SuNiNaTaS 14 Solution

문제 풀이 요약

1. 패스워드를 크랙할 계정 발견
2. john the ripper로 리눅스 비밀번호값 크랙킹

문제 풀이

압축을 풀면 passwd, shadow 파일이 나온다. 이 파일은 실제 리눅스 시스템에서 각각 /etc/passwd, /etc/shadow 에 해당하고, passwd 에는 사용자 계정 정보가, shadow 에는 해당 사용자의 비밀번호를 암호화한 값이 저장되어 있다.

1root:x:0:0:root:/root:/bin/bash
2daemon:x:1:1:daemon:/usr/sbin:/bin/sh
3bin:x:2:2:bin:/bin:/bin/sh
4sys:x:3:3:sys:/dev:/bin/sh
5sync:x:4:65534:sync:/bin:/bin/sync
6games:x:5:60:games:/usr/games:/bin/sh
7man:x:6:12:man:/var/cache/man:/bin/sh
8lp:x:7:7:lp:/var/spool/lpd:/bin/sh
9mail:x:8:8:mail:/var/mail:/bin/sh
10news:x:9:9:news:/var/spool/news:/bin/sh
11uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
12proxy:x:13:13:proxy:/bin:/bin/sh
13www-data:x:33:33:www-data:/var/www:/bin/sh
14backup:x:34:34:backup:/var/backups:/bin/sh
15list:x:38:38:Mailing List Manager:/var/list:/bin/sh
16irc:x:39:39:ircd:/var/run/ircd:/bin/sh
17gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
18libuuid:x:100:101::/var/lib/libuuid:/bin/sh
19syslog:x:101:103::/home/syslog:/bin/false
20sshd:x:102:65534::/var/run/sshd:/usr/sbin/nologin
21landscape:x:103:108::/var/lib/landscape:/bin/false
22messagebus:x:104:112::/var/run/dbus:/bin/false
23nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
24mysql:x:105:113::/var/lib/mysql:/bin/false
25avahi:x:106:114::/var/run/avahi-daemon:/bin/false
26snort:x:107:115:Snort IDS:/var/log/snort:/bin/false
27statd:x:108:65534::/var/lib/nfs:/bin/false
28usbmux:x:109:46::/home/usbmux:/bin/false
29pulse:x:110:116::/var/run/pulse:/bin/false
30rtkit:x:111:117::/proc:/bin/false
31festival:x:112:29::/home/festival:/bin/false
32postgres:x:1000:1000::/home/postgres:/bin/sh
33haldaemon:x:113:122:Hardware abstraction layer,,,:/var/run/hald:/bin/false
34suninatas:x:1001:1001::/home/suninatas:/bin/sh

passwd파일에는 맨 아래에 suninatas유저를 확인할 수 있다.

1root:$6$E2loH6yC$0lcZ0hG/b.YqlsPhawt5NtX2jJkSFBK6eaF/wa46d8/3KPs6d45jNHgNoJOl7X1RsOrYsZ.J/BBexJ93ECVfW.:15426:0:99999:7:::
2daemon:x:15426:0:99999:7:::
3bin:x:15426:0:99999:7:::
4sys:x:15426:0:99999:7:::
5sync:x:15426:0:99999:7:::
6games:x:15426:0:99999:7:::
7man:x:15426:0:99999:7:::
8lp:x:15426:0:99999:7:::
9mail:x:15426:0:99999:7:::
10news:x:15426:0:99999:7:::
11uucp:x:15426:0:99999:7:::
12proxy:x:15426:0:99999:7:::
13www-data:x:15426:0:99999:7:::
14backup:x:15426:0:99999:7:::
15list:x:15426:0:99999:7:::
16irc:x:15426:0:99999:7:::
17gnats:x:15426:0:99999:7:::
18libuuid:x:15426:0:99999:7:::
19syslog:x:15426:0:99999:7:::
20sshd:x:15426:0:99999:7:::
21landscape:x:15426:0:99999:7:::
22messagebus:x:15426:0:99999:7:::
23nobody:x:15426:0:99999:7:::
24mysql:!:15426:0:99999:7:::
25avahi:*:15426:0:99999:7:::
26snort:*:15426:0:99999:7:::
27statd:*:15426:0:99999:7:::
28usbmux:*:15426:0:99999:7:::
29pulse:*:15426:0:99999:7:::
30rtkit:*:15426:0:99999:7:::
31festival:*:15426:0:99999:7:::
32postgres:!:15426:0:99999:7:::
33haldaemon:*:15426:0:99999:7:::
34suninatas:$6$QlRlqGhj$BZoS9PuMMRHZZXz1Gde99W01u3kD9nP/zYtl8O2dsshdnwsJT/1lZXsLar8asQZpqTAioiey4rKVpsLm/bqrX/:15427:0:99999:7:::

shadow파일에는 맨 아래에 suninatas유저의 암호화된 비밀번호 값을 확인할 수 있다.

리눅스 패스워드 암호화도 hash에 해당하기 때문에 john the ripper 툴로 크래킹하겠다.

FLAG: iloveu1