Introduction
A community organization retired its staff portal. A synthetic copy of its old password export has appeared in an incident exercise, while the current staff archive still works. Determine what the supplied candidates actually recover without losing the relationship between an old record and a person.
You will use the working archive, run John the Ripper in Kali Linux and produce a private recovery inventory. All identities are invented. The audit and target containers are isolated and share one VM kernel. Only the supplied files and service are in scope; no installation or programming is required.
Prerequisites are entering terminal commands and recognizing paths. This lab explains its options and file operations. Allow about 45 minutes including reading and ordinary mistakes; this is an author estimate. The next guided lab starts an independent scene and checks current impact.
Use the Archive and Protect Your Results
In this step, you will see normal access before investigating the export. Open Auditor. Its terminal enters the Kali audit container as auditor, in /home/auditor/project. The archive is a different container.
SSH is an encrypted remote login protocol. This archive accepts passwords and returns only the authenticated account name; it provides no general shell. Start with its non-sensitive demonstration account. -p selects the service port. The two -o options choose the prepared server-key file and require a matching key. A host key identifies the server; your password authenticates you. The final whoami requests your remote account name.
ssh -o UserKnownHostsFile=/etc/reuse/known_hosts -o StrictHostKeyChecking=yes -p 12222 demo@staff-archive whoami
At demo@staff-archive's password:, type welcome-7 and press Enter. Password characters are not displayed. Expect demo, then your local prompt. Do not enter the password as a shell command. After a typo, use Ctrl+C and repeat the SSH command. A connection or host-key error is not a rejected credential; do not disable host-key checking.
Read the authorized scope. cat displays a file; relative paths start in your current directory. inputs contains read-only originals.
cat inputs/scope.tsv
The tab-separated columns are employee_id, current_login, host and port. Only these current identities on staff-archive:12222, plus demo, may be tested. Do not guess extra usernames, hosts or candidate lists.
Recovered passwords are sensitive even here. umask 077 removes group/other access from newly created files in this terminal session. mkdir -m 700 makes a directory that only its owner can enter. Run separately:
umask 077
mkdir -m 700 findings
findings is your writable area. If it already exists after reconnecting, keep it; repeat umask 077 in a new session. Use pwd to see your directory and cd /home/auditor/project to return here if a relative path fails. Preserve all input files, archive accounts and current passwords throughout the audit.
Recover the Supplied Dictionary Matches
In this step, you will test five candidates against four real password hashes. A hash is a one-way password-derived value. Offline recovery computes candidate hashes with the stored settings and compares them; it does not decrypt passwords or log into the archive.
Stay in Auditor, at /home/auditor/project. Read each small input:
cat inputs/legacy.txt
cat inputs/candidates.txt
Legacy lines are record_id:hash. $6$ identifies SHA-512 crypt. The stored value includes a salt, which makes identical passwords produce different stored values. Keep each record identifier attached. This tiny synthetic dictionary makes the exercise fast; its speed does not estimate production password strength.
John's --format=sha512crypt selects this format; --wordlist reads the supplied candidates. A pot stores recovered hash/password pairs. --pot selects a private file instead of a shared default. --session selects the run's recovery/log location. OMP_NUM_THREADS=2 limits worker threads for this command only. These paths have no spaces and need no quotes.
OMP_NUM_THREADS=2 john --format=sha512crypt --wordlist=inputs/candidates.txt --pot=/home/auditor/project/findings/audit.pot --session=/home/auditor/project/findings/recovery inputs/legacy.txt
Wait for the prompt. Expect three recovered hashes; timing and order vary. On a repeat, No password hashes left to crack can mean the pot already has the results, not that the input was empty. --show reads saved results without another recovery run:
john --show --format=sha512crypt --pot=/home/auditor/project/findings/audit.pot inputs/legacy.txt
Expect these relationships, with ordering allowed to differ:
portal-17:cedar42
portal-23:pebble7
portal-41:birch81
3 password hashes cracked, 1 left
Export the actual output. > redirects standard output to a file, replacing that result file on a repeat. It does not edit the hashes.
john --show --format=sha512crypt --pot=/home/auditor/project/findings/audit.pot inputs/legacy.txt > findings/recovered.txt
cat findings/recovered.txt
The export must retain record identifiers and recovered passwords. After a path typo, correct and rerun the affected command. If you created a broadly readable result, chmod 600 findings/recovered.txt restores owner-only read/write access; the same repair works for another result file. Do not share the pot or plaintext export as the incident summary.
Preserve Identity and Uncertainty
In this step, you will make a password-free recovery inventory. Stay in Auditor and read the old roster:
cat inputs/legacy-roster.tsv
It connects record_id to stable employee_id and a display name. Two people are named Morgan Rivera: portal-17 belongs to E101; portal-41 belongs to E103. A name cannot safely connect an old record to a current login.
Here recovered means an original hash matched a supplied candidate. not-recovered means none matched in this completed, limited run. It does not mean strong, safe, absent or not reused. Current-service acceptance remains unknown for every record.
Create findings/recovery.tsv with the columns record_id, employee_id, recovery. printf interprets \t as a tab and \n as a newline. Single quotes preserve those sequences until printf reads them; > creates or replaces this password-free inventory.
printf 'record_id\temployee_id\trecovery\nportal-17\tE101\trecovered\nportal-23\tE102\trecovered\nportal-41\tE103\trecovered\nportal-58\tE104\tnot-recovered\n' > findings/recovery.tsv
cat findings/recovery.tsv
Self-check that all four records appear once with the roster's employee IDs: three recovered and one unresolved beyond this budget. To repair a value, correct the printf text and rerun it. The private pot/export support further authorized work, while this inventory communicates the result without disclosing passwords.
Summary
You used a working SSH service, recovered three synthetic legacy passwords with John and preserved their original identities. Your private results and password-free inventory distinguish successful offline matches from an exhausted dictionary's limits. No recovered password has yet been shown to work on a current staff account. The next guided lab makes that separate judgment with authorized exact credential pairs.
