Presentation Slides

Password Cracking Basics

For CTF Competitions

Preface - Different Representations of ASCII

These are not passwords, rather different representations of the letters.

Why do passwords need to be “cracked”?

Passwords are hashed

• One-way function - cannot easily get password from hash
• Given the same input, always gives the same output
• No two inputs give the same output

If you hit “Forgot Password” and were emailed your password back, think again about using that service.

Password Salting

Passwords are often “salted”

• Random data added as an input to the hashing algorithm
• Different salt per-password
• Salt is saved next to hash and isn’t secret

Approaches

• Hash Tables
• Brute Force
• Dictionary

Hash Tables

Hash tables are precomputed lookup tables of passwords and their hashed variants which leads to near-instant decoding of hashes.

• Makes cracking common passwords trivial
• Salting would make these tables impossibly big

Brute Force

Try every combination of characters for increasing lengths

• Might take a few lifetimes of the universe for longer passwords

abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
0123456789
 !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

+ Foreign Language Characters

Dictionary Attacks

• Words are easy to remember
• People like remembering passwords

RockYou

• Social Media Widget Maker Company
• Easy SQL Injection
• Stored 32 million user’s passwords in plaintext
• This was dumb, even in 2009

Common Hash Types

List of Example Hashes

Name That Hash

• There are multiple tools for identifying hashes, this is just one of them

Online Hash Cracking Services

http://rainbowtables.it64.com/

• Cracks LM Hashes

https://hashes.com/en/decrypt/hash/

• Looks up MD5, SHA1, NTLM, SHA256, SHA512

https://crackstation.net/

• Looks up LM, NTLM, MD5, SHA1, SHA224, SHA256, SHA384, SHA512, whirlpool

ophcrack

ophcrack is a free Windows (LM/NTLM) password cracker using Rainbow Tables

John The Ripper

CPU Password Cracker

• 7z2john
• zip2john
• pdf2john
• office2john

Hashcat

GPU Accelerated Password Cracker

• Fast
• Can use multiple GPUs
• Multiple Attack Types

Hashcat Attack Modes

Picking a Wordlist

• RockYou
• Find one online
• Make your own list
  • Scrape Wikipedia Articles
  • Kaggle (Dataset Website)

Hashcat Arguments

Specify hash type with -m #

Specify attack mode with -a #

Speedup Arguments

• -O uses “optimized kernels”. Limits max length.
• -w # sets the workload profile
  • 1 is Low
  • 2 is Normal
  • 3 is High - Will lag system GUI
  • 4 is “Nightmare” - Will lag system GUI

Dictionary Attack (Mode 0)

hashcat -m 0 -a 0 MD5_Hash_File.txt wordlist.txt

password

Combinator Attack (Mode 1)

hashcat -m 0 -a 1 MD5_Hash_File.txt animal_names.txt city_names.txt

WolfChicago

Mask Attacks (Mode 3)

hashcat -m 0 -a 3 MD5_Hash_File.txt CTF-?u?u?u?u-?d?d?d?d

CTF-AAAA-0000 through CTF-ZZZZ-9999

Hybrid Attacks (Mode 6)

hashcat -m 0 -a 6 MD5_Hash_File.txt wordlist.txt ?d?d?d?d

password0000 through lastpassword9999

Hybrid Attacks (Mode 7)

hashcat -m 0 -a 7 MD5_Hash_File.txt ?d?d?d?d wordlist.txt

0000password through 9999lastpassword

Rules

Works on Dictionary Attacks and Hybrid Attacks

• OneRuleToRuleThemAll (Universal Rule)
• Pantagrule (Universal Rule)
• toggles# (Toggles upper/lowercase of a word)
• leetspeak (l33t)

hashcat -m 0 -r leetspeak.rule -r toggles1.rule -a 0 MD5_Hash_File.txt wordlist.txt

Passw0rd pa55woRd

aircrack-ng

Crack WEP/WPA-PSK passwords

aircrack-ng -w dictionary.txt wireless.cap

hcxtools

Convert wireless captures to JtR/Hashcat

Useful Links

Hashcat Example Hashes

Name That Hash

John The Ripper Tools Online

Wordlist Sites

Weakpass

SecLists

wordlistctl CLI tool

Hashcat Rules

One Rule To Rule Them All

Pantagrule

Kaonashi

Hashcat Rules