Okay, so due to some reviews that I've gotten
I am NOT going to be drilling the "Hello everybody" sentence anymore
or I will try not to do it anyway
but rather instead, I'm just gonna jump into the tutorial itself right away.
So today we're gonna do something different from what we've done thus far.
This is a common problem encountered by tech support people and companies
or forensics and police
or something of a kind
or private companies as well.
You generally get a machine if you are working forensics
but you're working for the police force
or whether you are working for a private company
that is a contractor for the police or something of a kind
you will inevitably encounter system passwords that you will need to bypass.
That can be extremely problematic.
For example, if somebody has encrypted their drives
with a strong enough encryption key
it is unlikely that you will ever manage to pull anything out of those drives.
Now we're not going to be dealing with the encrypted drives today
as that is pretty much impossible or highly unlikely, I would say.
Rather instead, we will be dealing with systems passwords.
Now usually what the forensics would do is insert a bootable CD or USB
and boot it from there.
However, a lot of the systems you get logged in by some default user.
For example, my default user here is test.
It doesn't have any root privileges whatsoever
but I am able to actually do some basic operations on the system
which do not require root access.
Now from this user mode, I want to acquire a root password
so that I can actually control the system to the fullest of extent
and see what is going on there.
Now I can't actually control the system from a bootable CD
Rather instead, I can control that particular system
which runs from a bootable CD and then access the files here
and this is also one of the methods it that is very nice.
You can extract password hashes and then crack them later on
or something of a kind
but today, what I wanted to show you
this particular method is when people forget their passwords
or something of a kind.
You don't necessarily want to go into through the trouble
of actually booting from a CD
then getting a hash
and then after you've gotten a hash, you then need to crack it
and so on and so forth.
Rather instead, I will show you a method where you can obtain root access
without that, by just rebooting the system and changing a few things there
and then afterwards, we will use that method
or we will use the one with the CD to acquire the hash as well
and then I will show you how to crack that hash with John the Ripper.
Anyway, without further ado, let's just go ahead and reboot the system.
So I'm just logged in as test here.
Let's just type in "reboot"
Oops...We can just use the graphical interface to reboot the system
or you can just physically turn the machine off and on.
As I said, you can physically turn the machine on and off
and that's gonna qualify as a as a restart.
So it is now in the process of booting, GRUB is loading
and immediately after the GRUB loads, move up and down
so that the timer actually stops.
Go ahead and press...
You see there are these options here
It says "Use up and down arrow keys to select which entry is highlighted"
"Press Enter to boot the selected OS or 'e' to edit those commands before booting"
So what we want to do is press 'e', and there's a whole bunch of things here.
It's kinda difficult to see.
I can't make it any clearer for you unfortunately
There is one line which is very clear
where I am now
It says "echo loading Linux 3.18.0-kali1-amd64"
I'm sure you see that one.
Down below immediately, there is "Linux /boot/vmlinuz-3.18.00..."
and down below that line, you have this number stream...
Well, it's the same line I think.
Let me just move the arrow...
Excellent! There we go
So it's the same line basically
It just can't fit into the screen.
Maybe on your computer it will .
So there is this long number
It says here "9517-a28..."
and so on and so forth
and after that line, immediately it says r o.
Due to the background, it's a little bit difficult to see
but on your systems you'll be able to see it with more clarity
but anyway, after this number
"9517-a28..."
There is a space, and then there is r o
Delete the r o
Type in r w
Go to the end of that line
Don't change anything else
Go to the end
Press space
Type in "init=/bin/bash"
Excellent
So let's see how do we actually save this mode.
So I just pressed F10 and it's booting up now.
Let's see what happens
Excellent! There we go
So I am prompted with a root shell.
See I am root on my system now .
You can see in the left corner of the screen that I am root here
Of course, this would be in full screen mode
but you can't actually load VirtualBox guest additions
while you are booting it like this
so the screen will be rather small.
