Homework 3

Due Date: 2026-07-27 23:59:59

Homework 3

Introduction

This homework lab will primarily cover password cracking. We will be using both hashcat and john to crack passwords and passphrases.

What you must do

Everything in questions 1 and 2 uses the files in the hw3-files/ directory of the course-environment repo and one wordlist: hw3-dict.txt (10,000 entries). If you have already cloned introsec-env to set up your VM, the files are in its hw3-files/ directory. Every password below is crackable with that dictionary and the right attack — do not use rockyou.txt or any other list. The skill being graded is picking the correct attack, not the biggest wordlist.

The concepts and syntax for every attack type here are on the Hash Cracking page — read it first.

⚠️ These are practice artifacts for this course only. Cracking hashes, archives, or keys you were not given permission to crack is a crime under the CFAA. Everything here was generated for you to attack legally.

Worked example (do this first, to confirm your setup)

Before the graded challenges, reproduce this end-to-end so you know your tools work and you understand the expected write-up format. Create a three-line wordlist and an MD5 hash of a word in it, then crack it:

❯ printf 'winter\nspring\nsummer2026\nautumn\n' > demo.dict
❯ echo -n summer2026 | md5sum | cut -d' ' -f1 > demo.hash
❯ cat demo.hash
2e49d77248f05d5b9c0fa6467dc50fea

❯ hashcat -m 0 -a 0 demo.hash demo.dict
...
❯ hashcat -m 0 -a 0 demo.hash demo.dict --show
2e49d77248f05d5b9c0fa6467dc50fea:summer2026

For every challenge below, your hw3.md must record, in this style: the hash or file, the exact command you ran, and the recovered password or flag. A cracked password with no command shown earns no credit.

Crack all eight challenges in hw3-files/, using only hw3-dict.txt. Each yields a flag — for the raw hashes the flag is the password; for the archive, document, and key it is the CS491{...} string (or passphrase) you recover.

#	File	Hint
a	`01-fast.hash`	An NTLM (`-m 1000`) hash of one dictionary word. A straight dictionary attack.
b	`02-slow.hash`	A sha512crypt ( $6$ , `-m 1800`) hash of one dictionary word. *Same difficulty of password* as (a)** — time both runs and compare.
c	`03-customrule.hash`	An MD5 of a dictionary word with leet-speak letter→symbol substitutions (other than a→@) and a short suffix of the form `CX`, where `C` is from `!@#$%^&()_+~` and `X` is a numerical digit. No shipped rule file makes it; write your own rule*.
d	`04-mask.hash`	An MD5 of a password with the structure three uppercase letters, then three digits (like `ABC123`). Use a mask (`-a 3`).
e	`05-hybrid.hash`	An MD5 of a dictionary word followed by two digits and one symbol. Use a hybrid attack (`-a 6`).
f	`06-challenge.7z`	A password-protected 7-Zip archive. Convert with `7z2john`, crack with `john`. Open it to read the flag.
g	`07-challenge.docx`	A password-protected Word document. Convert with `office2john`, crack with `hashcat -m 9600` or `john`. The flag is the document’s only content.
h	`08-id_ed25519`	A passphrase-protected OpenSSH key. Convert with `ssh2john`, crack with `john`. The passphrase is one dictionary word.

Hints that apply throughout:

Identify unknown hashes with hashid or hashcat --identify.
The shell interprets $, !, #, and *; wrap masks and rules in single quotes.
office2john prints filename:$office$...; hashcat -m 9600 needs the hash without the filename: prefix (cut -d: -f2-). john accepts the whole line.
Some *2john outputs (the 7-Zip one here) crack reliably with john but not hashcat — that is expected.

Reflect on the fast-vs-slow pair. Challenges (a) and (b) encode passwords of the same difficulty in a fast hash (NTLM) and a slow one (sha512crypt). In your hw3.md, report the wall-clock time each took (use time … or Hashcat’s status output), state the ratio, and explain in two or three sentences why the slow hash is the defender’s tool — reference the work factor and a modern KDF (bcrypt, scrypt, or Argon2). See the Hash Cracking page’s takeaways for the framing.
One of the best parts of john is the ability to convert many different things to a format that john can understand. This is done with one of the files /usr/share/john/ on your kali VM.

Use the following script to select 20 random lines from the rockyou.txt wordlist and save them to a file called rockyou20.txt:
```
BEGIN {
    if (!n) {
        print "Usage: sample.awk -v n=[size]"
        exit
    }
    t = n
    srand()

}

NR <= n {
    pool[NR] = $0
    places[NR] = NR
    next

}

NR > n {
    t++
    M = int(rand()*t) + 1
    if (M <= n) {
        READ_NEXT_RECORD(M)
    }

}

END {
    if (NR < n) {
        print "sample.awk: Not enough records for sample" \
            > "/dev/stderr"
        exit
    }
    # gawk needs a numeric sort function
    # since it doesn't have one, zero-pad and sort alphabetically
    pad = length(NR)
    for (i in pool) {
        new_index = sprintf("%0" pad "d", i)
        newpool[new_index] = pool[i]
    }
    x = asorti(newpool, ordered)
    for (i = 1; i <= x; i++)
        print newpool[ordered[i]]

}

function READ_NEXT_RECORD(idx) {
    rec = places[idx]
    delete pool[rec]
    pool[NR] = $0
    places[idx] = NR  
} 
```
Run this script with awk -f sample.awk -v n=20 /usr/share/wordlists/rockyou.txt > rockyou20.txt. Yes, I know I could have just used shuf -n 20, but this is more fun.
- Use the script again on rockyou20.txt to select 3 random lines, combine those with spaces, and use that as the keyphrase for an ssh key of type ed25519.
- Use python3 /usr/share/john/ssh2john.py to convert the key to a format that john can understand.
- Use hashcat to generate all possible 3-word passphrases from the rockyou20.txt wordlist and crack the key. You will need to look at the options for hashcat to generate all possible 3-word passphrases. Hints:
  - Look at the hashcat attack modes. One of them is ‘combination’.
  - You will need to use the --stdout option to generate the passphrases.
  - You will likely need to run the command multiple times on incremental word lists to get all three-word combinations.
- Use john to crack the key. You will need to look at the options for john to use a wordlist.
Record this whole process (commands used) in your hw3.md file.
You used hashcat to generate the combinations above. Write a python script that will do the same thing.

Submission

Once you have completed the above, you should have a markdown file in your repo called hw3/hw3.md that contains all the requested information. Commit and push this to your repo. Also commit and include any requested screenshots. Once you have done this, you can consider the assignment submitted.

In order to include output from your shell, see the technical writing page for some basic instructions. For instance:

❯ ps -efH --no-header | awk '{print $1}' | grep -Ev $(python3 -c 'import sys; print("|".join(sys.argv[1:]))' $(cut -f1 -d':' /etc/passwd)) | sort | uniq -c | sort -rn | head -n 11
USER01
USER02
USER03
USER04
USER05
USER06
USER07
USER08
USER09
USER10
USER11

Could be created with the following markdown:

```sh
❯ ps -efH --no-header | awk '{print $1}' | grep -Ev $(python3 -c 'import sys; print("|".join(sys.argv[1:]))' $(cut -f1 -d':' /etc/passwd)) | sort | uniq -c | sort -rn | head -n 11
USER01
USER02
USER03
USER04
USER05
USER06
USER07
USER08
USER09
USER10
USER11
```