5 ms·

It was Bill Joy's password, not Ken Thompson's, that had a control character

186 points by MrXOR 7y ago

EamonnMR 7y ago
So much interesting content is locked in these oldschool mailing lists, how does a modern-day web user get into them?
- capableweb 7y ago
  Like the rest of us, get browsing! https://minnie.tuhs.org/pipermail/tuhs/ https://minnie.tuhs.org/pipermail/tuhs/ Might as well add a disclaimer: back in the days, in order to find the gold nuggets on the web, you had to shift through shit. A lot of shit. But then once in a while, you find those little nuggets that made the whole shit-shifting worthwhile. Useful exercise in patience for beginner webbers maybe.
  - AceJohnny2 7y ago
    > back in the days, in order to find the gold nuggets on the web, you had to shift through shit. "back in the day"? Edit: no, I meant, it hasn't changed since then. Sturgeon's Law still applies today.
    - awgm 7y ago
      Either way
    - capableweb 7y ago
      I did not know that it's "day" not "days". Not a native English speaker and have always been saying it "days". Thank you for correcting me!
      - mikorym 7y ago
        Both could be correct. Here I think "day" could make more sense. An example of the other case: "Back in the days of Fortran programming..." If you leave out anything after "days" by just saying "back in the days" then it is like you are pausing. As in when you reminisce, "Oh, back in the days!" Maybe that is what the intention was. In any case, the commentor was actually just saying that he thinks nothing has changed.
    - capableweb 7y ago
      Sorry, I misunderstood and thought you were trying to correct me! Thanks anyway :) I would agree, but I think the difference nowadays (had to look up I got "nowadays" right, seems I did!) is that people usually want a quality filter in front of them (like upvotes, likes, retweets or some other metric) rather than just having to judge by themselves. In good ol' email threads, you always had to judge by yourself. In social media today, many assume quality because of metrics.
  - kevin_thibedeau 7y ago
    Google can't monetize this content so it ends up on page 5 behind all the irrelevant SEO links.
    - mav3rick 7y ago
      If enough legit and important articles linked to it , it would be at the top.
      - capableweb 7y ago
        And what decides if a article is "legit and important"? If some other legit and important article links to it, of course! And so we continue, until only the bottom-feeding "high quality" is left at the top of the search result, which is generally boring but "correct" content.
      - Bjartr 7y ago
        If that were true there wouldn't be so much bullshit on the first few pages. Try doing a Google search that gets lots of low-effort ad-stuffed "top x" or "best x of 2019" lists or similar garbage and changing the date range to limit results to before 2008 or thereabouts. It's incredible how much more useful, and easier to quickly evaluate, the results often are.
        mav3rick 7y ago
        Only if your bullshit meter was an objective meter. It's subjective. Links to a page is at least objective.
    - rasz 7y ago
      Google Groups should have this, but search in Groups is permanently broken. Search, you know, Googles main domain.
- tedunangst 7y ago
  Subscribe to the list and use a webmail client.
- TheDong 7y ago
  You need an email account in order to join a mailing list, so get one of those. Your ISP probably gives you one, but you can also use one of the more obscure email providers like yahoo or gmail if you want. I'm a fan of fastmail on my own domain. Once you have an email address, this content is now available to you! Most mailing lists are free and easy to subscribe to.
  - capableweb 7y ago
    I understand where you coming from, but I don't think this "modern web-user" is unfamiliar with what email is, so the sarcastic tone is a bit over the top and usually not appreciated on HN. Instead you could have spent time explaining a better way of browsing the content, or what to consider when reading. Instead of assuming this person doesn't know what a email address is.
    - kick 7y ago
      He was doing it in the style of the WWW of the past, it wasn't sarcastic, it was a fun and friendly joke.
  - EamonnMR 7y ago
    I understand the concept of a mailing list, but how do you discover new lists?
js2 7y ago
