Linux Password Cracking (Shadow Files)

Extracting and cracking Unix/Linux authentication credentials

What You'll Discover

🎯 Why This Matters

Linux and Unix systems power the majority of web servers, cloud infrastructure, and critical enterprise systems. Understanding how to extract and crack Linux passwords is essential for penetration testing, security audits, and incident response. Unlike Windows, Linux uses strong password hashing by default (SHA-512, yescrypt, Blowfish), but weak passwords remain vulnerable despite robust cryptography. Security professionals need Linux password cracking skills to assess password policies on servers, evaluate the impact of physical access attacks, and demonstrate that strong hashing alone doesn't guarantee security without proper password requirements.

🔍 What You'll Learn

You'll master Linux credential extraction from /etc/shadow, understand the format and security of SHA-512, SHA-256, MD5, and yescrypt password hashes, learn to use unshadow to combine /etc/passwd and /etc/shadow files, and develop skills in cracking Linux passwords with John the Ripper and hashcat. These techniques are critical for Linux server penetration testing, assessing password policies on production systems, recovering access to locked accounts, and understanding how attackers pivot through Linux infrastructure using compromised credentials.

🚀 Your First Win

In the next 15 minutes, you'll understand how Linux stores passwords in /etc/shadow, learn to identify different hash types from their format, and know exactly how security professionals crack Linux credentials during authorized assessments.

🔧 Try This Right Now

Let's examine how Linux password hashes are stored in the /etc/shadow file:

# View shadow file (requires root)
sudo cat /etc/shadow

# Format: username:hash:lastchange:min:max:warn:inactive:expire:reserved
# Example entry:
# hdna:$6$rounds=5000$salt$hash:19000:0:99999:7:::

# Hash format breakdown:
# $6$ = SHA-512 (most common modern Linux)
# $5$ = SHA-256
# $1$ = MD5 (legacy, weak)
# $2a$/$2y$ = Blowfish/bcrypt (strong)
# $y$ = yescrypt (newest, very strong)

# View your own user info in passwd
cat /etc/passwd | grep $USER

# Passwd format: username:x:UID:GID:comment:home:shell
# The "x" means password is in /etc/shadow

# For pentesting, you'll extract both files:
# /etc/passwd - contains usernames and UIDs
# /etc/shadow - contains password hashes

# Example shadow hash breakdown:
# $6$rounds=5000$saltsaltsa$verylonghashstringhere

# $6$ = Hash algorithm (SHA-512)
# rounds=5000 = Iteration count (default 5000)
# saltsaltsa = Random salt (prevents rainbow tables)
# verylonghash = The actual password hash

You'll see: Linux password hashes use strong algorithms like SHA-512 with salting and thousands of iterations (rounds), making them much harder to crack than NTLM. The salt ensures identical passwords produce different hashes across systems. Understanding this format is fundamental to Linux password attacks.

Skills You'll Master

Understanding Linux Authentication

Linux password security has evolved significantly from early Unix systems. Modern Linux distributions use SHA-512 crypt by default, applying 5,000 rounds of SHA-512 hashing with a random salt. The /etc/shadow file stores these hashes with restricted permissions (readable only by root), separating password data from the publicly readable /etc/passwd file. This architecture provides strong security - SHA-512 with salting and iteration counts makes rainbow table attacks impossible and dramatically slows brute force attempts. However, the fundamental truth remains: weak passwords crack regardless of hash strength. An 8-character password cracks in days or weeks; complex passwords under 12 characters remain vulnerable to determined attackers.

The Linux shadow file documentation details the password storage format, but understanding the security implications requires deeper analysis. SHA-512 crypt processes each password guess through 5,000 iterations of SHA-512, dramatically slowing cracking compared to NTLM (which uses single MD4). Modern GPUs crack NTLM at 100 billion attempts/second but only achieve 200,000-500,000 SHA-512 attempts/second - a 200,000x difference. This computational cost protects against brute force but can't compensate for dictionary-based passwords or predictable patterns.

Newer distributions are transitioning to yescrypt, which provides even stronger protection through memory-hard key derivation. The yescrypt algorithm requires significant memory allocation during hashing, making GPU and ASIC acceleration less effective. However, adoption remains limited, and most Linux systems still use SHA-512 crypt. Organizations should understand that while Linux password hashing is significantly stronger than Windows NTLM, the ultimate security depends on password complexity and length. A 16+ character passphrase on Linux becomes practically uncrackable with current technology, while an 8-character password on the same system may crack within days.

Tools and Techniques

🔨 unshadow: Combining Password Files

The unshadow utility (part of John the Ripper) combines /etc/passwd and /etc/shadow into a single file suitable for password cracking. This step is essential because John needs both username information (from passwd) and password hashes (from shadow) to perform cracking operations.

