Introduction
Recovering a password from a retired portal does not prove that it still opens the current staff archive. You must connect the old record to an authorized current identity, then test that exact relationship.
Build a password-free impact inventory that distinguishes current reuse, rejected old credentials, an out-of-scope person and an unresolved record. John performs real offline recovery; Hydra performs limited online authentication; SSH lets you observe the accepted account identity. The synthetic target and Kali auditor are isolated containers sharing one VM kernel.
Complete the previous guided lab or know its John, private-file and stable-ID workflow. This unit explains Hydra and the impact decisions. Its fresh environment contains no results from the previous VM. Allow about 50 minutes including reading and ordinary mistakes; this is an author estimate.
Rebuild the Evidence in This Fresh Scene
In this step, you will establish normal access and recover this unit's original export. Open Auditor at /home/auditor/project. Nothing needs to be copied from the previous VM. Start with the known demonstration login:
ssh -o UserKnownHostsFile=/etc/reuse/known_hosts -o StrictHostKeyChecking=yes -p 12222 demo@staff-archive whoami
Type welcome-7 at the password prompt; expect demo and a return to the local prompt. Password entry is invisible. This confirms normal service access before testing old credentials. After a typo, cancel with Ctrl+C and repeat. Connection or host-key failures are not credential rejection; keep strict host-key checking enabled.
Create private results, then rerun the recovery workflow already taught. umask is session-local; repeat it after reconnecting. If findings already exists, keep it and continue.
umask 077
mkdir -m 700 findings
cat inputs/legacy.txt
cat inputs/candidates.txt
OMP_NUM_THREADS=2 john --format=sha512crypt --wordlist=inputs/candidates.txt --pot=/home/auditor/project/findings/audit.pot --session=/home/auditor/project/findings/recovery inputs/legacy.txt
john --show --format=sha512crypt --pot=/home/auditor/project/findings/audit.pot inputs/legacy.txt > findings/recovered.txt
cat findings/recovered.txt
Expect portal-17:cedar42, portal-23:pebble7, portal-41:birch81 and the summary 3 password hashes cracked, 1 left. A repeat can reuse the pot; inspect --show rather than interpreting a lack of new recovery as failure. portal-58 remains unresolved with this candidate budget.
Use pwd and cd /home/auditor/project after a directory mistake. Correct a misspelled path and repeat the affected command. chmod 600 findings/recovered.txt repairs excessive result permissions; apply the same pattern to another private file if necessary. Do not modify the inputs or the archive's current passwords.
Test Only the Authorized Exact Pairs
In this step, you will decide which recovered records may be tested and use Hydra to test two exact pairs. Stay in Auditor. Read the identity relationship and the current authorization separately:
cat inputs/legacy-roster.tsv
cat inputs/scope.tsv
Join the files mentally using employee_id, not display name. portal-17 is E101, whose current login is mrivera. portal-23 is E102, now ncho. The other Morgan Rivera is E103; no current identity for that employee is authorized. Do not invent a login for that person. E104 has an authorized current login, but its old password was not recovered, so there is no old pair to test within this budget.
Hydra's -C reads login:password pairs, one per line. This preserves each relationship instead of combining every login with every recovered password. printf, \n, single quotes and > work as in the previous lab. Save only the two authorized recovered pairs:
printf 'mrivera:cedar42\nncho:pebble7\n' > findings/pairs.txt
cat findings/pairs.txt
For the following command, -C selects that file, -s selects the SSH port, -t 1 limits concurrency to one task and -w 8 limits response waiting. -o saves Hydra's findings. ssh://staff-archive selects the protocol and exact target. Hydra's normal host handling differs from native SSH's pinned-key workflow; use only this prepared internal target. The course's authorization is two original recovered pairs, not an invitation to expand guessing.
hydra -C findings/pairs.txt -s 12222 -t 1 -w 8 -o findings/hydra.txt ssh://staff-archive
Wait for completion. Expect a successful line for mrivera with cedar42, followed by 1 valid password found and a completion summary for the target. The ncho pair is rejected. Hydra's output contains plaintext credentials and stays private. A zero exit status alone does not prove a working credential: a completed run with zero valid passwords can also exit successfully.
cat findings/hydra.txt
An unfinished run, connection error, or disabled target does not establish that a password was rejected. Check the exact host, port and pair file first. If you intentionally repeat a completed run and Hydra asks about hydra.restore, use the same command with -I to ignore the old restore file. This repeats the two authorized attempts; it does not expand scope. Do not use options that stop after the first success, since both pairs need a decision. Grading observes actual authentication decisions for the exact original pairs, including rejection; a copied Hydra success line is insufficient.
Confirm Identity and Record Bounded Impact
In this step, you will observe the accepted identity and write a password-free handoff. Stay in Auditor and use native SSH with the recovered password:
ssh -o UserKnownHostsFile=/etc/reuse/known_hosts -o StrictHostKeyChecking=yes -p 12222 mrivera@staff-archive whoami
Type cedar42 at the password prompt. Expect mrivera, then the local prompt. The archive's restricted command returns the actual authenticated account; it does not open a target shell. You have confirmed which current identity the old credential reaches. Successful authentication is the impact demonstrated here, not proof of access to every archive resource.
Your findings/impact.tsv must have the five columns record_id, employee_id, current_login, result, identity. Use - for an unavailable current login or an identity not established by successful authentication. The allowed result values mean:
current-reused: the authorized current account accepts that employee's recovered old password.current-not-accepted: that exact recovered pair reached the service and was rejected. This does not prove the account has no other weak password.out-of-scope: recovery succeeded, but the employee has no authorized current identity. Do not test a guessed one.not-recovered: this dictionary did not recover the old password. Current reuse remains unknown.
Write the inventory without passwords, one row for every old record:
printf 'record_id\temployee_id\tcurrent_login\tresult\tidentity\nportal-17\tE101\tmrivera\tcurrent-reused\tmrivera\nportal-23\tE102\tncho\tcurrent-not-accepted\t-\nportal-41\tE103\t-\tout-of-scope\t-\nportal-58\tE104\tlpark\tnot-recovered\t-\n' > findings/impact.tsv
cat findings/impact.tsv
Check identity relationships and all four different conclusions. Correct a typo by editing the printf text and rerunning it. Row ordering may differ, but every relationship must stay intact. Keep the pot, plaintext export, pair file and Hydra results private; the impact inventory is the password-free handoff. Preserve the demonstration login and every original account/password. Do not rotate passwords during this assessment: remediation is a subsequent task that requires its own authorization and plan.
Summary
You connected old records to authorized current identities, tested exact credential pairs with Hydra and observed the reused account through SSH. Your inventory distinguishes one demonstrated reuse from a rejected pair, an out-of-scope identity and an unresolved record. These conclusions describe this bounded assessment; they do not certify all passwords or all services as secure. The challenge transfers the same method to a different workshop roster and target.
