TryHackMe: Passwords - A Cracking Christmas

Welcome to my walkthrough of the TryHackMe “Passwords - A Cracking Christmas” room! This festive-themed challenge takes us through the world of password-based encryption attacks, where we help Sir Carrotbane crack encrypted files that might contain Santa’s master gift registry.

Introduction

The Best Festival Company’s systems have been showing traces of encrypted data buried deep within their servers. Sir Carrotbane has discovered a series of locked PDF and ZIP files labeled “North Pole Asset List” that could contain fragments of Santa’s master gift registry. Our mission is to crack these encrypted files and understand the security implications.

Learning Objectives

Through this room, we’ll explore:

• How password-based encryption protects files like PDFs and ZIP archives
• Why weak passwords make encrypted files vulnerable to attacks
• How attackers use dictionary and brute-force attacks to recover passwords
• Hands-on password cracking techniques
• The importance of using strong, complex passwords for defense

Getting Started

First, let’s connect to the TryHackMe machine using SSH. This gives us access to the target environment where we can practice our password cracking skills safely.

Understanding Password Attacks

Dictionary Attacks

Dictionary attacks use predefined lists of potential passwords (wordlists) and test each one systematically. These wordlists often contain:

• Common passwords from previous data breaches
• Popular password patterns
• Dictionary words and variations

Brute-Force and Mask Attacks

While brute-force attacks try every possible character combination, mask attacks are more targeted. They limit guesses to specific formats, like “three lowercase letters followed by two digits,” making the process more efficient.

Hands-On Exercise

Step 1: Identify File Types

Before we can crack any passwords, we need to understand what we’re working with. Let’s examine our target files:

Using the file command helps us confirm whether we’re dealing with PDF or ZIP files, which determines which tools we’ll use for cracking.

Step 2: Choose the Right Tools

Based on the file type, we can select appropriate cracking tools:

For PDF files:

• pdfcrack - Specialized PDF password cracker
• john (via pdf2john) - Versatile password cracker

For ZIP files:

• fcrackzip - Fast ZIP password cracker
• john (via zip2john) - Universal approach

Advanced options:

• hashcat - GPU-accelerated cracking for better performance

Step 3: Dictionary Attack on PDF

Let’s start with a dictionary attack on the PDF file using pdfcrack and the famous rockyou.txt wordlist:

pdfcrack -f flag.pdf -w /usr/share/wordlists/rockyou.txt

The tool systematically tests passwords from the wordlist until it finds a match. When successful, it reveals the password that protects the PDF.

Step 4: Cracking ZIP Files with John

For ZIP files, we’ll use John the Ripper with a two-step process:

1. Extract the hash: Convert the ZIP file into a format John can understand

zip2john flag.zip > ziphash.txt

2. Run the attack: Use the wordlist to crack the password

john --wordlist=/usr/share/wordlists/rockyou.txt ziphash.txt

The cracking process shows real-time progress, including the current password being tested and the average speed of attempts per second.

Challenge Solutions

Question 1: PDF Flag

After successfully cracking the PDF password, we can open the file and retrieve the flag:

Answer: THM{Cr4ck1ng_PDFs_1s_34$y}

Question 2: ZIP Flag

For the ZIP file, we first need to view the cracked password:

The password is revealed as winter4ever. Now we can extract the ZIP file contents:

Reading the extracted flag.txt file gives us our second flag.

Answer: THM{Cr4ck1n6_z1p$_1s_34$yyyy}

Detection and Defense

Monitoring for Password Cracking Activity

Security teams should watch for several indicators of password cracking attempts:

Process Creation Monitoring:

• Look for known cracking tools: john, hashcat, fcrackzip, pdfcrack
• Monitor command-line patterns: --wordlist, -w, --mask, references to rockyou.txt
• Watch for hash extraction tools: zip2john, pdf2john

Resource Usage Patterns:

• Sudden high GPU utilization (for GPU-accelerated cracking)
• Sustained high CPU usage from cracking processes
• Large file reads from wordlist locations

Network Indicators:

• Downloads of large wordlist files
• Package installations for cracking tools
• Git clones of popular wordlist repositories

Example Detection Rules

Here’s a Sigma-style detection rule for Windows environments:

title: Password Cracking Tools Execution
detection:
  selection_name:
    Image|endswith:
      - '\john.exe'
      - '\hashcat.exe'
      - '\fcrackzip.exe'
      - '\pdfcrack.exe'
  selection_cmd:
    CommandLine|contains:
      - '--wordlist'
      - 'rockyou.txt'
      - 'zip2john'
      - '--mask'
  condition: selection_name or selection_cmd
level: medium

Incident Response Playbook

When password cracking activity is detected:

1. Immediate Actions:

   • Isolate the affected host if malicious activity is confirmed
   • Capture process memory dumps and system artifacts
   • Preserve working directories and shell history

2. Investigation:

   • Determine which files were successfully decrypted
   • Check for signs of lateral movement or data exfiltration
   • Identify the source and intent of the activity

3. Remediation:

   • Rotate affected passwords and encryption keys
   • Implement multi-factor authentication where possible
   • Educate users on strong password practices

Key Takeaways

This TryHackMe room demonstrates several critical security concepts:

1. Weak passwords are a significant vulnerability - Even strong encryption can be bypassed if the password is easily guessable.

2. Dictionary attacks are highly effective - Many users choose passwords that appear in common wordlists.

3. Detection is possible - While offline cracking doesn’t trigger login failures, the cracking process itself leaves detectable traces.

4. Defense in depth matters - Strong passwords should be combined with other security measures like MFA and file access controls.

Conclusion

The “Passwords - A Cracking Christmas” room provides an excellent introduction to password-based attacks and defenses. By understanding how these attacks work, security professionals can better protect their organizations and educate users about the importance of strong password practices.

Remember: the goal isn’t just to crack passwords, but to understand the techniques so we can defend against them effectively. Strong passwords, combined with proper monitoring and incident response procedures, form a crucial part of any comprehensive security strategy.

Happy learning, and may your passwords be ever strong! 🎄🔐