# Extract passwd and shadow files (requires root)
# During pentest after gaining root access:
sudo cp /etc/passwd passwd.txt
sudo cp /etc/shadow shadow.txt

# Or extract from physical access/live boot:
# Boot from USB → mount target filesystem
sudo mount /dev/sda1 /mnt
sudo cp /mnt/etc/passwd passwd.txt
sudo cp /mnt/etc/shadow shadow.txt

# Combine files with unshadow
unshadow passwd.txt shadow.txt > unshadowed.txt

# Examine the combined output
cat unshadowed.txt

# Format: username:hash:UID:GID:comment:home:shell
# Example:
# hdna:$6$rounds=5000$salt$hash:1000:1000:HackerDNA User:/home/hdna:/bin/bash

# Now this file is ready for John the Ripper or hashcat
# The tool can see both usernames and their corresponding hashes

# Target specific users (extract only certain accounts)
grep -E "^(root|hdna|admin)" unshadowed.txt > targets.txt

Unshadow performs a simple but critical function - it matches username entries from /etc/passwd with their corresponding password hashes from /etc/shadow. Without this step, John the Ripper can't associate usernames with hashes, limiting attack effectiveness. During penetration tests, prioritize cracking root and sudo-capable accounts, as these provide immediate privilege escalation.

⚡ John the Ripper: Linux Password Specialist

John the Ripper excels at Linux password cracking with automatic format detection, optimized SHA-512 implementations, and powerful rule engines. It's the standard tool for Linux/Unix password auditing and provides excellent performance on CPU-based systems.

# Basic dictionary attack
john --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt

# John automatically detects hash type (SHA-512, SHA-256, MD5, etc.)
# No need to specify format for standard Linux hashes

# Rule-based attack with mutations
john --rules --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt

# Show cracked passwords
john --show unshadowed.txt

# Format shows: username:password:UID:GID:...
# Example: hdna:password123:1000:1000:...

# Incremental mode (brute force)
# Very slow for SHA-512 but effective for short passwords
john --incremental unshadowed.txt

# Target specific users
john --users=root,hdna --wordlist=rockyou.txt unshadowed.txt

# Custom rules for Linux servers
# Common patterns: username-based, server names, admin passwords
echo '[List.Rules:LinuxRules]' > linux.conf
echo 'cAz"[0-9][0-9][0-9][0-9]"' >> linux.conf  # Capitalize + year
echo 'cAz"[!@#]"' >> linux.conf  # Capitalize + special char
echo 'l Az"[0-9]"' >> linux.conf  # Lowercase + append digit

john --rules=LinuxRules --wordlist=server_terms.txt unshadowed.txt

# Session management for long attacks
john --session=hdna_linux unshadowed.txt
john --restore=hdna_linux

# Specify format explicitly (if needed)
john --format=sha512crypt unshadowed.txt

John the Ripper's automatic format detection handles SHA-512, SHA-256, MD5, Blowfish, and yescrypt hashes without manual configuration. The official John the Ripper documentation provides comprehensive guides for advanced usage. For Linux password audits, rule-based attacks prove highly effective as users often base passwords on usernames, server names, or organizational terms.

🚀 hashcat: GPU-Accelerated Linux Cracking

Hashcat provides GPU acceleration for Linux password cracking, dramatically improving performance compared to CPU-based cracking. While SHA-512 is computationally expensive, modern GPUs still provide significant speed advantages over CPUs.

# Hashcat modes for Linux:
# 1800: SHA-512 crypt (sha512crypt $6$) - most common
# 7400: SHA-256 crypt (sha256crypt $5$)
# 500:  MD5 crypt (md5crypt $1$) - legacy
# 3200: Blowfish/bcrypt ($2a$, $2y$)
# 7900: SHA-512 APR (Apache htpasswd)

# Extract hashes for hashcat (skip unshadow step)
# Just extract the hash field from shadow file
sudo cat /etc/shadow | grep -v "^[#\*!]" | cut -d: -f2 > hashes.txt

# Dictionary attack on SHA-512 hashes
hashcat -m 1800 -a 0 hashes.txt rockyou.txt

# Rule-based attack with password mutations
hashcat -m 1800 -a 0 hashes.txt rockyou.txt -r rules/best64.rule

# Mask attack for known patterns
# Example: 8-10 characters, starts with capital
hashcat -m 1800 -a 3 hashes.txt '?u?l?l?l?l?l?l?d?d'

# Hybrid attack: wordlist + mask
hashcat -m 1800 -a 6 hashes.txt rockyou.txt '?d?d?d?d'

# Show cracked passwords
hashcat -m 1800 hashes.txt --show

# Benchmark SHA-512 cracking speed
hashcat -m 1800 -b

# Typical speeds:
# RTX 3090: 400-500k H/s (400,000 hashes/second)
# RTX 4090: 800k-1M H/s
# CPU (8-core): 5k-10k H/s

# Compare to NTLM (mode 1000):
# Same GPU: 100+ billion H/s
# SHA-512 is 200,000x slower to crack!

# Workload tuning for maximum performance
hashcat -m 1800 -a 0 hashes.txt rockyou.txt -w 3

# For legacy MD5 crypt (much faster)
hashcat -m 500 -a 0 hashes.txt rockyou.txt

GPU acceleration provides substantial performance improvements for SHA-512 cracking, but the algorithm remains computationally expensive. A high-end GPU achieving 1 million SHA-512/sec would need approximately 3 years to exhaust all 8-character passwords using full character space. This stark reality underscores why strong hashing matters - it makes brute force attacks impractical even with powerful hardware.

