0

I have an encrypted hard drive. The hard drive, root user, and primary user all share the same password. I have successfully logged in but seem to have forgotten the password.

I'm looking to limit the damage of this forgotten password and attempt to recover it.

The steps I am taking so far are the following:

  • Write down the password as best I can remember it.

  • Email a copy of /etc/passwd to myself so I can attempt to run a brute force attack on it with the characters from the prior step.

  • Backup unsaved data and files as best I can.

Does anyone have any suggestions on a tool to use to brute force /etc/passwd?

Update:

It looks like the hashed passwords are now in /etc/shadow so if I want to run this brute force I need to do it now while I have a login prompt...

I have no root shell and cannot sudo since it's the same password.

6
  • If you're still logged in can't you just use passwd to set a new password?
    – Seamus
    Nov 24, 2023 at 3:53
  • @Seamus unless you use sudo passwd <username>, passwd should usually prompt for the current password. OP: do you have a root shell? Also see: unix.stackexchange.com/a/161920/70524
    – muru
    Nov 24, 2023 at 4:03
  • @muru: why could he not use sudo passwd?
    – Seamus
    Nov 24, 2023 at 4:10
  • @Seamus I don't happen have a root shell otherwise and can't sudo because it's the same password I've forgotten.
    – mpr
    Nov 24, 2023 at 4:14
  • Because I'm sure you'll change your password afterwards: "The hard drive, root user, and primary user all share the same password." That sounds like a bad idea. I'd recommend you have no password login for root at all (you have sudo!), and that your encryption uses a much stronger password, which you might want to store on a key file on a USB thumb drive or a smartcard or a Fido dongle. Nov 24, 2023 at 4:30

1 Answer 1

1

You're not root, so you can't bypass memory protection and read the master key directly from RAM.

Your encryption key is unrecoverable at this point (barring defects, very serious unpatched security vulnerabilities, or hardware attacks like cooling down your RAM with liquid nitrogen, quickly forcing a reboot from a medium where you are able to dump RAM to an external storage medium while the system avoids using the RAM regions that your kernel used, and hoping for a very limited amount of physically inevitable but flips. Not realistic outside lab-alike settings.).

The only thing you can do is copy the data you can still access to a separate storage medium. The good news is that this probably encompasses all important data, if this is a personal computer.

Then, flatten your system, set it up anew, this time making sure you have a decryption backup let on secondary medium, avoid password reuse, and restore your personal data from where you copied it to.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .