This module is designed to help you understand and learn the basic concepts of different password attacks.
Password Cracking Techniques
John
Single crack mode is a rule-based cracking technique that generates password candidates based on the victim’s username, home directory name, and GECOS values (full name, room number, phone number, etc.)
Wordlist mode is used to crack passwords with a dictionary attack, meaning it attempts all passwords in a supplied wordlist against the password hash
Incremental mode generates candidate passwords based on a statistical model (Markov chains); it is designed to test all character combinations defined by a specific character set
hashcat website hosts a comprehensive list of example hashes
hashID can be used to quickly identify the hashcat hash type
Hashcat has many different attack mode, including dictionary, mask, combinator, and association
Dictionary attack (-a 0) is where user provides password hashes and a wordlist as input, and Hashcat tests each word in the list as a potential password
Mask attack (-a 3) is a type of brute-force attack in which the keyspace is explicitly defined by the user
if wordlist alone is not enough to crack a password hash, we can use rules; rules files can be found at /usr/share/hashcat/rules
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
hashcat -a 0 -m 0 <hashes> [wordlist, rule, mask, ...]
# hash types hashcat --help
# identify hash type using hashid hashid -m '$1$FNr44XZC$wQxY6HHLrgrGX0e1195k.1'
# dictionary attack hashcat -a 0 -m 0 e3e3ec5831ad5e7288241960e5d4fdb8 /usr/share/wordlists/rockyou.txt
# dictionary attack with rules hashcat -a 0 -m 0 1b0556a75770563578569ae21392630c /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# mask attack password which starts with an uppercase letter, continue with four lowercase letters, a digit, and then a symbol hashcat -a 3 -m 0 1e293d6912d074c0fd15844d803400dd '?u?l?l?l?l?d?s'
Writing Custom Wordlists and Rules
We can use Hashcat to combine lists of potential names and labels with specific mutation rules to create custom wordlists how a given word should be transformed
Each rule is written on a new line and determines
Function
Description
:
Do nothing
l
Lowercase all letters
u
Uppercase all letters
c
Capitalize the first letter and lowercase others
sXY
Replace all instances of X with Y
$!
Add the exclamation character at the end
1 2 3 4 5 6
# apply rule in each word of password.list to create a password a new password list using the fule hashcat --force password.list -r custom.rule --stdout | sort -u > mut_password.list
# add relevant OSNIT about Mark White to file echo'''mark white august 5 1998 nexura ltd san francisco ca usa bella maria alex baseball ''' > mark.wordlist
# create custom rule echo': c so0 c so0 sa@ c sa@ c sa@ so0 $! $! c $! so0 $! sa@ $! c so0 $! c sa@ $! so0 sa@ $! c so0 sa@' > custom.rule
# create two-word combinations of every word the list with the same list hashcat --stdout -a 1 mark.wordlist mark.wordlist > mark_combined.wordlist
# create a password wordlist that's atleast 12 characters long awk 'length($0) >= 12' mark_combined.wordlist > mark_12wordlist
# crack password using the rule directly with -r flag hashcat -a 0 -m 0 97268a8ae45ac7d15c3cea4ce6ea550b mark_12wordlist -r custom.rule # or apply the rule to password list to create a new password list hashcat --force mark_12wordlist -r custom.rule --stdout | sort -u > mut_password.list hashcat -a 0 -m 0 97268a8ae45ac7d15c3cea4ce6ea550b mut_password.list
Cracking Protected Files and Archives
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
# find available scripts to exctract hashes from files locate *2john*
# cracking openssl encrytped gzip # using openssl tool with a for loop for i in $(cat rockyou.txt);do openssl enc -aes-256-cbc -d -in GZIP.gzip -k $i 2>/dev/null| tar xz;done
Cracking BitLocker-encrypted drives
bitlocker2john to four different hashes: the first two correspond to the BitLocker password, while the latter two represent the recovery key
recovery key is very long and randomly generated, it is generally not practical to guess
1 2 3 4 5
bitlocker2john -i Backup.vhd > backup.hashes
grep "bitlocker\$0" backup.hashes > backup.hash
hashcat -a 0 -m 22100 '$bitlocker$0$16$0...SNIPPED' /usr/share/wordlists/rockyou.txt