The current title ("It was Bill Joy's password, not Ken Thompson") I assume is in reference to Ken's password being cracked two weeks ago. The title is not correct. Ken's password was cracked. Bill Joy's password has now also been cracked, but not disclosed w/o getting permission from Joy to do so first. Discussion from two weeks ago - https://news.ycombinator.com/item?id=21202905 https://news.ycombinator.com/item?id=21202905 Message posting /etc/password entries - https://minnie.tuhs.org/pipermail/tuhs/2019-October/018854.html https://minnie.tuhs.org/pipermail/tuhs/2019-October/018854.h... Message showing Ken's cracked password - https://minnie.tuhs.org/pipermail/tuhs/2019-October/018917.html https://minnie.tuhs.org/pipermail/tuhs/2019-October/018917.h... Message showing Bill Joy's hashed password - https://minnie.tuhs.org/pipermail/tuhs/2019-October/018955.html https://minnie.tuhs.org/pipermail/tuhs/2019-October/018955.h... A correct title would be "Bill Joy's password has now also been cracked."
- oneepic 7y ago
  I thought it was referring to the fact the author found his expectation was the opposite of reality -- he first assumed it would have been Ken, not Bill Joy, to have a control character in his password. But Bill was the one.
- tedunangst 7y ago
  The title is in reference to which password contained a control character. It is truncated, but not incorrect.
  - dang 7y ago
    Ok, we've put a control character in the title above. (Submitted title was "It was Bill Joy's password, not Ken Thompson"... also a category error to compare a password to Ken.)
    - tedunangst 7y ago
      I suppose you could construct a sentence like "it was bill joys password, not Ken Thompson, which unlocked the safe" in response to a (exaggerated) story about Ken picking a lock.
mzs 7y ago
Bill Joy used a control character: Second attempt was lower-case with control characters, and succeeded in around 40 minutes. There's a control character in it ;) Because of the outpouring of negativity about these disclosures, I am reluctant to post the actual password without the user's consent, since he's still alive. If anyone knows Bill, and can contact him, please ask for permission. https://minnie.tuhs.org/pipermail/tuhs/2019-October/019124.html https://minnie.tuhs.org/pipermail/tuhs/2019-October/019124.h...
MrXOR 7y ago
Sorry, the title and I were wrong. now, I read the full story and a better correct title is: "Bill Joy's Unix password had a control character". @dang, please edit the title.
ohjeez 7y ago
I knew someone who started with DEC minicomputers. His original password included a backspace. That is, the password might have looked like 1234 but it was actually 12^H34 because at that point, the backspace character was still a terminal command.
gm3dmo 7y ago
They all had their uid set to 0?
- DrStalker 7y ago
  From memory setting a UID to 0 was a way to effectively have multiple root accounts on a system. sudo is a much better solution to the same problem so using uid 0 in this manner is not something I expect to see on any modern unix/linux system.
  - dredmorbius 7y ago
    "shutdown" or "reboot" as a UID=0 user with shell set to "/sbin/shutdown" or "/sbin/reboot" and a specific password is still occasionally found. Log in as that to shut down or reboot system.
EvanAnderson 7y ago
If you read on in the thread there's this fun story[1]: > John P. Linderman jpl.jpl at gmail.com > Sat Oct 19 23:11:10 AEST 2019 > Related story. A user came to us with a problem while we were in our computer room. We asked him to log in at the VAX console, so we could look into the problem. Moments later, dozens of users flooded in, asking what had happened. Seems the first user had a CTRL-P in his password, which, when entered at the console, triggered the VAX to pause. [1] - https://minnie.tuhs.org/pipermail/tuhs/2019-October/019137.html https://minnie.tuhs.org/pipermail/tuhs/2019-October/019137.h...
- carokann 7y ago
  I do this all the time with bash. I run a python script, and try to ctrl+c the output of it while it's still running. My brain refuses to learn right click.
  - lejar 7y ago
    ctrl+shift+c will copy it. :)
rs23296008n1 7y ago
Thank the relevant deity. Now I can sleep at night. The restless nights can now end and I can resume a normal life again. Whew!
- rs23296008n1 7y ago
  I stand by my comment as it points out the complete unimportance of this article. Even a post by someone making something as part of their programming portfolio would have been more useful to the world.
projektfu 7y ago
I inadvertently had this on a Sun. I was entering a new password from a remote terminal and accidentally hit a lower case letter where I wanted an upper case one. Reflexively I hit backspace, and the Sun used DEL, so it stored a ^H in the password. I was then unable to change it because while getty or login could handle it, passwd wouldn’t accept it as my existing password.
- technofiend 7y ago
  Anecdotally pressing ^v triggers quoting so the next character is taken verbatim. So ^v^h should have worked.
  - projektfu 7y ago
    There was a ton of wizardry I didn’t know at the time
    - technofiend 7y ago
      I hear you. The very first system Unix system I had root to ended up with two etc directories. It took a really long time to figure out I hadn't corrupted the filesystem but instead had created one directory named /etc<DEL> which was an unprintable character.
