DEV Community

Md. Ibrahim Reza Rabbi
Md. Ibrahim Reza Rabbi

Posted on

Recover Lost Linux Password Using Yescrypt Hash Cracking (Kali & Shadow File Guide)

#cybersecurity #password #linux #hash

In Linux systems, user passwords are not stored in plain text. Instead, they are stored as cryptographic hashes inside the /etc/shadow file. Modern distributions use yescrypt ($y$), a memory-hard password hashing algorithm designed to resist brute-force and GPU-based attacks.

Since hashing is a one-way function, passwords cannot be decrypted. Recovery is done through hash cracking, where candidate passwords are hashed and compared against the stored value. Tools such as John the Ripper Jumbo are commonly used for this process.

Because yescrypt is computationally expensive, blind brute-force attacks are inefficient. The most practical approach is a dictionary attack, where prebuilt wordlists (such as rockyou.txt) are used along with mutation rules. In real-world CTFs, success depends heavily on contextual guessing, such as usernames, system themes, or predictable password patterns.

Hash Location in Linux

Password hashes are stored in /etc/shadow with the following structure:

username:hash:lastchg:min:max:warn:inactive:expire:reserved
Enter fullscreen mode Exit fullscreen mode

Example entry:

kali:$y$j9T$zY1oKFxJlTgP2WcJhzbNl1$xhkUmB8R9fzETc/1kgL/nOPcWFTvhn17clxXCgyFjpC:19953:0:99999:7:::
Enter fullscreen mode Exit fullscreen mode

Breakdown:

  • kali → username
  • $y$j9T$... → password hash (used for cracking only)
    • $y$ → yescrypt algorithm
    • j9T → cost parameters
    • salt → zY1oKFxJlTgP2WcJhzbNl1
    • hash → xhkUmB8R9fzETc/...
  • Remaining fields → password policy metadata

For cracking purposes, only the hash portion is required:

$y$j9T$zY1oKFxJlTgP2WcJhzbNl1$xhkUmB8R9fzETc/1kgL/nOPcWFTvhn17clxXCgyFjpC
Enter fullscreen mode Exit fullscreen mode

Now, before cracking, you also need to get that hash from your system :)

For this purpose, we will choose the Autopsy software, which is a free forensic tool. Install it and open an empty case. When complete, follow the image instructions.

Note: The given process works for Disk image type or VM type file forensics.


Now, select the image contain file and the image ->

Then, go next , next. Then it start the analyze and it will take some time when it is finish by the given image way you will be able to get the shadow file :')->

Step 1: Prepare Hash File 

echo '$y$j9T$zY1oKFxJlTgP2WcJhzbNl1$xhkUmB8R9fzETc/1kgL/nOPcWFTvhn17clxXCgyFjpC' > hash.txt
Enter fullscreen mode Exit fullscreen mode

Now, for cracking I will prefer John the ripper. If, default kali not work then you may use the john jumbo link & install_explain_link. After, it is installed let's follow the below steps

Step 2: Dictionary Attack 

john --format=crypt --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
Enter fullscreen mode Exit fullscreen mode

Check results:

john --show hash.txt
Enter fullscreen mode Exit fullscreen mode

Step 3: When Dictionary Attack Fails

If the password is not present in the wordlist, more advanced techniques are required.

1. Sequential brute force (incremental attack)

This method tries all possible combinations:

john --format=crypt --incremental hash.txt
Enter fullscreen mode Exit fullscreen mode

2. Custom wordlist generation using Crunch

Crunch allows generation of targeted wordlists instead of random brute force.

Basic syntax:

crunch <min> <max> <charset> -o wordlist.txt
Enter fullscreen mode Exit fullscreen mode

Examples:

Numeric-only wordlist (4–6 digits):

crunch 4 6 0123456789 -o numbers.txt
Enter fullscreen mode Exit fullscreen mode

Lowercase alphabet wordlist (3–5 characters):

crunch 3 5 abcdefghijklmnopqrstuvwxyz -o alpha.txt
Enter fullscreen mode Exit fullscreen mode

Mixed pattern wordlist:

crunch 6 6 abcdef123 -o custom.txt
Enter fullscreen mode Exit fullscreen mode

3. Use custom wordlist with John 

john --format=crypt --wordlist=custom.txt hash.txt
Enter fullscreen mode Exit fullscreen mode

Summary

  1. Start with dictionary attack using rockyou.txt
  2. Apply rule-based mutations
  3. If unsuccessful, use custom wordlists (Crunch)
  4. Use incremental brute force only as a last resort
  5. Always prioritize contextual password guessing over blind attacks

Key Insight

Yescrypt is designed to resist brute-force attacks. Effective cracking depends not on raw computation, but on intelligent wordlist construction and contextual analysis. This is why dictionary-based attacks remain the most practical method in CTFs and security testing environments.

Top comments (0)