SUCRACK(1)

📦 version 1.2.3, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 SUCRACK — the sucrack(1) page, bestie edition 💖

okay so listen. this is the manual page for sucrack, a general commands manual situation, and it's literally a multithreaded Linux/UNIX tool for brute-force cracking of local user accounts via su. yes THAT su. i'm gonna walk you through every single flag because you deserve to know everything, no gatekeeping 💅

✨ SYNOPSIS ✨

sucrack [options] wordlist

🦋 DESCRIPTION 🦋

sucrack is a multithreaded Linux/UNIX brute-force cracking tool. what it does is it drives su(1), referencing one specific user, and it feeds words from a wordlist in as passwords. one word at a time, over and over, that's the whole vibe.

the cute part? running sucrack does not require high privileges on the target system. like, it's not out here needing root to even start. that's the tea ☕

🌸 OPTIONS 🌸

so sucrack can read passwords from stdin. in that case, you use - instead of a filename as the wordlist parameter. iconic behaviour honestly.

common options:

  • -h — print the help message. the classic. the goat.
  • -a — use ansi escape codes so your statistics look pretty. (this needs the --enable-statistics configuration flag, so don't come for me if it's not vibing)
  • -s <seconds> — statistics display intervall. (again, needs the --enable-statistics configuration flag)
  • -c — only print statistics if a key other than q is pressed. so like, chill mode. you press something and THEN it tells you things.
  • -r — enable rewriting of dictionary words. (see rules below, they're fun)
  • -w <num> — number of threads to run with.
  • -b <size> — size of the word list buffer.
  • -u <user> — the user account to su to. this is kind of the whole point bestie.
  • -l <rules> — specify certain rules for the rewriting process.

🎀 rewriting rules 🎀

these are the letters you can hand to -l and they transform your words. obsessed.

  • A — rewrite word with only upper case characters
  • F — rewrite word with first character as upper case
  • L — rewrite word with last character as upper case
  • a — rewrite word with only lower case characters
  • f — rewrite word with first character as lower case
  • l — rewrite word with last character as lower case
  • D — prepend each digit (0-9) to the word
  • d — append each digit (0-9) to the word
  • e — enleet the word
  • x — apply all rules to a word

🌈 ENVIRONMENT VARIABLES 🌈

SUCRACK_SU_PATH

the path to su (usually /bin/su or /usr/bin/su)

SUCRACK_AUTH_FAILURE

the message su returns on an authentication failure (like "su: Authentication failure" or "su: Sorry")

SUCRACK_AUTH_SUCCESS

the message that indicates an authentication success. heads up: this message must not be a password listed in the wordlist. (the default is "SUCRACK_SUCCESS")

👑 AUTHOR 👑

Nico Leidecker <nfl@portcullis-security.com>

http://www.leidecker.info

💜 SEE ALSO 💜

su(1)

and that's the whole page bestie, go be safe and ethical out there, this is a security tool and i trust you with it 🫶

okay that's a wrap!! this was Version 1.2.3 of the SUCRACK(1) page, thanks for reading the whole thing you absolute icon 🎀✨💖

📦 where this page comes from