Custom Rules & Broken Tools (Password Cracking)

© Copyright 2017 NotSoSecure Global Services Limited, all rights reserved.
Custom Rules & Broken Tools

Will Hunt
• Associate Director @ NotSoSecure
• 9 years in InfoSec
• Pentester, formerly digital forensics, trainer of both
• @Stealthsploit / stealthsploit.com
$ whoami /all

• hashcat custom rule efficiency
• Cracking length limitations
What’s The Plan?

hashcat Custom Rule Efficiency

Dictionary Rules
password password Password
letmein letmein password
security security P@ssword
monkey monkey passw0rd
123456 123456 Passw0rd
qwerty qwerty P@ssw0rd
password1
passw0rd1
Dictionaries and Rules 101

hashcat Rules

hashcat Rules
https://hashcat.net/wiki/doku.php?id=rule_based_attack

• Objective – try and create a more efficient rule
• Method – test existing rules against large data set and
extract top performing individual rules
• Testbed – 2016 Lifeboat breach (Minecraft)
• 7 million unsalted MD5s – 4.3 mill unique
• Outcome – “One rule to rule them all….”
• Validate – test custom rule against
Lifeboat breach (and other) data
• Hope – I didn’t waste my time…
Roll Your Own

hashcat64.exe -m0 lifeboat_hashes rockyou.txt --status --status-timer=5
-w3 --debug-mode=1 --debug-file=stats-lifeboat-best64 --potfile-disable
-o lifeboat-best64 -r rulesbest64.rule
Let Cracking Commence

The Stats

Success and Efficiency

The Anomalies

• High concurrency
• Different rules produced the same plain text value
before the ‘:’ rule hit.
• E.g. Password is L3tme1n
• Dictionary contains l3tme1n
• If T0 rule hits before : rule… (T0 toggles case of first char)
• T0 gets the point, stealing it from :
The Anomalies

• Identify top 25% performing rules from each ruleset
• Concat & de-dupe
• Repeat the tests
• Custom rule cracked 2.72% (117,626) more passwords
• Not the most efficient
Super Rule Creation

Xsplit breach – 2013, 3m hashes, 2.2m unique, unsalted SHA-1
2.38% better (53,046)
Battlfield Heroes – 2011, 548k hashes, 423k unique, unsalted MD5
1.13% better (4,808)
More Validation Against 2nd Place

• Nope.
• Several factors – time, hardware, money, dictionary quality
• Continual optimisation
• Increased cumulative average success
• https://www.notsosecure.com/one-rule-to-rule-them-all/
• https://github.com/NotSoSecure/password_cracking_rules
#OneRuleToRuleThemAll?

Cracking Length Limitations

• @mubix
• Password candidates are stored in GPU registers
• Not enough registers to store long candidates
• i.e. hash won’t crack even if plain text is in dictionary
• Potential to exceed limits but processing time doubles
• JtR and hashcat investigated
Inspiration

• oclHashcat-plus v0.15 released in 2013 with support for
increased lengths, generally from 15 to 55 with exceptions
hashcat

https://hashcat.net/wiki/doku.php?id=frequently_asked_questions
• Mode 0 – Straight (dictionary)
• Mode 1 – Combination
• Mode 6/7 – Hybrid Wordlist + Mask / Hybrid Mask + Wordlist
hashcat

• NTLM – based on UTF16-LE which uses 16 bits (2 bytes)
per character
• Each character of pw is twice the length in bytes
hashcat

Dictionary contains only the password
Password: NowThePwIsTwentyEightLetters
NTLM – 27 Limit

Password: Weak SHA512crypt!
SHA512crypt – 16 Limit

• --list=format-all-details –format=NT
• JtR takes input by default as UTF8
• Note max length in bytes
JtR

• 27 Unicode characters may need up to 81 bytes of UTF8
(up to 3 bytes per char)
• Not often encountered - Japanese, Chinese, Korean,
random special chars etc
JtR

• Latest version of john jumbo has made things easier
• No longer shows length in bytes
JtR

•
• J
MD5 – 55 Limit

• L
MD5 – 55 Limit

•
• J
SHA-384 – 111 Limit

• L
SHA-384 – 111 Limit

• John jumbo can be custom compiled
• http://www.openwall.com/lists/john-users/2017/05/05/1
• Non-SIMD build can get higher numbers
• hashcat has a modified version – doesn’t support NTLM
• https://github.com/hashcat/hashcat/tree/longer_passwords_and_salts
• Both will take significant performance hits
Length Increases

• Cheat sheet for JtR supported hashes (Over 430 of them!)
• May differ from hashcat
• https://www.notsosecure.com/maximum-password-
length-reached/
• And remember, no matter what others may tell you…
Cheat Sheet

It’s All About The Length

Thank You
feedback/contact
training@notsosecure.com

Custom Rules & Broken Tools (Password Cracking)

Recommended

Recommended

More Related Content

Similar to Custom Rules & Broken Tools (Password Cracking)

Similar to Custom Rules & Broken Tools (Password Cracking) (20)

More from camsec

More from camsec (6)

Recently uploaded

Recently uploaded (20)

Custom Rules & Broken Tools (Password Cracking)