Cracking Hashes Using Logic Instead Of Power

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLx-C6rw_siknVcOlj9m43V_-2AGqb14fwp-e95OeRtzYQCRCuQo3jQqlJ3AS7UhxXnONKe_wrjRx8OEdxD-AylSLzXiVgIZVlBQuHq3ar_VHD9IstS7OOQmxYQBPIRXjZyf-87U1p5AY5/s1600/passhash.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="207" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLx-C6rw_siknVcOlj9m43V_-2AGqb14fwp-e95OeRtzYQCRCuQo3jQqlJ3AS7UhxXnONKe_wrjRx8OEdxD-AylSLzXiVgIZVlBQuHq3ar_VHD9IstS7OOQmxYQBPIRXjZyf-87U1p5AY5/s400/passhash.jpg" width="400" /></a></div><br />Often times you are up against a highly complicated password hash, which your CPU/GPU power sufficient to be able to crack in that scenario we can try alternative approaches to cracking passwords, In this post, "<b>Tyler Borland</b>" demonstrates a method of cracking hashes by using logic instead of power,<br /><h4 style="text-align: left;"><b>START:</b></h4><a href="http://7habitsofhighlyeffectivehackers.blogspot.com/2013/11/can-someone-be-targeted-using-adobe.html" rel="nofollow" target="_blank">http://7habitsofhighlyeffectivehackers.blogspot.com/2013/11/can-someone-be-targeted-using-adobe.html</a><br /><br />The article above talks about utilizing other compromised information rather than just hashes to aid in the hash cracking process. In particular, with the Adobe dump, the password<br />hints were used. Before I get into that, I'd like to talk about other styles that were used in the past.<br /><h4 style="text-align: left;"><b>Finding Patterns.</b></h4><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiE2MfyV99WhaIKc_7hpX_HxX2SYSUtTz_ujZOYhFCg0RnK4xDfcIpZLHPqpDfOgWKI2FfEHhUrzBlyQSdKATYMh0BT9e7m1njFo_l3zr6Yy8mAAz0dcxUiJ3gVHJIE0-zb6vVtjWBOXrwJ/s1600/Crack+me+if+u+can.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiE2MfyV99WhaIKc_7hpX_HxX2SYSUtTz_ujZOYhFCg0RnK4xDfcIpZLHPqpDfOgWKI2FfEHhUrzBlyQSdKATYMh0BT9e7m1njFo_l3zr6Yy8mAAz0dcxUiJ3gVHJIE0-zb6vVtjWBOXrwJ/s400/Crack+me+if+u+can.JPG" width="400" /></a></div><br /><br />In cracking competitions, like the "Crack Me If You Can" competition at Defcon, you see more than just powerful hardware and clusters being utilized to crack large amounts of<br />hashes. Instead the logistics of the already cracked passwords are utilized to enhance and speed the cracking efforts. For example, a good writeup of this is located at:<br /><br /><a href="http://www.sch0.org/index.php/crack-me-if-you-can" rel="nofollow" target="_blank">http://www.sch0.org/index.php/crack-me-if-you-can</a><br /><br />This article talks about finding patterns and building permutations off of it for better wordlists instead of straight bruteforcing. With password policies for a corporations, this<br />would be a great and useful technique to employ.<br /><h4 style="text-align: left;"><b>Profiling The target.)</b></h4><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjaXr6U-Sr1Mqz88bbmFo2rcFZ0Zgt_7kL8TOxCIrK3Vy_R6cYRsEU5eAfs0VnpAGn8hi13l0r395oavbKqYkXQZSlT0wQcKl_3zVecgm6vt5qb20xQfmuC6M7cPTJhQYPp21I4kpG3FNa-/s1600/wHIM2Qk.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="187" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjaXr6U-Sr1Mqz88bbmFo2rcFZ0Zgt_7kL8TOxCIrK3Vy_R6cYRsEU5eAfs0VnpAGn8hi13l0r395oavbKqYkXQZSlT0wQcKl_3zVecgm6vt5qb20xQfmuC6M7cPTJhQYPp21I4kpG3FNa-/s400/wHIM2Qk.png" width="400" /></a></div><br />Of course, such tactics are also used to build smart dictionaries off of individual targets for smarter bruteforcing wordlists. This method of building better wordlists is often<br />called 'password profiling'. An example of a Python tool to take advantage of this is CUPP:<br /><br /><a href="https://github.com/Mebus/cupp" rel="nofollow" target="_blank">https://github.com/Mebus/cupp</a><br /><br />This tool asks you a series of questions about the target. Things easily retrievable from social networking profiles. It then builds up a permutation and/or combination smart wordlist to take advantage of.<br /><h4 style="text-align: left;"><b>Using Other Compromised Details</b></h4>Fast forward to the article released today on cracking Adobe hashes. The technique being used by Joshua was not to run straight to trying to bruteforce the 3DES passwords, but<br />instead finding passwords used by several other people.<br /><br />Joshua then looked at the password hints being deployed by these users to find clues or to piece together a multitude of similar clues. Armed with this information he was then able to piece the information together to make educated guesses, if not knowing the exact password. Example quotes from article:<br /><br />"Now let's see if any other people in the dump have the exact same password hash as this account, and if so then how many.<br /><br /><b>[jdustin@localhost passwords]$ grep BBRXmv9FVlXioxG6CatHBw== cred | wc -l</b><br /><b>207"</b><br /><br />"Okay, let's grab those 207 the lines containing all accounts who used that same password, cut out just their password hints, and then sort them by how often that hint is in the list:<br /><br /><b>[jdustin@localhost passwords]$ grep BBRXmv9FVlXioxG6CatHBw== cred | cut -d"|" -f5 | sort | uniq -c | sort -nr | head -n50"</b><br /><div class="separator" style="clear: both; text-align: center;"></div><br /></div>

Cracking Hashes Using Logic Instead Of Power

Often times you are up against a highly complicated password hash, which your CPU/GPU power sufficient to be able to crack in that scenario ...

+ Read more »