      - anon9001 7y ago
        `mkdir -- "$(echo "-rf \u2215")"` is a fun one for someone else to anxiously rm later ;)
        technofiend 7y ago
        Lol. The lessons I learned about ls -lq, ls -li and find -inum have stuck with me since then, though.
  - kazinator 7y ago
    Interestingly, this feature (the LNEXT character which causes the next one to be literal) is still not in POSIX. https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/termios.h.html https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/te... The VLNEXT macro is mentioned as reserved for implementations though.
technofiend 7y ago
Plato terminals had a custom keyboard* which included buttons for super and subscripts. The administrator for our school district's account had special privileges including the ability to create new users, give others the right to create lessons, more disk space and was highly coveted. It didn't take too long for someone to figure out Mrs. Kennedy's password was <SUPER>man. Of course my password instantly became yellow<SUB>marine. * http://xahlee.info/kbd/plato_iv_keyboard.html http://xahlee.info/kbd/plato_iv_keyboard.html
- sedachv 7y ago
  > Plato terminals had a custom keyboard Every terminal and personal computer had a custom keyboard back then.
big_chungus 7y ago
A guy I worked with did this once, but on an esxi machine through the web interface. Took a very long time of figuring out what characters to press on an ssh connection from a mac to get the same, then to translate that to windows keyboard. Password changes often warn (or flat-out deny) if your password is too short, similar to username, etc.; maybe they should do so for control characters.
cantrevealname 7y ago
For everyone who finds this story confusing, I'll try a recap: The password file on UNIX systems from 1969 right up till the 1990s were readable by everyone on the system. However, the passwords were one-way encrypted or "hashed". For the password a user typed such as "p/q2-q4!", the password file contained a hash such as "ZghOT0eRm4U9s". It used to be a rite of passage of every aspiring UNIX systems programmer to write a cracking program to discover some of the passwords on their system -- typically by encrypting a dictionary of words to see if any matched up with the hashed values in password file. If everyone picked good passwords, this was futile. But on any large UNIX system, many users selected dictionary words so this attack was often successful. Recently someone unearthed the password file from one of the original systems on which UNIX and C were developed. Naturally it's great fun to discover the original passwords of all the UNIX luminaries such as Ken Thompson (his strong password being a chess move "p/q2-q4!"), Dennis Ritchie (password "dmac" -- anyone know what that might mean?), Brian Kernighan (an easy to type keyboard pattern "/.,/.,"), Steve Bourne, inventor of the Bourne shell, didn't seem to care and chose obvious password "bourne", and more here https://news.ycombinator.com/item?id=21209594 https://news.ycombinator.com/item?id=21209594. One lone password from the original list, Bill Joy's password, was still uncracked. Bill Joy is the co-founder of Sun Microsystems, author of vi, and a key developer of BSD UNIX. He apparently picked the best password. This latest news says that Bill Joy's password has now been cracked, that it uses a control character in place of a letter, it is otherwise all lowercase letters, and is a chess related term (as Ken Thompson's was also chess related). An an example, his password could be chess-related word "c^Astlng", where the ^A is control-A (but it isn't -- I checked). But the actual password has not been revealed "because of the outpouring of negativity about these disclosures, [the discoverer is] reluctant to post the actual password without [Bill Joy's] consent".
- pingyong 7y ago
  Pretty interesting that those guys took what are essentially joke passwords. Seems like they probably didn't expect anyone to bother trying to crack them.
cantrevealname 7y ago
If anyone would like to try their own hand at discovering Bill Joy's 1970s-era password, here's how to get started with the hashcat tool. First check if everything is working by trying a known result, e.g., Dennis Ritchie's password which we know was "dmac": apt-get install hashcat echo "dmac" > guesses hashcat --force -m 1500 -a 0 gfVwhuAMF0Trw guesses If see you a message that says, "gfVwhuAMF0Trw:dmac" and "Status: Cracked", it's working. Now put in Bill Joy's hash ".2xvLVqGHJm8M" in place of "gfVwhuAMF0Trw" and a list of guesses, one per line, in the guesses file, and run hashcat again. We've been told that the password is a chess-related word, all lowercase letters except that one letter is a matching control character, such as in "b^Ishop" where the "i" is actually a control-I.

