Cracking the Passwords

When you crack passwords, you could be breaking the law. Do it only in the context of our course.

1. Terminology: Lookup Tables, password lists, crack hashes.
2. https://haveibeenpwned.com/ Check if you have an account that has been compromised in a data breach!
3. https://www.onlinehashcrack.com/ A password recovery service assisting pen-testers & security experts since 2008. Non-profit.
4. Penetration testing includes password audit.
5. https://www.kali.org/news/kali-linux-aws-cloud/ December 2016 Kali Linux full images are free on the Amazon AWS marketplace. Make sure to fill out the Amazon penetration testing request form.
6. https://github.com/offensive-security/kali-cloud-build Kali bootstrapping script for Amazon Machine Images (AMI)
7. There are many other penetrations distros. Visit http://distrowatch.com

A login Trojan, a keyboard logger, un-encrypted communication with an ISP or website, …, can all get the plain text password. We (should) call this stealing – not cracking.

1. [From "The New Hacker's Dictionary" aka Jargon File] Social engineering is a term used among crackers and samurai for stealing (cracking?) techniques that rely on weaknesses in wetware rather than software; the aim is to trick people into revealing passwords or other information that compromises a target system's security.
2. Classic scams include phoning up a mark who has the required information and posing as a field service tech or a fellow employee with an urgent access problem.

1. A now common stealing (cracking?) technique is to attempt to login at a site, and cause a password reset request to be sent to the email address on record, which the attacker has gathered through other techniques. This email is then intercepted.

Read smartphone fingerprint scanners are they secure?. Read also How To Fool a Fingerprint Security System at http://www.instructables.com/. Does this really work? May be not always. But, as can be seen, this is mostly a question of perfecting such techniques. Here is more advice: why you should not use the new smartphone fingerprint readers.

1. What exactly are rainbow tables cannot be explained without first talking about crypto hashes, hash chains etc.
2. Hash functions are used in data bases, etc. Every hash function maps a large domain into a small range of numbers. Thus, there always will be collisions, i.e., for two a, b, (hash) = hash(b). Note also that the inverse of a hash function is not a function.
3. Crypto-hash functions, chash, are used in storing passwords, etc. A few famous crypto hash functions are MD5, SHA1, SHA512. Every crypto hash function is an ordinary hash function also.
4. The result r of chash(a) is known as a hash of a. The r is not considered an encryption of a.
5. The crypto hash functions are so carefully designed/ constructed/ implemented that, until recently (?), there was no "computationally feasible" algorithm that can be applied to the following problem. Because of this they are also called one-way.
6. Suppose we already know, chash(a) = y, where a is a plain text input, and y was the result of a crypto-hash function chash. Discover a b so that: chash(b) = y.
7. For MD5 and SHA1, in the last few years, the above problem has been solved.
8. http://en.wikipedia.org/wiki/Cryptographic_hash_function

1. Brute force "decryption"
2. Crackers obtain /etc/passwd and /etc/shadow files through other techniques, and crack the encoded passwords on their own computer systems.
3. To speed up password cracking, a dictionary of words and well-known passwords are encoded using all possible salt values. These are compared with the encoded passwords in the /etc/shadow file. These are compared with the encoded passwords in the /etc/shadow file. Several machine-readable collections of dictionaries are available for various uses, including cracking.
4. An 8 character password encodes, with salt, to one of 4096 * 13 character strings. So, a dictionary of say 2,000,000 common words, names, passwords, and simple variations would amount to some 20 GB.

1. ./Rainbow-Tables What are Rainbow Tables? These use good amount of discrete math.

1. https://haveibeenpwned.com/ Check if you have an account that has been compromised in a data breach!
2. https://www.onlinehashcrack.com/ "Online Hash Crack is a password recovery service assisting pen-testers & security experts since 2008." Non-profit.

1. JTR is a password cracker. Linux/Unix, Windows. Command line. apt-get install john Installs john, unshadow, etc. https://github.com/magnumripper/JohnTheRipper
2. Suppose we have a file of salted and encoded passwords, such as /etc/shadow of Linux. John can try hard to crack these into plain text. Can take hours.

   sudo apt-get install john
   sudo unshadow /etc/passwd /etc/shadow > /tmp/mypasswd.txt
   john /tmp/mypasswd.txt
   

3. Attempts (i) a dictionary attack, (ii) combined dictionary words, (iii) hybrid attack of dictionary words with special characters and numbers, (iv) brute force.
4. John prints a status line when a key is pressed. John can create multiple named sessions. http://www.openwall.com/john/doc full docs, including download links, etc.
5. http://rafaveguim.github.io/cracking/passwords/jtr/2016/05/05/jtr-research-lab/ Generate charts with --external=AutoStatus and chart_logs.py . 2016.
6. ./john.html

