
363. 10:52it says the session status cracked it
364. 10:54said it did it with this hash let's go
365. 10:56look in that file we
366. 10:57put that in so i'll sudo cat
367. 11:00crackpasswords.txt
368. 11:01and let's take a look inside there there
369. 11:03it is okay perfect there's the hash i
370. 11:05used
371. 11:06and there's the password for my word
372. 11:07list that we matched up
373. 11:09and that was indeed the password so now
374. 11:11i have a challenge for you i want you to
375. 11:13use the skills
376. 11:14you just learned in this video to hack
377. 11:16or crack
378. 11:17my server's passwords the first five
379. 11:19people to do this will win coffee
380. 11:21so link below good luck and if you don't
381. 11:23win that's fine
382. 11:24i'll keep this challenge up for probably
383. 11:26a week or maybe two weeks and i would
384. 11:28love for you to let me know below what
385. 11:29you think about it and again it's using
386. 11:30the skills we just talked about here in
387. 11:32this video i'm gonna have you crack a
388. 11:33password via the online method
389. 11:34using a word list using hydra bam bam
390. 11:37bam automation and then i'm gonna have
391. 11:38you crack an offline password
392. 11:40using a word list a hash a password hash
393. 11:43using hashcat now there's a lot more to
394. 11:45password hacking or cracking
395. 11:47i just scratched the surface here but i
396. 11:49wanted to get you started
397. 11:50hashcat is a crazy program that you can
398. 11:52use to do some
399. 11:53well crazy stuff if you have something
400. 11:55like a beastly gaming pc like this
401. 11:57this boy behind me with a crazy cpu and
402. 11:59a crazy gpu
403. 12:00you can do some serious password
404. 12:02cracking going through massive word
405. 12:04lists i'm talking millions and millions
406. 12:05of passwords in these lists
407. 12:07anyways guys that's about it password
408. 12:09hacking password cracking whatever you
409. 12:10want to call it it's a powerful tool
410. 12:12and again please do not use this in any
411. 12:15way that's
412. 12:16illegal which let me be very clear
413. 12:18unless you have someone's explicit
414. 12:20permission to do this
415. 12:22it's illegal hack yourself hack your own
416. 12:24passwords
417. 12:25hack me i'm giving you permission to
418. 12:27hack my just the one server
419. 12:29nothing else in my challenge otherwise
420. 12:31set up your own lab and do it and there
421. 12:33do not use this for any illegal methods
422. 12:36but beyond that i hope you like this
423. 12:37video
424. 12:38if you do like it like it and if you
425. 12:39haven't already hit that subscribe
426. 12:40button if you like what i'm doing here
427. 12:42yep that's about it i'll catch you guys
428. 12:50later
429. 12:53[Music]
430. 12:56you