Formatting/converting hashes into their expected formats
The amount of formatting you need to do with the passwd
and shadow
files will depend on the tool you will use for password cracking. If you wish to use John, you can use the unshadow utility to combine the password hash back into the /etc/passwd
file as it was originally used. The reason for this is that the /etc/passwd
file can contain possible password candidates that John will try if it is aware of them. These are some of the candidates that will be attempted in John’s single crack mode (along with some mangling rules). Without any other options provided, John will then attempt any wordlist provided, then follow that with incremental mode (that is, brute forcing
). To unshadow the files with John, run the following command:
unshadow /etc/passwd /etc/shadow > combined.txt
Note that if you run the preceding command and the system returns an error that it cannot find the command, run the command from the directory...