Password Cracking with Hashcat

2018 is quickly becoming known as the year of cybersecurity breaches, and many of the breaches involve some sort of information such as email addresses or passwords.  Many worry that this means that their password is already discovered by some Russian hacker, but many of these breaches have only released what is known as a hashed version of a password.  This is because for security reasons, you want passwords to never be stored in cleartext, but instead as a one way hashed format.  

To understand better how this works we can use this simplistic diagram to understand the process of password hashing.  The user will enter their username and a password.  Before the password is stored into a database it will be hashed using a hashing algorithm.  The output of this hashing algorithm will then be stored along with hashing key.  From this point forward when a user enters their password the hashing algorithm will be performed again and the hashed values will be compared with what is stored in the database.  This means the company storing the password will never know the cleartext version of the user's password.  As well, if the database were ever breached or leaked to the Internet an attacker would only have the hashed version of the password.  The hashed version of the password is not enough to take the password and use it on any other sites where the user might be re-using the same password.  

The theory behind a one way hash is a mathematical algorithm that maps data of arbitrary size to a bit string of a fixed size and is designed to never be inverted back into the cleartext form.  Unfortunately, this is not always the case.  Attackers can obtain the hashed version of passwords and try to reverse to a cleartext version using a brute-force method.  In comes the popular software known as Hashcat.  

Hashcat is the self-proclaimed world’s fastest password recovery tool. It had a proprietary code base until 2015, but is now released as free software. Versions are available for Linux, OS X, and Windows and can come in CPU-based or GPU-based variants.  To break down Hashcat into a more understandable concept more or less Hashcat will take what is known as a wordlist or a character string and will then hash the word or string.  Once the attempted string has been computed into a hashed version it can compare the hash to the unknown hash.  If there is a match Hashcat can determine it has successfully found the cleartext version of a one way hash.  Utilizing heavy CPU-based or GPU-based computation Hashcat can attempt a very quick rate of hashing methods allowing attackers or security professionals to crack one way hashes in a rapid rate.  

Now that we have a basic understanding of how the brute forcing method of Hashcat works we can look more closely at how Hashcat accomplishes this task.  Of course I mentioned earlier taking a wordlist or a character string in, but there are ways to increase efficiency allowing Hashcat to perform a more targeted attack.  Obviously the reason one would want to increase efficiency is due to the time constraints that are introduced with increasing password lengths and complexity.  For Hashcat to run through a very large wordlist, such as in the 10's of Gigabytes, it can take hours depending on the hashing algorithm.  On the other hand for Hashcat to perform a brute force attack of all characters and numbers it can take potentially days, weeks, or even years.  Thus, the need for efficiency or a more targeted approach is preferred.  This leads to the different attack methods that are provided by Hashcat.   The mode known as straight, or more commonly known as a dictionary attack, is simply just running straight through the provided wordlist or character string.  The second mode is known as combination mode which will concatenate words from multiple wordlists.  For example if you have a one list with the word "red" and the second list has the word "fox" the result would be "redfox". The third type of attack is known as the Brute-force attack, which has recently been renamed as the mask attack.  This attack type will try all characters from a given character set, per position.  Meaning if you used the mask attack against a password that is known to be only 8 characters in length, and only consisting of alphabetic characters the output would look much like the excerpt shown below.

aaaaaaaa
aaaabaaa
aaaacaaa
.
.
aaaaxzzz
aaaayzzz
aaaazzzz
baaaaaaa
baaabaaa
baaacaaa
.
.
baaaxzzz
baaayzzz
baaazzzz
.
.
zzzzzzzz

Finally there are two other attack modes listed on the Hashcat wiki page.  The hybrid wordlist + Mask and the hybrid mask + wordlist.  These two attack mode are simply the aforementioned attack methods, but merging multiple attack methods together.  

Additionally, not classified as a attack mode, but is provided is what is known as a rule-based attack.  The rule-based attack is one of the most complicated of all the attack modes. The reason for this is very simple. The rule-based attack is like a programming language designed for password candidate generation. It has functions to modify, cut or extend words and has conditional operators to skip some, etc. That makes it the most flexible, accurate and efficient attack.  An example of a rule based attack would be if you had a wordlist with the first word of "fox" and the rule states to add all combinations of numbers to the end the output would be fox1, fox2, fox3, etc.  The power of the rule-based attack mode comes from the fact you can modify wordlists during runtime, which means saving disk space.  Instead of pre-calculating the wordlists with additional line items that might modify the word we can perform this modification directly on the GPU's memory.  Hashcat when downloaded does come with a variety of different included rule sets, but can be expanded or modified per cracking scenario.  

In reality the success of your cracking efficiency will come down to either the ability of your wordlist or the mask creation.  Therefore, you will need to continue building wordlist collection.  Here are some of my favorite wordlists.  

Many developers have tried to increase the automation in password cracking.  To help reduce the amount of commands that are required or to increase the consistency between multiple cracking sessions.  A great example is the Hatecrack tool that was released by Trustedsec.  Additionally, for my processes and my workflow for clients I took a stab at creating my own version written in PowerShell. I have posted the script on Github for all to use as freely as they want.  

There are many different subsections of password cracking that I would like to dive into, but I am currently up against some time constraints. This blog post will continue to be modified as time is available.