CyberSec Lab — Hashcat

💀 ASSIGNMENT GOALS

Examine the hash dump file.

Identify all hash types using hashcat --identify.

Crack MD5 and SHA-1 hashes with a dictionary attack.

Crack the NTLM hash using a mask attack.

Use hashcat --show to display all cracked credentials.

Complete the pentest report and submit.

PHASE 1 — EXAMINE HASH DUMP

💻

Terminal

📖

Reference Manual

📝

Notepad

📋

Pentest Report

⚠ CLASSIFIED — PENTEST ENGAGEMENT

MISSION BRIEFING

Operation: Hash Horizon | Tool: Hashcat

SCENARIO

During a red team engagement against Apex Systems Inc., access was gained to the company's web server database. A dump containing password hashes for multiple user accounts was successfully exfiltrated.

Your objective is to use Hashcat to identify the hash types, select the appropriate attack modes, crack as many passwords as possible, and produce a findings report documenting the password security weaknesses discovered.

Cracked credentials could enable lateral movement or privilege escalation across the network.

OBJECTIVES

cat hashes.txt — examine the exfiltrated hash dump.

hashcat --identify hashes.txt — identify all hash types and their mode numbers.

Run dictionary attacks (-a 0) against MD5, SHA-1, and SHA-256 hashes.

Run a mask attack (-a 3) against the NTLM hash to crack the pattern-based password.

Use hashcat --show to display all cracked credentials in a clean table.

Fill in the Pentest Report with your findings and submit.

TOOLS

💻

Terminal

hashcat, cat, ls, file, clear, help

📖

Reference Manual

Hash mode table, attack modes, mask charset guide

📝

Notepad

Keep track of hashes, mode numbers, and cracked passwords

📋

Pentest Report

Submit your findings here

AVAILABLE FILES

📄

hashes.txt

/root/loot/hashes.txt — the exfiltrated hash dump

📚

wordlist.txt

/usr/share/wordlists/rockyou.txt — pre-loaded

Display Mode

TERMINAL — root@kali : ~/loot

Hashcat Lab Terminal — Kali Linux 2024.1

Working directory: /root/loot

Type 'help' for available commands.

root@kali:~/loot#

REFERENCE MANUAL — HASHCAT

HASHCAT SYNTAX

hashcat [options] hashfile [wordlist|mask]

hashcat -m <mode> -a <attack> hashes.txt wordlist.txt
hashcat -m <mode> -a 3 hashes.txt <mask>
hashcat --identify hashes.txt
hashcat -m <mode> hashes.txt --show

COMMON HASH MODES (-m)

MODE	HASH TYPE	EXAMPLE HASH	STRENGTH
0	MD5	5d41402abc4b...	Very Weak
100	SHA-1	aaf4c61ddcc5...	Weak
1000	NTLM	b4b9b02e6f09...	Weak
1400	SHA-256	5e884898da28...	Medium
1700	SHA-512	cf83e1357eef...	Strong
3200	bcrypt	$2a$12$...	Very Strong
500	MD5crypt ($1$)	$1$salt$hash	Medium
1800	SHA-512crypt ($6$)	$6$salt$hash	Strong

ATTACK MODES (-a)

MODE	NAME	DESCRIPTION
0	Dictionary	Test words from a wordlist file
1	Combinator	Combine two wordlists together
3	Mask (Brute-force)	Generate passwords from a pattern mask
6	Hybrid Dict+Mask	Wordlist words + mask appended
7	Hybrid Mask+Dict	Mask prepended + wordlist words

MASK CHARSETS

MASK	CHARACTER SET	EXAMPLE
?l	Lowercase a-z	a,b,c...
?u	Uppercase A-Z	A,B,C...
?d	Digits 0-9	0,1,2...
?s	Special chars	!,@,#,$...
?a	All printable	?l+?u+?d+?s

Example mask for "Summer2024!" → ?u?l?l?l?l?d?d?d?d?s

USEFUL FLAGS

FLAG	DESCRIPTION
--identify	Auto-detect hash type
--show	Display cracked passwords
--force	Ignore warnings (use in VMs)
--rules-file	Apply mangling rules
-o output.txt	Save cracked hashes to file
--status	Show live cracking progress
--potfile-path	Custom pot file location

HOW TO IDENTIFY HASH TYPE

1. Run hashcat --identify hashes.txt
2. Look at the hash length and prefix:
  • 32 chars, hex = likely MD5 (mode 0)
  • 40 chars, hex = likely SHA-1 (mode 100)
  • 32 chars, hex, Windows = likely NTLM (mode 1000)
  • 64 chars, hex = likely SHA-256 (mode 1400)
  • Starts with $2a$ = bcrypt (mode 3200)

NOTEPAD — notes.txt

FileEditFormatView

Ln 1, Col 1UTF-8notes.txt

PENTEST REPORT — HASH CRACKING FINDINGS

HASH CRACKING FINDINGS REPORT

APEX SYSTEMS INC. — RED TEAM ENGAGEMENT — COMPLETE ALL FIELDS

SECTION 1 — CRACKED CREDENTIALS

Number of Accounts Cracked

Username #1

Password #1

Username #2

Password #2

Username #3

Password #3

Username #4

Password #4

Username #5

Password #5

SECTION 2 — RISK ASSESSMENT

Overall Risk Rating

Attack Modes Used

Recommendations