hashcat -m 160 'e5d8870e5bdd26602cab8dbe07a942c8669e56d6:tryhackme' /usr/share/wordlists/rockyou.txt
  • -m option is the kind of hash you are trying to break

    git clone https://github.com/noraj/haiti.git
    sudo gem install fpm
    cd haiti/packages/debian/ruby-docopt
    fpm -s gem docopt
    cd ../haiti
    fpm -s gem haiti-hash
    cd ..
    sudo dpkg -i ruby-docopt/ruby-docopt_0.6.1_all_debian11.deb
    sudo dpkg -i haiti/haiti_2.1.0_all_debian11.deb
    cd ../../
    rm -rf haiti
  • Wordlists of hashes:

    • SecLists
    • tool: wordlistctl, for searching all leaked or composed wordlists (around 6300)
      • Example usage: wordlistctl search rockyou
      • Download one you find: sudo python3 wordlistctl.py fetch malenames-usa-top1000
  • Tools:


  • Rule mode: consists on using a wordlist by adding it some pattern or mangle the string. For example, adding the current year or appending a common special character
  • Creating a custom rule for john:
# This rule appends at the end, beginning and both up to 5 digits and symbols
[List.Rules:CRACK1]
cAz"[0-9~!@#$%^&*()_+]"
cAz"[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]"
cAz"[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]"
cAz"[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]"
cAz"[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]"
cA0"[0-9~!@#$%^&*()_+]"
cA0"[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]"
cA0"[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]"
cA0"[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]"
cA0"[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]""[0-9~!@#$%^&*()_+]"
 
# This rule reverses all word on a wordlist
[List.Rules:CRACK5]
r
 
# This rule appends numbers to a string
[List.Rules:CRACK6]
Az"[0-9][0-9][0-9][0-9][0-9][0-9][0-9]"
  • Command to extract necessary data of a wordlist and piping it to what we need:
sudo cat /usr/share/wordlists/misc/city-state-country.txt | dos2unix | grep 'Mexico*' | cut -f 1 -d ',' | uniq > mexico.txt
  • Examples with john
john hash.txt --wordlist=/usr/share/wordlists/passwords/rockyou.txt rules=norajCommon02
 
john /home/gitblanc/TryHackMe/crackthehashlevel2/hash1.txt --format=Raw-Md5 --wordlist=/usr/share/wordlists/usernames/malenames-usa-top1000.txt --rules=CRACK1
  • Consult John The Ripper Wordlist rules syntax

  • Ideas of mutation rules, of course several can be combined together.

  • Border mutationย - commonly used combinations of digits and special symbols can be added at the end or at the beginning, or both

  • Freak mutationย - letters are replaced with similarly looking special symbols

  • Case mutationย - the program checks all variations of uppercase/lowercase letters for any character

  • Order mutationย - character order is reversed

  • Repetition mutationย - the same group of characters are repeated several times

  • Vowels mutationย - vowels are omitted or capitalized

  • Strip mutationย - one or several characters are removed

  • Swap mutationย - some characters are swapped and change places

  • Duplicate mutationย - some characters are duplicated

  • Delimiter mutationย -ย delimiters are added between characters

  • Depending of your distribution, the John configuration may be located at /etc/john/john.conf and/or /usr/share/john/john.conf. To locate the JtR install directory run locate john.conf, then create john-local.conf in the same directory (in my case /usr/share/john/john-local.conf) and create our rules in here.

  • Add a new rule on the new john file:

[List.Rules:THM01]
$[0-9]$[0-9]
  • Generate mutations on wordlists with Mentalist

  • Generate specific wordlists with Cewl

    • Example cewl command: cewl -d 2 -w $(pwd)/example.txt https://example.org
    • The -d option is the depth (number of link level the spider will follow)
  • Craft wordlists from scratch with TTPassGen

    • Example command to create a wordlist containing all 4 digits PIN code value: ttpassgen --rule '[?d]{4:4:*}' pin.txt
    • Example command to generate a list of all lowercase chars combinations of length 1 to 3: ttpassgen --rule '[?l]{1:3:*}' abc.txt
    • Example to create a wordlist that is a combination of several wordlists (PIN + - + letter): ttpassgen --dictlist 'pin.txt,abc.txt' --rule '$0[-]{1}$1' combination.txt
    • Be warned combining wordlists quickly generated huge files, here combination.txt is 1.64 GB.
  • Use the tool lyricpass to download the lyrics of all the songs made by a group or musician.

    • Example: lyricpass.py -a "Adele"
  • For stego challenges, if you do not find anything with common methods (like cracking with john or hashcat) try this web: md5hashing.net

Rooms