Hacking_and_Penetration_Testing_with_Low_Power_Devices

Penetration testing with a single beagle
119
FIGURE 5.21
LAN Manager passwords cracked with John the Ripper.
The appropriate command to crack these passwords is john –wordlist¼/pentest/
password/wordlists/rockyou.txt hashdump.txt. John will output the passwords it
finds. You can also list passwords later using john –show hashdump.txt. The output
from running john is shown in Figure 5.21.
Note that LAN Manager passwords are cracked in two separate parts and are not
case-sensitive. Windows converts passwords to upper case and truncates them to
fourteen characters. The LAN Manager passwords are particularly vulnerable
because the first and last seven characters are hashed separately. The user Bob
has a password of “JessicaAlba” and Phil has a password that starts with “moneymo”.
After some intelligent guessing, Phil’s password is found to be “moneymoney”.
Because the Linux computer at 192.168.10.101 has no vulnerable services, the only
practical way to attack this box is to crack user passwords. This presents a challenge as
we know one user account, root, with certainty. Based on the OpenVAS scan, the
machine appears to run some flavor of Ubuntu so we might also try the username
ubuntu. A successful password crack for the ubuntu user is shown in Figure 5.22.
Once we have a foot in the door with the ubuntu log-in, we can download the /etc/
passwd file in order to get additional usernames for cracking more passwords. We
can also try our luck with a sudo -s command from the ubuntu log-in. If we are fortunate,
the user will be in the sudoers list and we will be prompted for the known
ubuntu password and not the root password. Once logged in as root, there is little
we can’t do including downloading the /etc/shadow file. While it might seem strange
to crack passwords after obtaining root access, many people reuse the same password
on multiple systems.