One challenge in GPGPU is generating enough work to keep the GPU busy. In a Brute-force attack, the keyspace can easily become huge. A Rule-based attack needs large numbers of rules applied to large dictionaries. Efficient rules must be written by hand. This requires comparing many plaintext passwords to identify patterns and express them as rules, which can take considerable work.
The aim was to automate rule generation for two reasons. The first was to generate enough rules to keep GPUs busy. The second was to automate pattern detection itself. After some failed attempts, I realized that finding a small set of efficient rules, as in a CPU-based attack, conflicted with the need to generate many rules for a GPU. The result would look more like a Hybrid attack than a rule-based attack. This led me to abandon the rule engine.
With the power of GPGPU it's more important to create lots of mutations. So why not create all possible mutations? That's easier than it sounds. It can be achieved by disassembling a plaintext password into all its possible mutations. That's done with the expander, which is part of the hashcat-utils. To make use of all of these patterns we need to combine them with something. That can be either with themselves or with a dictionary. We call this Combinator attack.
The fingerprint attack combines the output of the expander with a combination engine. It automatically generates an attack based on patterns and works well on GPGPU.
Thanks to pure_hate for making a video about the fingerprint attack: question-defense.com/2010/11/24/oclhashcat-fingerprint-attack-video (gone)
This second article shows how to use the fingerprint attack with oclHashcat. I wrote a small Perl script to automate some of the steps described in the first article.
This includes:
It then adds some randomly predefined rules and mixes the results of the fingerprint attack with other attack modes, such as combinator and hybrid attacks. I have tested this script successfully on both Linux and Windows.
This article shows only the Linux commands. To reproduce the steps on Windows, you need additional tools and must rewrite the commands. It is 100% possible, and I have tested it myself.
This time I use the Defcon 2010 CMIYC hashlist and a hashlist generated from the leaked myspace plains. You can use whichever hashlist you like.
There are two ways to generate the initial pattern dictionary:
The milworm dictionary is an appropriate source. If you are new to the fingerprint attack, I recommend this dictionary because it is very small (less than 100k entries) and contains many useful patterns.
$ mv mil-dic.txt cracked.dict
That completes initialization. The cracked.out file must exist because the autocrack script waits for it. The command works on all dictionaries.
$ perl -MDigest::MD5 -ne 'chomp; printf "%s:%s\n", Digest::MD5::md5_hex ($_), $_' < cracked.dict > cracked.out
If you are not going to attack an arbitrary hashlist you can skip this step. The following command uses the leaked myspace plains and generates a hashlist out of all the words in this dictionary.
$ perl -MDigest::MD5 -ne 'chomp; printf "%s\n", Digest::MD5::md5_hex ($_)' < myspace.txt > myspace.txt.md5
If you are not going to attack the defcon hashlist, you can skip the next command. But you then have to replace the NTLM.txt with your hashlist's filename.
First, extract all NTLM hashes from the defcon hashlist:
$ cut -d: -f4 < defcon_contest_hashes.txt | sort -u > NTLM.txt
Now generate the initial dictionary. In the previous article I used a Brute-Force attack to do this. To prove that this is not required, I will use the batchcracker this time. batchcracker.sh is a script included in the oclHashcat packages. It runs some common attacks on a given hashlist. This includes Mask attack, Combinator attack, Hybrid attack and Brute-Force attack. It is designed to run quickly, so it uses only lightweight versions of these attacks.
The next attack took less than 10 minutes on my GTX285. Do not forget to change the hash_mode variable to 1000 in batchcracker.sh:
NOTE: batchcrack.sh in oclHashcat v0.26 is broken. The page that described the patch, patch_batchcrack_v026, was never written.
$ ./batchcrack.sh NTLM.txt
Let's see what I have so far:
$ wc -l batchcrack.out 4673 batchcrack.out
and what's left:
$ wc -l NTLM.txt 25967 NTLM.txt
We still need to prepare the cracked.out and cracked.dict files for the autocracker. The next command removes the hashes from the outfile so that only the plains remain.
$ mv batchcrack.out cracked.out $ cut -b34- < cracked.out > cracked.dict
Before you can use autocrack.pl you have to change all the paths to your dictionaries in the script. You can also just add or remove some of the dictionaries. Again, I strongly recommend that you have a large number of both small and big dictionaries. You may also want to change the hash_file and hash_mode variables in accordance with your hashlist in the script-header.
The following attack runs for as long as you want.
$ perl autocrack.pl
I let it run for exactly 13 hours without interaction.
$ wc -l cracked.out 16120 cracked.out
and what's left:
$ wc -l NTLM.txt 14520 NTLM.txt
Here are some excellent examples of cracked passwords:
&~defcon '#(4)\ August19681 '&a123456 10-D'Ann ~|Bailey Krist0f3r f@cebOOK Nuclear$( zxcvbn2010! 13Hark's NjB3qqm Sydney93? antalya%] Annl05de ;-Fluffy
I can compare the results with the results from the Korelogic contest.
Here are some statistics:
The first article about the fingerprint attack was posted on Question Defense's blog some time ago.
See here: question-defense.com/2010/08/15/automated-password-cracking-use-oclhashcat-to-launch-a-fingerprint-attack (gone)