Anyway, it says root@ (none)
but doesn't really matter, I can do whatever I want.
I can go ahead and clear the screen
I can /cd/root
See I have full access to the system
and from here, I can pretty much do anything.
For example, I can do "init 5" you have start nope you do not have startx
You "startx"
Nope, you do not have startx
Fantastic
ifconfig
No network configuration either, primarily because I am in this mode
which is fantastic, but it doesn't matter.
I can do a lot of things with the system.
Just to give you an example
Here you go
cd/home/test/
So I am in test, and now I can do "passwd test"
and I can change the password for test.
I can even do "passwd root" and I can change the password for root.
Let's do that
So "passwd root"
What shall it be, the new password?
I'm just gonna type in exactly the same one as I've typed in before
but you get the idea.
You can type in whatever you want here.
Excellent
So it says "passwd: password updated successfully"
Now what we want to do is reboot and do a regular boot.
So we get the graphical user interface as well
and we get full screen here in VirtualBox
and we get a bit of a prettier environment as well
So just go ahead and reboot
You will of course need to undo the changes.
Okay, so this approach comes with certain problems.
Let's just power off the machine.
You do not wish to power off as well
Amazing
As you just see, this does come with a few drawbacks.
It is not as convenient, but oh well.
It doesn't really matter.
What you would do in a physical machine then
if you don't bother yourself with figuring out what the problem is here.
I, of course, have to go like this
and you'll probably have to do it like this on your virtualizer
which is probably VirtualBox
but I have seen that some people have been using VMware
in the discussion section
as they've had some problems with the VirtualBox
As I said, you can either try to figure out what is the problem here
and it says it's better if you shut down instead of power off on the command line
or something like that.
You can try typing in some other commands, but honestly why bother?
Just press the reset button on your computer
and let that be the end of it.
Reset
It's booting up
Oh, excellent! That has deleted been by default and it's clean.
So if you mess something up here, just reboot the machine
and the clean up operation will be done for you.
Uh, exit from here? I don't really want to
Nevermind, I'm just going to reset it again.
Not a good idea to do these sort of things in a VirtualBox
or in pretty much any virtualizer.
They can present problems in a VirtualBox
primarily because it is not a physical machine.
It doesn't work...
I mean, not in exactly the same way.
Anyway, I am rebooting it here
and we're gonna get into the system
and we will be root.
So not yet, but now we know the password
because we have changed it.
Although this method does not enable you to actually get the password itself.
Rather instead, it allows you to only change it
but we obviously needed to do that
because we need root password
if we are to actually access the etc passwd and etc shadow file
where the password is actually hashed
and let me show you that.
This is where Linux stores its password
You need to become root for this
and now we know the root password.
So let's just type in "cat /etc/shadow
Excellent
So you see here it says "test", which is my user
and then there is some sort of a hash over here.
That it's not pretty to look at, but what can you really do about it?
You can crack it I suppose, but that's about it.
Excellent
The route is the first one, and then there's the hash here as well.
Now we need to actually crack this.
Let me just go ahead and clear the screen.
In the follow-up tutorial
I'm gonna show you how you can actually extract this hash
and how you can crack it.
Now this particular tutorial or these few tutorials
will be for a Linux type system
and then we'll move on in the next tutorials to a Windows-based system
but remember that we need to obtain root privileges on a system
or admin privileges on a Windows system
before we will be able to do these sort of things
in order to extract the passwords themselves
Why should you do this?
I mean, if you already have root access to the system
well, you might want to extract the system password
primarily because people tend to repeat the passwords
and they might have used it elsewhere
or something of a kind
or your contractor might just say "Hey, I want the password"
"I don't necessarily want just root access...
...but rather instead, I want the password for whatever reasons"
As I said, people tend to distribute them over the other accounts
or something of a kind
and they can use it to log in elsewhere as well.
In any case, I bid you farewell
and I hope to see you see you in the follow-up tutorial.