Pentestit Lab v11 - CLOUD token [writeup]

Na serwerze 192.168.10.1 w /var/tmp znajdujemy dump.pcap z pcapa nalezy wyciagnac hasło do owncloud na 192.168.10.3

z owncloud pobieramy my_store.kdbx


./keepass2john my_store.kdbx > my_store.hash2

my_store:$keepass$*2*100000*222*248fc218b7a47edeecd7a79e8587d5ff2c2221d98efd99837fe198ab0de8a82e*330c91f974cb4df1d015bb15456d382db9c0c2f362909d5cd74f9b951fdee2f7*828fb21b74cda7ae28a21473aaa62384*f974657de86a3aca6faec09804d852a4df5fba5847e54d18e12bd81c33cce528*7ca22042949d204e2f35aae52982946c101679205aa8db0ece2135cdb574170c

usuwamy z pliku początek "my_store:"

$keepass$*2*100000*222*248fc218b7a47edeecd7a79e8587d5ff2c2221d98efd99837fe198ab0de8a82e*330c91f974cb4df1d015bb15456d382db9c0c2f362909d5cd74f9b951fdee2f7*828fb21b74cda7ae28a21473aaa62384*f974657de86a3aca6faec09804d852a4df5fba5847e54d18e12bd81c33cce528*7ca22042949d204e2f35aae52982946c101679205aa8db0ece2135cdb574170c:reajel


PS E:\Tools\hashcat-3.6.0> .\hashcat64.exe -m 13400 -a 0 -w 3 ..\..\pentestit\my_store.hash2 ..\..\rockyou.txt --show
$keepass$*2*100000*222*248fc218b7a47edeecd7a79e8587d5ff2c2221d98efd99837fe198ab0de8a82e*330c91f974cb4df1d015bb15456d382db9c0c2f362909d5cd74f9b951fdee2f7*828fb21b74cda7ae28a21473aaa62384*f974657de86a3aca6faec09804d852a4df5fba5847e54d18e12bd81c33cce528*7ca22042949d204e2f35aae52982946c101679205aa8db0ece2135cdb574170c:reajel

Session..........: hashcat
Status...........: Cracked
Hash.Type........: KeePass 1 (AES/Twofish) and KeePass 2 (AES)
Hash.Target......: $keepass$*2*100000*222*248fc218b7a47edeecd7a79e8587...74170c
Time.Started.....: Sat Sep 16 16:53:59 2017 (29 mins, 47 secs)
Time.Estimated...: Sat Sep 16 17:23:46 2017 (0 secs)
Guess.Base.......: File (..\..\rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.Dev.#1.....:     2621 H/s (146.45ms)
Recovered........: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress.........: 4685824/14343297 (32.67%)
Rejected.........: 0/4685824 (0.00%)
Restore.Point....: 4259840/14343297 (29.70%)
Candidates.#1....: ridebmxdd -> phred2525
HWMon.Dev.#1.....: Temp: 72c Fan: 33% Util:100% Core:1303MHz Mem:3004MHz Bus:16

Started: Sat Sep 16 16:53:54 2017
Stopped: Sat Sep 16 17:23:48 2017
PS E:\Tools\hashcat-3.6.0>

Hasło złamane.

Po zaimportowaniu pliku do keepass v2 uzyskamy dostęp do tokena: Sky_is_Over!