12-07-2011, 01:17 AM
I might have thrown the 'e' flag to 7z, though i'm still at a loss as to where the rest of the files went. Thank you.
Got it extracted properly, it only sees one GPU out of crossfire mode, and runs NTLM on this thing @ about 630Mh/s when run with '-m 1000 + hash' and no other options.
In terms of doing the analysis - profiling is part of many security audits, not necessarily pentests, and the data gathered for the analysis is often not allowed off premises. Better yet, unless you want to turn all their workstations into a processing cluster for JTR, you're probably not likely to find a good GPU in an office firm (biotech firms are a different story apparently, they've figured out that these chips are useful). The restrictions usually lead to an understanding that a 'best effort' approach will be taken which will give us the low hanging fruit and then its a matter of explaining the difference to the client, and they usually dont mind. It is nice however to walk in with a real GPU available (had a 460m so far) and be able to go through their hashes with a more thorough approach. And give results based on some serious attacks on the hash.
Proper ROEs for a pentest determine whether or not we can pull stuff like that out of their networks, but since it usually comes down to demonstrating configuration faults by way of breach, its often possible to pull them out for more serious analysis.
It doesnt look like anything recognizes the ATI card if it's not in crossfire. Even the opencl demos dont seem to. However, in crossfire, there are computational errors... i'll try to re-link the cards and run lite 0.8 again. Thanks
Got it extracted properly, it only sees one GPU out of crossfire mode, and runs NTLM on this thing @ about 630Mh/s when run with '-m 1000 + hash' and no other options.
In terms of doing the analysis - profiling is part of many security audits, not necessarily pentests, and the data gathered for the analysis is often not allowed off premises. Better yet, unless you want to turn all their workstations into a processing cluster for JTR, you're probably not likely to find a good GPU in an office firm (biotech firms are a different story apparently, they've figured out that these chips are useful). The restrictions usually lead to an understanding that a 'best effort' approach will be taken which will give us the low hanging fruit and then its a matter of explaining the difference to the client, and they usually dont mind. It is nice however to walk in with a real GPU available (had a 460m so far) and be able to go through their hashes with a more thorough approach. And give results based on some serious attacks on the hash.
Proper ROEs for a pentest determine whether or not we can pull stuff like that out of their networks, but since it usually comes down to demonstrating configuration faults by way of breach, its often possible to pull them out for more serious analysis.
It doesnt look like anything recognizes the ATI card if it's not in crossfire. Even the opencl demos dont seem to. However, in crossfire, there are computational errors... i'll try to re-link the cards and run lite 0.8 again. Thanks
(12-06-2011, 05:21 PM)atom Wrote: oh and this:
Quote:ERROR: ./kernels/4098/m0000q_warp.Barts.64.kernel: No such file or directory
is mostly because of invalid use of unpacker. use 7z x file.7z
here you can see its there:
Quote:root@sf:~/xy/oclHashcat-lite-0.08/kernels/4098# ls -l m0000q_warp.Barts.64.kernel
-rw------- 1 root root 272774 Nov 25 10:10 m0000q_warp.Barts.64.kernel
