312-50 Question 456
Single answer▪ Cryptography ToolsDuring an internal security assessment, you capture a Linux server's /etc/shadow file after obtaining authorized access. The password hashes begin with "$6$" and include unique salts. The engagement requires you to identify weak user passwords as efficiently as possible using a standard cryptographic password-cracking tool. Which action is the MOST appropriate next step?
- A
Use John the Ripper with a wordlist or rule-based attack configured for sha512crypt hashes
- B
Use Hashcat in NTLM mode because NTLM is the default format for modern Linux password storage
- C
Decrypt the hashes directly with OpenSSL using the server's SSH host key
- D
Use GnuPG to import the shadow file and recover the original plaintext passwords
Show answer and explanation
Correct answer: A
Explanation
The key technical clue is the "$6$" prefix in /etc/shadow, which denotes sha512crypt in the modular crypt format used on many Linux systems. Because the hashes are salted and one-way, the practical auditing approach is password cracking through candidate generation and comparison, not decryption. Tools such as John the Ripper and Hashcat are commonly used for this purpose, but selecting the correct hash format is essential. John the Ripper is especially well known in CEH-aligned scenarios for auditing Unix-style password hashes from /etc/shadow. Relevant references include the crypt(3) manual for modular hash identifiers and tool documentation from John the Ripper/Openwall describing support for sha512crypt. Best practice in authorized engagements is to use targeted wordlists and rules first for efficiency, then escalate to broader attacks only if permitted by scope.
- A. Correct.
Correct. In Linux, a prefix of "$6$" in /etc/shadow indicates the sha512crypt password hashing scheme used by the system's crypt(3) framework, typically with per-password salts. John the Ripper is a standard and appropriate tool for auditing these hashes using dictionary, rule-based, or incremental cracking modes. This is a realistic and efficient next step during an authorized password audit because the hashes are not decrypted; instead, candidate passwords are hashed and compared.
- B. Incorrect.
Incorrect. NTLM is associated with Windows authentication, not standard Linux /etc/shadow storage. A candidate might choose this option because Hashcat is also a valid password-auditing tool, but the issue here is the mode and format: NTLM mode would be wrong for hashes identified by the "$6$" prefix. The misconception is confusing a legitimate tool with the wrong hash type.
- C. Incorrect.
Incorrect. OpenSSL is commonly used for many cryptographic operations, which makes this distractor plausible. However, password hashes in /etc/shadow are one-way hashes, not data encrypted with the SSH host key. SSH host keys are unrelated to reversing user password hashes. The misconception is treating password hashing like reversible encryption.
- D. Incorrect.
Incorrect. GnuPG is used for encryption, decryption, signing, and key management for OpenPGP workflows. It does not import /etc/shadow files to recover plaintext passwords. Someone might pick this if they broadly associate cryptography tools with all password-related tasks, but GnuPG is not designed for password-hash cracking or auditing.