Lab 11: Password Forensics - Menganalisis & Meretrieve Password dari Hash

cd ~ && mkdir forensics-lab11 && cd forensics-lab11

# 1. Buat file hash simulasi (berbagai jenis)
cat > hashes.txt << 'EOF'
# MD5 (unsalted)
user1:$1$salt$abcdef1234567890abcdef1234567890
# SHA-512 (Linux shadow format)
user2:$6$saltsalt$abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef12
# NT hash (Windows SAM)
user3:31d6cfe0d16ae931b73c59d7e0c089c0
# bcrypt
user4:$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
# Simple MD5 (unsalted)
admin:21232f297a57a5a743894a0e4a801fc3
EOF

echo "✅ File hash multi-format dibuat"

# 2. Identifikasi hash
cat > hash-identifier.py << 'PYEOF'
# Simple hash identifier
import re

hashes = {
    '21232f297a57a5a743894a0e4a801fc3': ('MD5', 'admin'),  # known: md5('admin')
    '31d6cfe0d16ae931b73c59d7e0c089c0': ('MD5', ''),  # md5('')
}

def identify(hash_str):
    length = len(hash_str)
    if hash_str.startswith('$1$'): return 'MD5 crypt (Linux)'
    if hash_str.startswith('$6$'): return 'SHA-512 crypt (Linux shadow)'
    if hash_str.startswith('$2a$') or hash_str.startswith('$2b$'): return 'bcrypt'
    if hash_str.startswith('$5$'): return 'SHA-256 crypt'
    if length == 32: return 'MD5 (possible)'
    if length == 40: return 'SHA1 (possible)'
    if length == 64: return 'SHA256 (possible)'
    if length == 128: return 'SHA512 (possible)'
    return 'Unknown'

with open('hashes.txt') as f:
    for line in f:
        line = line.strip()
        if not line or line.startswith('#'): continue
        if ':' in line:
            user, hash_val = line.split(':', 1)
            print(f"{user:10} → {identify(hash_val):30} ({len(hash_val)} chars)")
PYEOF

python3 hash-identifier.py

# 3. Simulasi dictionary attack
cat > dictionary.txt << 'DICT'
admin
password
123456
12345678
qwerty
letmein
welcome
monkey
dragon
baseball
iloveyou
trustno1
sunshine
master
DICT

cat > crack-simul.py << 'PYEOF'
import hashlib

# Target hashes
targets = {
    'admin': '21232f297a57a5a743894a0e4a801fc3',  # md5('admin')
}

with open('dictionary.txt') as f:
    words = [w.strip() for w in f if w.strip()]

print("=== Dictionary Attack Simulation ===")
for word in words:
    h = hashlib.md5(word.encode()).hexdigest()
    for user, target_hash in targets.items():
        if h == target_hash:
            print(f"✅ {user}:{word} = {h}")

# Hitung password strength
print("\n=== Password Strength Analysis ===")
for word in words:
    score = 0
    if len(word) >= 8: score += 1
    if any(c.isupper() for c in word): score += 1
    if any(c.islower() for c in word): score += 1  
    if any(c.isdigit() for c in word): score += 1
    if any(c in '!@#$%^&*' for c in word): score += 1
    level = ['Very Weak', 'Weak', 'Medium', 'Strong', 'Very Strong'][score]
    if word in ['admin', 'password', '123456']:
        level = '❌ COMMON - DO NOT USE!'
    print(f"  {word:15} → {level}")
PYEOF

python3 crack-simul.py