/credential-recovery

name: credential-recovery
description: >
  Offline credential and file recovery with hashcat and john. Use when any skill
  captures hashes (NTLM, Kerberos TGS/AS-REP, shadow, MSCACHE2) or encrypted
  files (ZIP, Office, PDF, KeePass, SSH key, 7z, RAR). Trigger phrases: "recover
  this hash", "offline recovery", "john", "hashcat", "zip2john",
  "password-protected file". Do NOT use for online password attacks
  (spraying, brute force against services) — use password-spraying instead.
keywords:
  - crack
  - hash
  - hashcat
  - john
  - zip2john
  - office2john
  - keepass2john
  - ssh2john
  - ansible2john
  - ansible vault
  - rockyou
  - wordlist
  - offline
  - brute force
  - NTLM
  - Kerberos TGS
  - AS-REP
  - shadow
  - bcrypt
  - MSCACHE2
  - PKZIP
  - password-protected
tools:
  - hashcat
  - john
  - zip2john
  - office2john
  - pdf2john
  - keepass2john
  - ssh2john
  - 7z2john
  - rar2john
  - gpg2john
  - ansible2john
opsec: low

Credential Cracking

You are helping a penetration tester with offline credential and file cracking. This skill covers hash identification, extraction from encrypted files, and cracking with hashcat or john. All operations are local — no target interaction. All testing is under explicit written authorization.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[credential-cracking] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

Scope Boundary

This skill covers offline hash cracking and encrypted file cracking only. It does NOT cover:

• Online password attacks (spraying, brute force) -- use **password-spraying**
• Credential dumping from memory/registry -- use **credential-dumping**
• Password guessing against services -- use **password-spraying**

When cracking is complete, STOP and return to the orchestrator with cracked credentials and recommendations for where to test them.

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• Hashes or encrypted files from another skill or user-provided
• **hashcat** (preferred for GPU-accelerated cracking) or **john** (john-jumbo

for `*2john` tools)

• Wordlists — check these locations in order:

1. `/usr/share/wordlists/rockyou.txt` (Kali default — may be a symlink or compressed `.gz`) 2. `/usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt` (SecLists location) 3. `/usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt.tar.gz` (compressed — extract first: `tar xzf rockyou.txt.tar.gz`) 4. `/opt/seclists/Passwords/` (legacy SecLists path)

**Common issue**: `/usr/share/wordlists/rockyou.txt` is often a broken symlink pointing to `/opt/seclists/...` which doesn't exist. If the symlink is broken, check `/usr/share/seclists/` directly. If rockyou is only available as `.tar.gz`, extract to `$TMPDIR` before use.

**If rockyou.txt is not found at ANY of the above locations** (including compressed variants), STOP immediately. Do not create custom wordlists or generate passwords. Report the failure:

> [credential-cracking] STOPPED — no wordlist found. Checked: > /usr/share/wordlists/rockyou.txt, /usr/share/seclists/Passwords/, > /opt/seclists/Passwords/. Install SecLists or provide a wordlist path.

Return to the orchestrator with this message. The operator must install a wordlist before cracking can proceed.

Sandbox — Disable for All Cracking Commands

hashcat and john need write access to multiple locations: session files (`~/.local/share/hashcat/sessions/`), potfile (`~/.local/share/hashcat/ hashcat.potfile`), restore files (CWD), and temp working files. Redirecting each individually with `--session`, `--potfile-path`, `-o` flags is fragile and often still fails.

**Always run hashcat and john with `dangerouslyDisableSandbox: true`.** This is the only reliable approach in Claude Code's sandboxed environment.

# CORRECT — disable sandbox for all cracking commands
Bash(command="hashcat -m MODE hash.txt wordlist.txt --force",
     dangerouslyDisableSandbox=true)

Bash(command="john --wordlist=wordlist.txt hash.txt",
     dangerouslyDisableSandbox=true)

# Also for --show after cracking
Bash(command="hashcat -m MODE hash.txt --show",
     dangerouslyDisableSandbox=true)

**Do not** attempt `$TMPDIR` workarounds first — go straight to sandbox disable. Cracking is a local-only operation with no security implications from disabling the sandbox.

john-jumbo Requirement

Most `*2john` extraction tools ship with **john-jumbo**, not basic john. Check:

john --version 2>&1 | head -1
# Should show "John the Ripper" with "jumbo" in the version string

If john-jumbo is not installed:

# Debian/Ubuntu
sudo apt install john

# Or build from source (last resort)
git clone https://github.com/openwall/john.git
cd john/src && ./configure && make -s clean && make -sj$(nproc)
# Binary at ../run/john

The `*2john` tools are typically in `/usr/share/john/` or alongside the john binary (e.g., `/opt/john/run/zip2john`). Check with:

find /usr -name "zip2john" 2>/dev/null
find /opt -name "zip2john" 2>/dev/null

Step 1: Identify Hash Type

Determine what needs cracking. This come