UNIX Shadow Password Cracker

Project Overview

The UNIX Shadow Password Cracker is a command-line security auditing utility developed in Python. It is designed to evaluate the strength of local system accounts on legacy UNIX and Linux environments by programmatically "cracking" password hashes stored in the critical `etc / shadow` file.

This tool automates the retrieval of user credentials, extracts the salt value essential for hashing, and executes a dictionary attack by iteratively comparing locally generated hashes against the compromised shadow entries, highlighting accounts with weak or common passwords.

Technical Architecture & Auditing Pipeline

The script implements a structured offline cracking loop, utilizing a multi-stage approach to reverse-engineer credential hashes:

Key Engineering Principles

• Shadow File Parsing: The tool uses system I/O stream readers to sequentially parse the critical UNIX shadow file format. It programmatically isolates specific fields by splitting lines using colon delimiters, accurately extracting the distinct `username` (field 0) and the legacy `crypt()` password hash (field 1).
• Salt Extraction and Re-Hashing: To handle the DES-crypt algorithm, the script programmatically extracts the 2-character "salt" directly from the beginning of the compromised hash string. It then passes this critical salt value into the `crypt.crypt()` library to generate matching test hashes for comparison.
• Dictionary Attack Vector: The tool relies on a large, offline "wordlist" dictionary (`passwords.txt`). It iterates through every entry in this file, generating corresponding hashes with the extracted system salt. A valid password is confirmed only when the generated test hash mathematically matches the original hash from the system shadow file.

Key Python Implementation

Below is the core of the cryptographic reversal routine, managing input stream reading, string manipulation, and the crucial hash comparison loop:

# Standard Python library for traditional UNIX crypt hashing

def testPass(cryptPass):
    # Extract the legacy DES salt (first two characters)
    salt = cryptPass[0:2]

    # Iterate through every potential candidate in the wordlist
    dictFile = open('passwords.txt', 'r')
    for word in dictFile.readlines():
        word = word.strip('\n')
        # Compute the test hash with the system salt
        cryptWord = crypt.crypt(word, salt)
        # Compare the test result to the target shadow hash
        if (cryptWord == cryptPass):
            print "[+] Found Password: " + word
            return
    print "[-] Password Not Found."

Defensive Hardening & Legacy System Migration

This auditing script demonstrates how simple dictionary attacks are incredibly effective against antiquated hashing algorithms. To secure modern UNIX/Linux environments, the following defensive strategies must be enforced:

• Mandate Strong Hashing Algorithms: Ensure that system configuration (`/etc/pam.d/common-password` and `/etc/login.defs`) is configured to use modern, robust, and iteratively salted hashing algorithms such as **bcrypt**, **scrypt**, or **Argon2** instead of legacy `crypt(3)`.
• Enforce Complex Password Policies: Implement strict password complexity requirements through **PAM** (Pluggable Authentication Modules), including mandatory length, multi-set character combinations, and dictionary-check blocking.
• Strictly Secure and Audit `/etc / shadow`: Maintain absolute restriction on read permissions for `/etc / shadow` (setting `600` or `r--------` and owned by `root`). Regularly audit system logs for unauthorized read attempts or unprivileged access events.