# Password Insecurities | Exploitation
## DescriptionIt looks like DEADFACE is going after the password of one of De Monne's customers: Haily Poutress. She has since changed her password, but De Monne is looking for ways to improve password requirements. De Monne would like you to crack the password from the database leak to determine if Haily's password was secure enough. Submit the flag as flag{password}.
Use the MySQL database dump from Body Count.
Download MySQL database dump
SHA1: 5867eeb1466b31eb8d361061fddd99700fc5d739
Password: d34df4c3
## File - - -You can find the SQL dump in:
ctf-writeups/DEADFACE/files/database/demonne.zip
## Solution- - -We can load the database and get the hash for Haily by running this statement:```sqlSELECT cpw.passwd FROM customers AS cu INNER JOIN cust_passwd AS cpw ON cpw.cust_pass_id = cu.cust_idWHERE cu.first_name = "Haily" AND cu.last_name = "Poutress"```
A team member was working on SQL challenges and they gave me the hash.Thanks to [Quantix](https://github.com/cftad/cftad).
Now that we have the hash we can dump it to a file to crack it with hashcat:```$1$FigUPHDJ$IYWZKYxoKDdLyODRM.kQq.```
We can then crack this password. Let's refer to the [hashcat wiki](https://hashcat.net/wiki/doku.php?id=example_hashes) to get the correct hash mode. The hash seems to resemble the hashes for 400 and 500. After trying both we find out that 500 (md5crypt) is the correct mode. We will use rock you as input
Running this command will give us the flag:`hashcat -m 500 hailie-hash /usr/share/wordlists/rockyou.txt`
```Dictionary cache hit:* Filename..: /usr/share/wordlists/rockyou.txt* Passwords.: 14344385* Bytes.....: 139921507* Keyspace..: 14344385$1$FigUPHDJ$IYWZKYxoKDdLyODRM.kQq.:trustno1       Session..........: hashcatStatus...........: CrackedHash.Name........: md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5)Hash.Target......: $1$FigUPHDJ$IYWZKYxoKDdLyODRM.kQq.Time.Started.....: Tue Oct 19 15:17:14 2021 (1 sec)Time.Estimated...: Tue Oct 19 15:17:15 2021 (0 secs)Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)Guess.Queue......: 1/1 (100.00%)Speed.#1.........:    19225 H/s (11.91ms) @ Accel:512 Loops:125 Thr:1 Vec:8Recovered........: 1/1 (100.00%) DigestsProgress.........: 2048/14344385 (0.01%)Rejected.........: 0/2048 (0.00%)Restore.Point....: 0/14344385 (0.00%)Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:875-1000Candidates.#1....: 123456 -> lovers1Started: Tue Oct 19 15:17:13 2021Stopped: Tue Oct 19 15:17:16 2021```
## Flag- - -flag{trustno1}
- - -Original writeup: https://github.com/TheArchPirate/ctf-writeups/blob/main/DEADFACE/exploitation/password-insecurities.md
