In this short article, I’ll walk you through the steps of cracking a password stored in the /etc/shadow file on a Linux machine. Keep in mind that in order to access the shadow and passwd files, you need root access.
Step 1:
Extract the user’s entry from the passwd file and the shadow file and put them in text files for John the ripper (replace the USERNAME with the username of your choice):
sudo cat /etc/passwd | grep USERNAME > passwd.txt sudo cat /etc/shadow | grep USERNAME > shadow.txt
Step 2:
Use the unshadow tool that is part of John the ripper tool set to create a single text file that contains both entries of the user into on line:
unshadow passwd.txt shadow.txt > unshadow.txt
The resulting file would be a combination of the user’s entries from passwd and shadow. This step organizaes the data needed by John in a format that John recognizes.
Step 3:
Choose a dictionary of possible passwords, such as Kali’s rockyou.txt (contains over 14 million passwords), and run John:
john --wordlist=/usr/share/wordlists/rockyou.txt unshadow.txt
If the password is found within the given wordlist, you’d see the output like this:
password (USERNAME)
Step 4:
If you get the famous “No password hashes loaded”, then the cryptographic hashing algorithm used is not easily recognized by John.
Take a look at the unshadow.txt file. The field after the username (with a number or letter between two dollar signs) is the one that identifies the hash type used. It could be one of the following:
- $1$ is MD5
- $2a$ is Blowfish
- $2y$ is Blowfish
- $5$ is SHA-256
- $6$ is SHA-512
- $y$ is yescrypt
For $y$, for example, you can use the command:
john --format=crypt --wordlist=/usr/share/wordlists/rockyou.txt unshadow.txt