186 points by MrXOR 7y ago

EamonnMR 7y ago

So much interesting content is locked in these oldschool mailing lists, how does a modern-day web user get into them?

capableweb 7y ago
Like the rest of us, get browsing! https://minnie.tuhs.org/pipermail/tuhs/ https://minnie.tuhs.org/pipermail/tuhs/ Might as well add a disclaimer: back in the days, in order to find the gold nuggets on the web, you had to shift through shit. A lot of shit. But then once in a while, you find those little nuggets that made the whole shit-shifting worthwhile. Useful exercise in patience for beginner webbers maybe.
- AceJohnny2 7y ago
  > back in the days, in order to find the gold nuggets on the web, you had to shift through shit. "back in the day"? Edit: no, I meant, it hasn't changed since then. Sturgeon's Law still applies today.
  - awgm 7y ago
    Either way
  - capableweb 7y ago
    I did not know that it's "day" not "days". Not a native English speaker and have always been saying it "days". Thank you for correcting me!
    - mikorym 7y ago
      Both could be correct. Here I think "day" could make more sense. An example of the other case: "Back in the days of Fortran programming..." If you leave out anything after "days" by just saying "back in the days" then it is like you are pausing. As in when you reminisce, "Oh, back in the days!" Maybe that is what the intention was. In any case, the commentor was actually just saying that he thinks nothing has changed.
  - capableweb 7y ago
    Sorry, I misunderstood and thought you were trying to correct me! Thanks anyway :) I would agree, but I think the difference nowadays (had to look up I got "nowadays" right, seems I did!) is that people usually want a quality filter in front of them (like upvotes, likes, retweets or some other metric) rather than just having to judge by themselves. In good ol' email threads, you always had to judge by yourself. In social media today, many assume quality because of metrics.
- kevin_thibedeau 7y ago
  Google can't monetize this content so it ends up on page 5 behind all the irrelevant SEO links.
  - mav3rick 7y ago
    If enough legit and important articles linked to it , it would be at the top.
    - capableweb 7y ago
      And what decides if a article is "legit and important"? If some other legit and important article links to it, of course! And so we continue, until only the bottom-feeding "high quality" is left at the top of the search result, which is generally boring but "correct" content.
    - Bjartr 7y ago
      If that were true there wouldn't be so much bullshit on the first few pages. Try doing a Google search that gets lots of low-effort ad-stuffed "top x" or "best x of 2019" lists or similar garbage and changing the date range to limit results to before 2008 or thereabouts. It's incredible how much more useful, and easier to quickly evaluate, the results often are.
      - mav3rick 7y ago
        Only if your bullshit meter was an objective meter. It's subjective. Links to a page is at least objective.
  - rasz 7y ago
    Google Groups should have this, but search in Groups is permanently broken. Search, you know, Googles main domain.
tedunangst 7y ago
Subscribe to the list and use a webmail client.
TheDong 7y ago
You need an email account in order to join a mailing list, so get one of those. Your ISP probably gives you one, but you can also use one of the more obscure email providers like yahoo or gmail if you want. I'm a fan of fastmail on my own domain. Once you have an email address, this content is now available to you! Most mailing lists are free and easy to subscribe to.
- capableweb 7y ago
  I understand where you coming from, but I don't think this "modern web-user" is unfamiliar with what email is, so the sarcastic tone is a bit over the top and usually not appreciated on HN. Instead you could have spent time explaining a better way of browsing the content, or what to consider when reading. Instead of assuming this person doesn't know what a email address is.
  - kick 7y ago
    He was doing it in the style of the WWW of the past, it wasn't sarcastic, it was a fun and friendly joke.
- EamonnMR 7y ago
  I understand the concept of a mailing list, but how do you discover new lists?

js2 7y ago

The current title ("It was Bill Joy's password, not Ken Thompson") I assume is in reference to Ken's password being cracked two weeks ago. The title is not correct. Ken's password was cracked. Bill Joy's password has now also been cracked, but not disclosed w/o getting permission from Joy to do so first. Discussion from two weeks ago - https://news.ycombinator.com/item?id=21202905 https://news.ycombinator.com/item?id=21202905 Message posting /etc/password entries - https://minnie.tuhs.org/pipermail/tuhs/2019-October/018854.html https://minnie.tuhs.org/pipermail/tuhs/2019-October/018854.h... Message showing Ken's cracked password - https://minnie.tuhs.org/pipermail/tuhs/2019-October/018917.html https://minnie.tuhs.org/pipermail/tuhs/2019-October/018917.h... Message showing Bill Joy's hashed password - https://minnie.tuhs.org/pipermail/tuhs/2019-October/018955.html https://minnie.tuhs.org/pipermail/tuhs/2019-October/018955.h... A correct title would be "Bill Joy's password has now also been cracked."

