 Hello everyone, welcome back to another simple and short video Explaining and depicting how I created and solved some of the challenges that I put together for a local capture the flag Competition for my school cyber team So I'm actually going to skip over the XOR challenge because the way that I intended this to be solved was with a tool that we created in-house So I don't I don't think I'll actually just demonstrate the one for you I'll just hop on over it and we'll move on to the I lost my password challenge So this one's pretty simple. It says okay. Oh, no, I've lost my password. Can you help me retrieve it? And this actually isn't in the usual flag format. It's just a password So you'd note here that we have a big et cetera shadow or et cetera et cetera password file And it's actually already unshadowed for us. Et cetera shadow doesn't hide the hash with a star We see the full hash of this user John which is meant to be a hint That oh you should be using the John the Ripper utility to actually go ahead and solve this so We would actually go ahead and download this I'll hop over to my terminal to kind of explain how we run through it So I'll hip over to I lost my password and there's our hashes So what I would end up doing is actually using John the Ripper Which if you have not heard of him, I recommend doing some research because the whole point of the CTF was to show off John the Ripper as the password cracker. So So other individuals get to know this tool and know that it exists and how to use it that kind of thing so We do want to be able to crack the password and we're gonna do a dictionary attack because a brute force attack is very long It would make more sense to initially use a dictionary file. So That was the tactic that I wanted them to kind of hopefully figure out but the way we end up using a dictionary file With John is actually using a word list Which I think we denote with dash L or Dash list maybe yeah word list So you can use the word list and we I'm gonna set that equal to where I store the rock you Dot text file and then I just give it the hashes and Looks like it already created this. I might have it in my home folder Let's just remove those. So now I'd be able to run the program just fine It's got to be in dictionary files, that's where I actually store the rock you text file and If you haven't heard if you haven't seen it or heard of it before John the Ripper dictionary files one of those sites that I ended up seeing on Stack Overflow they note that Roland Bowes has a lot of good password lists and I think they say that Rock you dot text is pretty much the best list available You probably can't see it. It's super small, but it's huge and it's stolen on encrypted stuff So alright, so John the Ripper is finished and it's noted that white rose is the password So just as a simple brute force not not not brute force, but a dictionary attack on it So white rose would be the password of the user which we just managed to Crack and we would submit that as our flag and we get that 100 points awesome. So super easy again Simple stuff just wanting to show off those tools like John the Ripper and how to use them And so the individual will suffer for a little bit if they've never seen it before and figure it out So and hopefully learn something in the process. Okay. Thanks for watching everyone. I'll see you the next video