HARD Password Cracking / DFIR 🏆 250 pts

password hashing md5 hashcat john sql

An SQL database dump from a compromised password vault has been recovered. The vault stores credentials for multiple internal accounts using different password hashing algorithms.

Your mission:
1. Parse the SQL dump and identify all user accounts
2. Identify which hashing algorithm each account uses
3. Find the account with the weakest hash — this is your target
4. Crack the hash using a wordlist attack
5. Use the cracked password to “access” that account’s vault entry
6. The flag is inside the vault entry for that account

Tools needed:
hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt (MD5)
john --format=raw-md5 --wordlist=rockyou.txt hash.txt

Hash type codes for Hashcat:
MD5 = 0 | bcrypt = 3200 | SHA-256 = 1400

Note: The bcrypt hashes are intentionally uncrackable in reasonable time. Only one hash is actually crackable — find it!

The hash 482c811da5d5b4bc6d497ffa98491e38 is an MD5 hash. MD5 hashes are 32 hex characters. This hash corresponds to a very common password found in rockyou.txt. Once you crack it, look at the “secrets” table in the SQL dump for vault entries belonging to that user (id=4).

Submit