Password cracking - demo

lees.sh

@@ -1,6 +1,22 @@
 #!/bin/bash
 
 echo -e '\e[1;33m[*] STARTING LEES (Linux Environment Enumeration Script)...\e[m'
+echo -e '
+ ▄            ▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄▄▄ 
+▐░▌          ▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌
+▐░▌          ▐░█▀▀▀▀▀▀▀▀▀ ▐░█▀▀▀▀▀▀▀▀▀ ▐░█▀▀▀▀▀▀▀▀▀ 
+▐░▌          ▐░▌          ▐░▌          ▐░▌          
+▐░▌          ▐░█▄▄▄▄▄▄▄▄▄ ▐░█▄▄▄▄▄▄▄▄▄ ▐░█▄▄▄▄▄▄▄▄▄ 
+▐░▌          ▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌
+▐░▌          ▐░█▀▀▀▀▀▀▀▀▀ ▐░█▀▀▀▀▀▀▀▀▀  ▀▀▀▀▀▀▀▀▀█░▌
+▐░▌          ▐░▌          ▐░▌                    ▐░▌
+▐░█▄▄▄▄▄▄▄▄▄ ▐░█▄▄▄▄▄▄▄▄▄ ▐░█▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄█░▌
+▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌
+ ▀▀▀▀▀▀▀▀▀▀▀  ▀▀▀▀▀▀▀▀▀▀▀  ▀▀▀▀▀▀▀▀▀▀▀  ▀▀▀▀▀▀▀▀▀▀▀ 
+                                                    
+'
+echo -e 'Author: adi7312'
+echo -e 'GitHub: https://github.com/adi7312/LEES'
 
 function system_enum() { 
     echo -e '\e[0;32m-------------------Performing system enumeration-----------------\e[m'
@@ -57,6 +73,13 @@ function user_enum(){
     if [[ $etc_shadow ]]; then
         echo -e "\e[0;31m[+] Shadow file can be read! \e[m"
         echo -e "\e[0;34m$etc_shadow\e[m"
+        mkdir tmp; touch ./tmp/hashes;
+        cat $etc_shadow > ./tmp/hashes
+        echo -e "[*] Hashes saved to ./tmp/hashes"
+        read -p "[*] Do you want to crack hashes now? [y/n]: " answer
+        if [[ $answer == "y" ]]; then
+            crack_passwords
+        fi
     else
         echo -e "[-] Can't get access to shadow file"
     fi    
@@ -125,7 +148,7 @@ function user_enum(){
 
     # finding .ssh directories
     echo -e "[*] Looking for ssh directories"
-    ssh_dirs=`find / -name .ssh -exec ls -la {} 2>/dev/null \;` 
+    ssh_dirs=`timeout 1 find / -name .ssh -exec ls -la {} 2>/dev/null \;` 
     if [[ $ssh_dirs ]]; then
         echo -e "\e[0;31m[+] .ssh directories found: \e[m"
         echo -e "\e[0;34m$ssh_dirs\e[m"
@@ -409,6 +432,7 @@ function service_enum(){
     else
         echo -e "[-] Can't get Apache version"
     fi
+
 
 }
 
@@ -463,11 +487,34 @@ function lxc_lxd_enum(){
         echo -e "[-] You are not inside lxc/lxd container"
     fi
 
+}
+
+function crack_passwords(){
+    echo -e '\e[0;32m\-------------------Performing password cracking-------------------/\e[m'
+    # checking if we can crack passwords
+    read -p "[*] Please specify wordlist location: " wordlist
+    echo -e "[*] Cracking passwords"
+    content=`cat ./tmp/hashes 2>/dev/null`
+    mkdir ./results
+    if [[ $content ]]; then
+        hashcat -a 0 ./tmp/hashes $wordlist --force --quiet --potfile-disable --outfile ./results/cracked.txt
+    else
+        echo -e "[-] No hashes to crack"
+    fi
+    if [[ -s cracked.txt ]]; then
+        echo -e "[+] Passwords cracked: \n"
+        cat cracked.txt
+    else
+        echo -e "[-] No passwords cracked"
+    fi
+    rm -r ./tmp
+
 
 }
 
 
 
+
 system_enum
 user_enum
 net_enum