oneepic 7y ago
I thought it was referring to the fact the author found his expectation was the opposite of reality -- he first assumed it would have been Ken, not Bill Joy, to have a control character in his password. But Bill was the one.
tedunangst 7y ago
The title is in reference to which password contained a control character. It is truncated, but not incorrect.
- dang 7y ago
  Ok, we've put a control character in the title above. (Submitted title was "It was Bill Joy's password, not Ken Thompson"... also a category error to compare a password to Ken.)
  - tedunangst 7y ago
    I suppose you could construct a sentence like "it was bill joys password, not Ken Thompson, which unlocked the safe" in response to a (exaggerated) story about Ken picking a lock.

mzs 7y ago

Bill Joy used a control character: Second attempt was lower-case with control characters, and succeeded in around 40 minutes. There's a control character in it ;) Because of the outpouring of negativity about these disclosures, I am reluctant to post the actual password without the user's consent, since he's still alive. If anyone knows Bill, and can contact him, please ask for permission. https://minnie.tuhs.org/pipermail/tuhs/2019-October/019124.html https://minnie.tuhs.org/pipermail/tuhs/2019-October/019124.h...

MrXOR 7y ago

Sorry, the title and I were wrong. now, I read the full story and a better correct title is: "Bill Joy's Unix password had a control character". @dang, please edit the title.

ohjeez 7y ago

I knew someone who started with DEC minicomputers. His original password included a backspace. That is, the password might have looked like 1234 but it was actually 12^H34 because at that point, the backspace character was still a terminal command.

gm3dmo 7y ago

They all had their uid set to 0?

DrStalker 7y ago
From memory setting a UID to 0 was a way to effectively have multiple root accounts on a system. sudo is a much better solution to the same problem so using uid 0 in this manner is not something I expect to see on any modern unix/linux system.
- dredmorbius 7y ago
  "shutdown" or "reboot" as a UID=0 user with shell set to "/sbin/shutdown" or "/sbin/reboot" and a specific password is still occasionally found. Log in as that to shut down or reboot system.

EvanAnderson 7y ago

If you read on in the thread there's this fun story[1]: > John P. Linderman jpl.jpl at gmail.com > Sat Oct 19 23:11:10 AEST 2019 > Related story. A user came to us with a problem while we were in our computer room. We asked him to log in at the VAX console, so we could look into the problem. Moments later, dozens of users flooded in, asking what had happened. Seems the first user had a CTRL-P in his password, which, when entered at the console, triggered the VAX to pause. [1] - https://minnie.tuhs.org/pipermail/tuhs/2019-October/019137.html https://minnie.tuhs.org/pipermail/tuhs/2019-October/019137.h...

carokann 7y ago
I do this all the time with bash. I run a python script, and try to ctrl+c the output of it while it's still running. My brain refuses to learn right click.
- lejar 7y ago
  ctrl+shift+c will copy it. :)

rs23296008n1 7y ago

Thank the relevant deity. Now I can sleep at night. The restless nights can now end and I can resume a normal life again. Whew!

rs23296008n1 7y ago
I stand by my comment as it points out the complete unimportance of this article. Even a post by someone making something as part of their programming portfolio would have been more useful to the world.

projektfu 7y ago

I inadvertently had this on a Sun. I was entering a new password from a remote terminal and accidentally hit a lower case letter where I wanted an upper case one. Reflexively I hit backspace, and the Sun used DEL, so it stored a ^H in the password. I was then unable to change it because while getty or login could handle it, passwd wouldn’t accept it as my existing password.

