Always ensure you have explicit permission to access any computer system before using any of the techniques contained in these documents. You accept full responsibility for your actions by applying any knowledge gained here.
I have found that I can squeeze some more power out of my hash cracking by adding these parameters:
These will force Hashcat to use the CUDA GPU interface which is buggy but provides more performance (–force) , will Optimize for 32 characters or less passwords (-O) and will set the workload to "Insane" (-w 4) which is supposed to make your computer effectively unusable during the cracking process. Finally "--opencl-device-types 1,2 " will force HashCat to use BOTH the GPU and the CPU to handle the cracking.
Using a dictionary
Hashcat example: cracking Linux md5crypt passwords (identified by $1$) using a wordlist:
hashcat --force -m 500 -a 0 -o $out_cracked_passes $hash_file $pass_list
Hashcat example cracking WordPress passwords using a wordlist: hashcat --force -m 400 -a 0 -o $out_cracked_passes $hash_file $pass_list
Put the OneRuleToRuleThemAll.rule file into the /usr/share/hashcat/rules/ folder and run it:
Using Hashcat for brute-forcing
Predefined character sets:
?u?l?d is the same as: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
Brute-force all passwords of length 1-8 with these possible characters: A-Z a-z 0-9 hashcat -m 500 $hash_file -a 3 --increment -1 ?l?d?u ?1?1?1?1?1?1?1?1
After grabbing or dumping the NTDS.dit and SYSTEM registry hive or dumping LSASS memory from a Windows machine:
Path
Description
C:\Windows\NTDS\ntds.dit
Active Directory database
C:\Windows\System32\config\SYSTEM
Registry hive containing the key used to encrypt hashes
Using Impacket to dump the hashes:
You can crack the NTLM hash dump usign the following hashcat syntax:
Cracking KRB5TGS Hashes - "Kerberoasting"
A service principal name (SPN) is a unique identifier of a service instance. SPNs are used by Kerberos authentication to associate a service instance with a service logon account. This allows a client application to request that the service authenticate an account even if the client does not have the account name. These SPNs cat be collected by using a username list and Impacket's example scripts. After gathering a list of valid usernames that have the property ‘Do not require Kerberos pre-authentication’ set (UF_DONT_REQUIRE_PREAUTH), you can get the SPN hash for cracking, replay, or creating of Kerberos tickets using the example below.
Hashcat supports multiple versions of the KRB5TGS hash which can easily be identified by the number between the dollar signs in the hash itself.
13100 - Type 23 - $krb5tgs$23$
19600 - Type 17 - $krb5tgs$17$
19700 - Type 18 - $krb5tgs$18$
KRB5TGS Type 23 - Crackstation humans only word list with OneRuleToRuleThemAll mutations rule list.
To crack Linux hashes with John you must first unshadow them
Hashcat appears to have issues with some zip hash formats generated from zip2john. You can fix this by editing the zip hash contents to align with the example zip hash format found on the hash cat example page: $zip2$*0*3*0*b5d2b7bf57ad5e86a55c400509c672bd*d218*0**ca3d736d03a34165cfa9*$/zip2$
John seems to accept a wider range of zip formats for cracking.
John the ripper: john --wordlist=/usr/share/wordlists/rockyou.txt <hash_file>
openssl passwd -l [or 1?] -salt <any_salt_value> <password>
<username>:<generated_pass>:0:0:root:/root:/bin/bash #enter into /etc/passwd like this
using System;
using System.IO;
using System.Security.Cryptography;
using System.Text;
public class Program
{
public static void Main()
{
//Change these three variables to decode your own; need a key and IV to decode!
string ciphertext = "BQO5l5Kj9MdErXx6Q6AGOw==";
string key = "c4scadek3y654321";
string iv = "1tdyjCbY1Ix49842";
string plaintext = string.Empty;
plaintext = DecryptString(ciphertext, key, iv);
Console.WriteLine(plaintext);
}
public static string DecryptString(string EncryptedString, string Key, string iv)
{
byte[] buffer = Convert.FromBase64String(EncryptedString);
Aes aes = Aes.Create();
((SymmetricAlgorithm) aes).KeySize = 128;
((SymmetricAlgorithm) aes).BlockSize = 128;
((SymmetricAlgorithm) aes).IV = Encoding.UTF8.GetBytes(iv);
((SymmetricAlgorithm) aes).Mode = CipherMode.CBC;
((SymmetricAlgorithm) aes).Key = Encoding.UTF8.GetBytes(Key);
using (MemoryStream memoryStream = new MemoryStream(buffer))
{
using (CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, ((SymmetricAlgorithm) aes).CreateDecryptor(), CryptoStreamMode.Read))
{
byte[] numArray = new byte[checked (buffer.Length - 1 + 1)]; //not sure why this has -1+1 here, example works without it though...
cryptoStream.Read(numArray, 0, numArray.Length);
return Encoding.UTF8.GetString(numArray);
}
}
}
}