1. Hashcat is a "password recovery" utility, using CPUs, GPUs, and other hardware accelerators on Linux, Windows, and OSX. Can do distributed password cracking.
2. ./HashCat/hashcat-wip.html

1. http://project-rainbowcrack.com/ RainbowCrack uses rainbow tables to crack unsalted hashes. It differs from brute force hash crackers. GPU acceleration is a key feature of RainbowCrack. It can offload most runtime computation to GPUs (NVIDIA/ AMD).
2. http://project-rainbowcrack.com/table.htm A List of Rainbow Tables. Key space of 13,759,005,997,841,642. Several TB of generated rainbow tables for LM, NTLM, MD5 and SHA1 are listed. Not (all) free.
3. http://project-rainbowcrack.com/ has freely downloadable executables for all major OS:
   1. rtgen: generate rainbow tables,
   2. rsort: sort the rainbow table;
   3. rcrack: find the password.

1. https://crackstation.net/ CrackStation uses massive pre-computed lookup tables created by extracting every word from the Wikipedia databases and adding with every public password list.
2. Buy crackstation-wordlist password-cracking dictionary. Their lookup table implementation (PHP and C) is available at https://github.com/defuse/crackstation-hashdb

1. Attempting to visit http://www.thc.org/ may produce the ominous Google warning: "The site ahead contains harmful programs". Personally, I think, this site is safe to visit. But, go with your own instincts.
2. "Hydra is a parallelized login cracker which supports numerous protocols to attack. It is very fast and flexible, and new modules are easy to add. This tool makes it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely."
3. "When you need to brute force crack a remote authentication service, Hydra is often the tool of choice. It can perform rapid dictionary attacks against more than 50 protocols, including telnet, ftp, http, https, smb, several databases, and much more. Like THC Amap this release is from the fine folks at THC." – http://sectools.org/tool/hydra/
4. apt-get install hydra https://www.thc.org/thc-hydra/ ; https://github.com/vanhauser-thc/thc-hydra; http://tools.kali.org/password-attacks/hydra
5. THC-Hydra http://sectools.org/tool/hydra/ "When you need to brute force crack a remote authentication service, Hydra is often the tool of choice. It can perform rapid dictionary attacks against more than 50 protocols, including telnet, ftp, http, https, smb, several databases, and much more." Multi platform.
6. Hydra can generate passwords.

   hydra -t 128 -l user_name -V -x '4:4:aA1"@#$!()=`~?><;:%^&*_-+/,.\ ' localhost ssh
   

   Read the manual for details.

7. Cracking hydra -l pmateti -P passwordhashes.txt 192.168.17.223 ssh

1. Brutus https://github.com/mjosaarinen/brutus is an open source online password cracking tool. For both Linux and Windows. HTTP, POP3, FTP, SMB, Telnet, IMAP, NNTP, NetBus, etc.

1. apt-get install medusa
2. http://foofus.net/goons/jmk/medusa/medusa.html Medusa Parallel Network Login Auditor.

1. Ubuntu: apt-get install ophcrack http://ophcrack.sourceforge.net/
2. OphCrack is a free rainbow-table based password cracking tool for Windows, Linux and MacOS. It cracks LM and NTLM hashes. Free and premium rainbow tables. It is among the most popular Windows password cracking tools (Cain and Abel is probably the most popular; see below).
3. L0phtCrack is an alternative to OphCrack. It attempts to crack Windows passwords. It also uses dictionary and brute force attacks for generating and guessing passwords.
4. L0phtCrack was acquired by Symantec and they promptly discontinued it in 2006. Later, L0phtCrack developers re-acquired this tool and re-released it in 2009.

1. http://thesprawl.org/projects/pack/ Password Analysis and Cracking Kit (PACK) of Defcon 2010.

1. http://www.oxid.it/ last release 2014; Cain and Abel is a password "recovery tool" for Windows. "It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, recovering wireless network keys, revealing password boxes, uncovering cached passwords and analyzing routing protocols."
2. "Cain and Abel can crack passwords using a dictionary attack, rainbow attack, and brute force. … It is also a great ARP Poisoning and MiTM tool."
3. https://software-tips.wonderhowto.com/how-to/hack-md5-passwords-with-cain-and-abel-356762/

1. http://www.aircrack-ng.org/ Aircrack-NG can crack WEP or WPA2 passwords. It uses the FMS attack along with other useful attack techniques for cracking password. For Linux and Windows. Capable of creating an Evil Twin, etc.