technofiend 7y ago
Anecdotally pressing ^v triggers quoting so the next character is taken verbatim. So ^v^h should have worked.
- projektfu 7y ago
  There was a ton of wizardry I didn’t know at the time
  - technofiend 7y ago
    I hear you. The very first system Unix system I had root to ended up with two etc directories. It took a really long time to figure out I hadn't corrupted the filesystem but instead had created one directory named /etc<DEL> which was an unprintable character.
    - anon9001 7y ago
      `mkdir -- "$(echo "-rf \u2215")"` is a fun one for someone else to anxiously rm later ;)
      - technofiend 7y ago
        Lol. The lessons I learned about ls -lq, ls -li and find -inum have stuck with me since then, though.
- kazinator 7y ago
  Interestingly, this feature (the LNEXT character which causes the next one to be literal) is still not in POSIX. https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/termios.h.html https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/te... The VLNEXT macro is mentioned as reserved for implementations though.

technofiend 7y ago

Plato terminals had a custom keyboard* which included buttons for super and subscripts. The administrator for our school district's account had special privileges including the ability to create new users, give others the right to create lessons, more disk space and was highly coveted. It didn't take too long for someone to figure out Mrs. Kennedy's password was <SUPER>man. Of course my password instantly became yellow<SUB>marine. * http://xahlee.info/kbd/plato_iv_keyboard.html http://xahlee.info/kbd/plato_iv_keyboard.html

sedachv 7y ago
> Plato terminals had a custom keyboard Every terminal and personal computer had a custom keyboard back then.

big_chungus 7y ago

A guy I worked with did this once, but on an esxi machine through the web interface. Took a very long time of figuring out what characters to press on an ssh connection from a mac to get the same, then to translate that to windows keyboard. Password changes often warn (or flat-out deny) if your password is too short, similar to username, etc.; maybe they should do so for control characters.

cantrevealname 7y ago

For everyone who finds this story confusing, I'll try a recap: The password file on UNIX systems from 1969 right up till the 1990s were readable by everyone on the system. However, the passwords were one-way encrypted or "hashed". For the password a user typed such as "p/q2-q4!", the password file contained a hash such as "ZghOT0eRm4U9s". It used to be a rite of passage of every aspiring UNIX systems programmer to write a cracking program to discover some of the passwords on their system -- typically by encrypting a dictionary of words to see if any matched up with the hashed values in password file. If everyone picked good passwords, this was futile. But on any large UNIX system, many users selected dictionary words so this attack was often successful. Recently someone unearthed the password file from one of the original systems on which UNIX and C were developed. Naturally it's great fun to discover the original passwords of all the UNIX luminaries such as Ken Thompson (his strong password being a chess move "p/q2-q4!"), Dennis Ritchie (password "dmac" -- anyone know what that might mean?), Brian Kernighan (an easy to type keyboard pattern "/.,/.,"), Steve Bourne, inventor of the Bourne shell, didn't seem to care and chose obvious password "bourne", and more here https://news.ycombinator.com/item?id=21209594 https://news.ycombinator.com/item?id=21209594. One lone password from the original list, Bill Joy's password, was still uncracked. Bill Joy is the co-founder of Sun Microsystems, author of vi, and a key developer of BSD UNIX. He apparently picked the best password. This latest news says that Bill Joy's password has now been cracked, that it uses a control character in place of a letter, it is otherwise all lowercase letters, and is a chess related term (as Ken Thompson's was also chess related). An an example, his password could be chess-related word "c^Astlng", where the ^A is control-A (but it isn't -- I checked). But the actual password has not been revealed "because of the outpouring of negativity about these disclosures, [the discoverer is] reluctant to post the actual password without [Bill Joy's] consent".

pingyong 7y ago
Pretty interesting that those guys took what are essentially joke passwords. Seems like they probably didn't expect anyone to bother trying to crack them.

cantrevealname 7y ago

If anyone would like to try their own hand at discovering Bill Joy's 1970s-era password, here's how to get started with the hashcat tool. First check if everything is working by trying a known result, e.g., Dennis Ritchie's password which we know was "dmac": apt-get install hashcat echo "dmac" > guesses hashcat --force -m 1500 -a 0 gfVwhuAMF0Trw guesses If see you a message that says, "gfVwhuAMF0Trw:dmac" and "Status: Cracked", it's working. Now put in Bill Joy's hash ".2xvLVqGHJm8M" in place of "gfVwhuAMF0Trw" and a list of guesses, one per line, in the guesses file, and run hashcat again. We've been told that the password is a chess-related word, all lowercase letters except that one letter is a matching control character, such as in "b^Ishop" where the "i" is actually a control-I.