PASSWORD ATTACK | ACADEMY - Credential Hunting in Linux

same problem here. no idea.
also tried to enum smb share and ftp password, but cannot mount smb share.

update:

  1. according to hint, filter some password out from password.list
  2. apply supplied rule to password. username is the same but lowercased.
  3. hydra to ssh port, then you will get it

hey man, how did you run the tool if Python2 & 3.9 are not installed in the victim machine?

hey bud, how did you solve the compatible versions between the decrypt tool and python3.9?

use wget or cURL…

The thing is how could we do it without using the hint?

2 Likes

I’m having the same issue, I did what you’ve done with the username in lowercase and nothing. Anyone else went through this?

after some random attempts one worked. Maybe it had to do with the number of threads being used :thinking:

For whoever still struggling mutation for the password and find the login cred for kira to ssh the target and use tool from the section it worked with me after several tries, thanks for the guys!!

Has someone found a way to enumerate the available credentials and passwords without the hint?

1 Like

nevermind i solved it it just take some time

it not work with lowercase, so i use kira pass , and uppercase and lowercase.
than it worked , with same provided rule

i log in into the ssh server found the passwd.bak then what? wget doesnt work for some reason

i have the same problem, any recommendation???

I know how to respond to the challenge, however I cannot transfer the files from the victim machine to my attack machine. I tried the command to create the share with smbserver.py but it doesn’t work :frowning:

I am using HTB instance

PLEASE HELP

I ran into problems running pypykatz - had bunch of python errors. What fixed my issue is that tried dumping the file from windows explorer instead of using powershell. It will give you *.DMP extension. That dump ended up running fine on pypykatz. Hope this helps someone.

Thank you for this! you are a kind and gentle soul - also a great reminder of the mindset required in this field.

Sorry for the necro bump but I’ve been stuck on this challange for 3 days. I was able to locate the password and shadow file for will. I then transferred the password file back to the host machine, can’t transfer tue shadow file.

I located Kira’s ssh files and ran the rsa file through ssh2john and john the ripper but the password received doesn’t seem to work as a sudo password.

At this point I’m just spitballing trying to think of what to try next.

Can anyone help to point me in the right direction please.

ok so as it always happens, after i posted this i ended up figuring out a way to get it.

For anyone who needs a hint… think of a different way to get the firefox_decrypt and lasagna scripts onto the target machine.

I had a longer hint written out but it got amended by mods, I wasn’t sure how helpful I was allowed to be.

.

1 Like

that’s what im trying right now, wish me luck

1 Like

I have same problem, I tried too with -t 48 and without -t option, but I received the same error

   ...
   [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
   [WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
   [DATA] max 16 tasks per 1 server, overall 16 tasks, 2096 login tries (l:1/p:2096), ~131 tries per task
   [DATA] attacking ssh://10.129.251.66:22/
   [STATUS] 146.00 tries/min, 146 tries in 00:01h, 1952 to do in 00:14h, 16 active
   [STATUS] 112.67 tries/min, 338 tries in 00:03h, 1760 to do in 00:16h, 16 active
   [STATUS] 105.57 tries/min, 739 tries in 00:07h, 1360 to do in 00:13h, 16 active
   [STATUS] 106.25 tries/min, 1275 tries in 00:12h, 824 to do in 00:08h, 16 active
   [STATUS] 104.82 tries/min, 1782 tries in 00:17h, 318 to do in 00:04h, 16 active
   1 of 1 target completed, 0 valid password found
   [WARNING] Writing restore file because 6 final worker threads did not complete until end.
   [ERROR] 6 targets did not resolve or could not be connected
   [ERROR] 0 target did not complete
   Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-03-29 00:46:07

Someone have resolved?