1. http://wfuzz.org/ + https://github.com/xmendez/wfuzz Wfuzz is a Python based flexible web application brute forcer which supports various methods and techniques to expose web application …
2. Crack programs now use GPUs (visit e.g., http://www.cryptohaze.com/) in parallelizing and can try billions of hashes per second.
3. Application Specific Crack tools
   1. http://pdfcrack.sourceforge.net/
   2. http://rarcrack.sourceforge.net/
4. http://sectools.org/tag/pass-audit/ Password Audit tools. Ranked by votes.

https://crackstation.net/ CrackStation uses massive pre-computed lookup tables to store a mapping between the hash of a password, and the correct password for that hash.

"The hash values are indexed so that it is possible to quickly search the database for a given hash. If the hash is present in the database, the password can be recovered in a fraction of a second. This only works for "unsalted" hashes. For information on password hashing systems that are not vulnerable to pre-computed lookup tables, see our hashing security page."

Crackstation's lookup tables were created by extracting every word from the Wikipedia databases and adding with every password list we could find. We also applied intelligent word mangling (brute force hybrid) to our wordlists to make them much more effective. For MD5 and SHA1 hashes, we have a 190GB, 15-billion-entry lookup table, and for other hashes, we have a 19GB 1.5-billion-entry lookup table.

1. https://www.kali.org/news/kali-linux-aws-cloud/ December 2, 2016 "We’re happy to announce that we’ve once again listed our Kali Linux images on the Amazon AWS marketplace. You can now spin up an updated Kali machine easily through your EC2 panel. Our current image is a “full” image, which contains all the standard tools available in a full Kali release. Once your instance is running, connect to it with your SSH private key using the “ec2-user” account. Don’t forget to update your Kali instance to get the latest packages and bug fixes. Type as root (or sudo): apt update && apt dist-upgrade. We are “selling” these images on the marketplace for free, so other than the regular Amazon charges, there are no extras to pay. The Kali team would like to take this opportunity to thank r0kh for his efforts of getting Kali back on track (no pun intended) and working flawlessly in AWS. If you plan to use these Kali images for penetration testing in an AWS environment, make sure you check out the Amazon penetration testing request form."
2. https://www.kali.org/news/azure-marketplace-weekly-iso-builds/ September 13, 2016
3. https://github.com/offensive-security/kali-cloud-build Kali bootstrapping script for Amazon Machine Images (AMI)

1. You may want to construct your own examples of the passwd and shadow files, where you know the passwords you used.
2. Design a password that is not crackable by any of the tools.

1. The following are readily available "word lists" in the context of choosing good passwords. This is obviously not an exhaustive list. Note also that some files are populated at multiple sites. These are collections of broken password databases.
2. /usr/share/wordlists/* of the Kali Linux distribution.
3. ./500-worst-passwords.txt Worst passwords that were actually in use.
4. http://weakpass.com/lists More of the above kind. A large collection. Totaling in the GB range.
5. https://github.com/danielmiessler/SecLists/ is the security tester's companion. It is a collection of multiple types of lists used during security assessments. List types include usernames, passwords, URLs, sensitive data grep strings, fuzzing payloads, and many more. It includes a collection of password lists. It includes the RockYou lists.
6. http://contest-2010.korelogic.com/wordlists.html wordlists used in "Crack Me If You Can" contest of DEFCON 2010.
7. https://wiki.skullsecurity.org/Passwords Passwords that were leaked or stolen from sites.
8. http://www.justpain.com/ut_maps/wordlists/ Not just passwords. Words tokenized from books, etc.
9. http://www.adeptus-mechanicus.com/codex/hashpass/hashpass.php Hashdumps and Passwords 2014
10. http://www.openwall.com/wordlists/ "This wordlists collection is a result of processing many hundreds of public domain wordlist files." Full version is not free. The reduced freely downloadable version is available at https://download.openwall.net/pub/.
11. Mark Burnett, Today I Am Releasing Ten Million Passwords, 2015. "This is completely absurd that I have to write an entire article justifying the release of this data out of fear of prosecution."

1. Download (or find/ discover in Kali/ BT5) at least two password cracking programs. You can find several by searching the web.
2. Depending on the tools downloaded, you will need to build differently. Do this as an ordinary user, not as root, unless impossible. You may also need to download "dictionaries" for use by the tools.
3. John the Ripper (john) is a fast password cracker.