🎯 Physical Access and Rescue Mode Techniques

Physical access to Linux systems enables password file extraction without network authentication. Security assessors use these techniques to demonstrate physical security vulnerabilities and test password strength offline.

# Method 1: Boot from USB/Live CD
# 1. Boot system from USB stick (Kali Linux, Ubuntu Live)
# 2. Mount target filesystem
sudo mkdir /mnt/target
sudo mount /dev/sda1 /mnt/target

# 3. Extract password files
sudo cp /mnt/target/etc/passwd passwd.txt
sudo cp /mnt/target/etc/shadow shadow.txt

# 4. Unmount and reboot
sudo umount /mnt/target

# Method 2: Single-user mode (if GRUB not password protected)
# 1. At GRUB menu, press 'e' to edit boot parameters
# 2. Find line starting with 'linux' or 'linux16'
# 3. Add 'single' or 'init=/bin/bash' to end of line
# 4. Press Ctrl+X or F10 to boot
# 5. System boots to root shell without password
# 6. Remount filesystem read-write:
mount -o remount,rw /

# 7. Extract password files or reset passwords directly
cp /etc/passwd /media/usb/
cp /etc/shadow /media/usb/

# Method 3: Rescue mode via kernel parameters
# Similar to single-user, but add: rd.break
# This drops to emergency shell before mounting root

# Method 4: Extract from backups
# Check common backup locations:
ls /var/backups/  # Ubuntu/Debian store shadow backups here
ls /backup/
ls /root/backup/

# Sometimes find unencrypted backups with password files
tar -tzf backup.tar.gz | grep shadow

Physical access attacks demonstrate why organizations need full-disk encryption (LUKS, dm-crypt) and GRUB password protection. Without these controls, an attacker with physical access can extract password files in minutes. Security assessments should test both password strength and physical security controls to provide comprehensive risk evaluation.

Defensive Countermeasures

🛡️ Strong Password Policies for Linux

Linux password policies should account for SHA-512's computational cost while maintaining practical usability. The Linux password policy configuration guide details implementation, but organizations should exceed minimum requirements for privileged accounts.

• Minimum 12 characters: Balanced security for regular accounts
• Root/sudo accounts 16+ characters: Privileged accounts need maximum protection
• Enforce via PAM: Use pam_pwquality module for complexity requirements
• Increase SHA-512 rounds: Default 5,000 rounds can be increased to 100,000+ in /etc/login.defs

🔐 Physical Security and Boot Protection

Physical access undermines password security regardless of hash strength. Organizations must implement physical security controls and boot-level protections to prevent unauthorized password extraction.

• Full-disk encryption: LUKS encryption protects against offline password extraction
• GRUB password protection: Prevent boot parameter modification and single-user mode
• BIOS/UEFI passwords: Prevent booting from external media
• Secure Boot: Verify boot components haven't been tampered with

⚡ SSH Key Authentication

SSH key-based authentication eliminates password transmission over the network and provides stronger security than password authentication. Organizations should transition to key-based authentication for remote access.

• Disable password authentication: Set "PasswordAuthentication no" in /etc/ssh/sshd_config
• Require SSH keys: ED25519 or RSA 4096-bit keys for all remote access
• Certificate-based authentication: SSH certificates for large deployments
• Two-factor authentication: PAM modules like Google Authenticator for additional protection

🔍 Audit Logging and Monitoring

Comprehensive logging detects password attack attempts and unauthorized access. Linux provides extensive logging capabilities through syslog, auditd, and authentication logs that security teams should monitor continuously.

• Monitor /var/log/auth.log: All authentication attempts logged with timestamps
• Auditd for shadow access: Alert on /etc/shadow file access attempts
• Failed login monitoring: Use fail2ban to block brute force attempts
• Sudo command logging: Track all privileged command execution

FAQ

Linux Password Cracking Basics

Technical Implementation

Practical Applications

🎯 You've Got Linux Password Cracking Down!

You now understand Linux password storage in /etc/shadow, can extract and combine password files with unshadow, and know how to crack SHA-512, SHA-256, and legacy MD5 hashes using John the Ripper and hashcat. These skills are essential for Linux server penetration testing, password policy auditing, and understanding how the strong hashing in Linux systems compares to Windows NTLM authentication.

Ready to master advanced password cracking techniques and optimization