It is SUCH a good feeling when something finally clicks.

I’ve been teaching myself for slightly over a month now. Reading all about networking, protocols, revisiting Python, etc.

Sometimes it feels like stumbling around in a dark room until you find a light switch.

I was practicing on the Metasploitable today. Scanned for vulnerabilities, enumerated for usernames and got a shell with exploit/unix/ftp/vsftpd_234_backdoor.

Spent some time browsing around and ended up cat-ing the /etc/shadow.

Yesterday I had gotten partly through the TryHackMe section on using John the Ripper/Jumbo John.

I spent longer than I’d care to admit trying to do a dictionary attack to unencrypt the private key for msfadmin (I changed the password from the default and added it a bit down on the rockyou wordlist.)

I kept getting error messages when trying to run John.

Spent soooo much time on different forums and reading through open and closed issues before it clicked that I need to unshadow the shadow + the encrypted password.

Moral of the story is just read the documentation.

There probably is an easier way to get plaintext passwords (if so please let me know) but I actually yelled “Yes!” aloud and clapped my hands together.

Can’t remember the last time I was so excited about something.

Thanks to you all. This is my first post on here but the number of times I’ve looked up issues on this sub and found answers is quite a lot!

submitted by /u/koreanjc
[link] [comments]

from hacking: security in practice https://ift.tt/nNE5twT