CTF Room: Crack the Hash

• Link to room
• Badge earned: Hash Cracker
• Difficulty: Easy
• Category: Cryptography, Hash Cracking

1. Brief

Crack the Hash is a TryHackMe room focused on identifying common hash formats and recovering plaintext passwords.

For most of these hashes, I used CrackStation first because it is quick for common unsalted hashes. When the hashes were slower, salted, or not available through online lookup, I switched to John the Ripper and Hashcat with rockyou.txt.

2. Level 1

The first level contains a set of easier hashes that can mostly be cracked with online lookup tools.



This hash was cracked using CrackStation.

Answer

bash



This hash was cracked using CrackStation.

Answer

bash



This hash was cracked using CrackStation.

Answer

bash

$2y$12$Dwt1BZj6pcyc3Dy1FWZ5ieeUznr71EeNkJkUlypTsgbX1H68wsRom

This is a bcrypt hash. Bcrypt is intentionally slow, so this one is better suited to a local cracking tool such as Hashcat.

Hashcat Command

bashhashcat -m 3200 -a 0 bcrypt.txt /usr/share/wordlists/rockyou.txt

Answer

bash



This hash was cracked using CrackStation.

Answer

bash

3. Level 2

Level 2 increases the difficulty. The room notes that all answers are in the classic rockyou.txt password list, so Hashcat is useful here.



This hash was cracked with rockyou.txt.

Answer

bash



This hash was cracked with rockyou.txt.

Answer

bash

$6$aReallyHardSalt$6WKUTqzq.UQQmrm0p/T7MPpMbGNnzXPMAXi4bJMl9be.cfi3/qxIf.hsGpS41BqMhSrHVXgMpdjS6xeKZAs02.

This is a SHA-512 crypt hash. The $6$ prefix identifies the format, and the salt is included inside the hash.

Hash Details

bashHash type: SHA-512 crypt
Hashcat mode: 1800
Salt: aReallyHardSalt

Hashcat Command

bashhashcat -m 1800 -a 0 hash.txt /usr/share/wordlists/rockyou.txt

Answer

bash



This is a salted SHA1 hash using the format sha1($pass.$salt).

Hash Details

bashHash type: salted SHA1
Hashcat mode: 110
Salt: tryhackme

Hashcat Command

bashecho ':tryhackme' > sha1salt.txt
hashcat -m 110 -a 0 sha1salt.txt /usr/share/wordlists/rockyou.txt

Answer

bash

4. Useful Hashcat Modes

These were the main Hashcat modes needed for the room:

bash# SHA-512 crypt
hashcat -m 1800 -a 0 hash.txt /usr/share/wordlists/rockyou.txt

# Salted SHA1: hash:salt
hashcat -m 110 -a 0 sha1salt.txt /usr/share/wordlists/rockyou.txt

# bcrypt
hashcat -m 3200 -a 0 bcrypt.txt /usr/share/wordlists/rockyou.txt

5. Summary

This was a good beginner-friendly hash cracking room. The first level can mostly be completed with CrackStation, which is useful for quickly checking common hashes.

The second level is where local cracking becomes more useful. Hashcat makes it much easier to handle slower formats such as bcrypt, Unix-style SHA-512 crypt hashes, and salted hashes where the salt needs to be supplied in the correct format.