>>1
Write a bash script to brute force it, then let it run on your computer for a few years. Good luck.
Name:
Anonymous2006-10-23 4:29
What's the username? Tell us about the computer and who uses it. Maybe we can guess it using heuristics.
Name:
Anonymous2006-10-23 6:11
gimme ip and ill crack it for you
Name:
Anonymous2006-10-23 8:40
The "passwords" in /etc/shadow are not encrypted, nor are they passwords. They're hashes. They can *not* be reversed. That's the whole idea.
You take a seed (a somewhat random 128 bit number for md5 hashes) and the password and generated a hash (md5 for example) of the value. The hash and the seed get stored in the shadow file. If you want to validate the password, you take the seed from the shadow file and combine it with the puntative password and take the hash of that. If it matches the hash in the shadow
file, the pasword must have matched the original password and it passes. If the hashes don't match, then the passwords didn't match and it fails. You NEVER have to reverse the hash and recover the plaintext password from the hash. The seed is there to insure that if two instances (accounts) use the same password, they DON'T get the same hash (because the seeds are different) making brute force guessing and precomputed dictionary hash attacks neigh unto impossible.
Best you can do is brute force guessing different passwords. John the Ripper or Crack do a pretty fair job against lame passwords. Against good passwords, you don't stand much of a chance. Unfortunately, few people use good passwords...
Name:
Anonymous2006-10-23 9:13
They can *not* be reversed. That's the whole idea.
QFT
BUT!
You can use Brute-Force - just a bit modified.
The Brute-Forcer picks the next combination, you make the hash of that combination, and compare it to the one in the file. If they match, then you have found the password.
But this takes even longer than normal Brute-Force...
Name:
Anonymous2006-10-23 10:07
LOL yeah, good luck. Even on one of the new quad core systems, it would take an average of thirty thousand years to just brute force a decent password (eight characters, upper and lower case, and a couple numbers).
Name:
Anonymous2006-10-23 13:41
>>8
You cannot do that, because each user account uses a different hash seed made from pseudorandom entropy