- So now that we've used password cracking
with John the Ripper,
let's check out password cracking with Hashcat.
With Hashcat we're gonna use our GPU.
So you'll see how password cracking is much faster.
Hashcat is nice because it has GPU support.
It also recently became open source,
so you can look at the code.
And it supports more than 2000 hashing algorithms.
Which will take a quick look at
some of the hashing algorithms that it supports.
So if you just type Hashcat, executable, and help,
It'll show the help menu.
You can see we can crack using word lists or brute force.
We're gonna show both in this example.
You can see you can choose the attack mode.
That's where we're gonna choose
whether it's a brute force or a word list.
There's a variety of formats
that Hashcat can crack.
Really over over 200 different types of hashes.
So you can see there's Citrix, there's Cisco.
The LM and NT, right there,
are the ones we're gonna concentrate on.
So we're gonna have to use the 3000 flag for LM
and the 1000 option for NTLM.
But you can see there are a large number
of hash types that Hashcat can actually crack.
There are, in addition to the different hashes,
there are a lot of different flags that you can use
for different activities on here.
So the -M is where we're gonna actually pick the hash type.
So we're gonna use the -M 1000
or -M 3000 for LM or NT.
Attack mode, We're gonna show if it's,
we're gonna use a 3 for the brute force attack.
You can restore a session that has been stopped.
You can also use a --show
similar to John the Ripper.
So you can actually show passwords that have been cracked.
You can pick the POT file path
where it shows where all your cracked passwords are.
You can use the --username to actually show the user names
when you're cracking.
Or you can just leave them out,
so it'll just focus on the hashes.
So let's see how this works.
We're gonna look at the password list.
It's the same list we used for John the Ripper.
It has both the LM and the NT hash there.
First, the LM, then the NT hash.
Shows both of them,
which is standard within Windows.
You run the executable.
We're gonna choose our POT file,
where we're gonna store all the passwords.
We're just gonna put it in the file called
cracked_passwords.pot.
We're gonna use the -M 3000
and then -a 3 for brute force.
So we're gonna brute force the LM hashes.
If you use ?a?a
that means we wanna brute force all two-character passwords.
If we don't use the ?a's at all,
then it's just brute forcing every combination
from one-character all the way up to
as many characters as you can.
So three a's with question marks,
those are three-character passwords that you're gonna crack.
We're gonna leave those off for right now, though.
And just crack every possibility.
As you can see it's cracking
and really quickly it cracked all one-character,
two character, three-character passwords.
Now, we see we're on four-character passwords.
It's cracking.
So Hashcat is incredibly fast.
You see, now it's on five-character passwords.
It's already cracked all
one-character through four character passwords.
And it has gone through every single combination.
You could see that it's
cracking six-character passwords now.
And expects to be done with six-character passwords
in 16 seconds.
And you can see all the passwords it's cracking.
It appears on the screen once it finishes cracking those.
Remember LM hashes are only seven-characters
for each side of it.
So it estimates it'll crack all these passwords
within 11 minutes.
It's quickly going through the seven-character passwords.
You can hit a button at any time to check the status.
You can hit the S button.
Or you can pause it if you'd like, also.
So we're just gonna quit for now.
So, we get the idea.
It would've cracked all the LM passwords within 10 minutes.
So let's show the passwords.
If you use the --show flag,
you can actually show all the passwords
that is cracked so far.
And you can see, it actually shows all the hashes
with the associated passwords.
You can see that since it's an LM hash
it splits the password into two.
So you'll see some with the brackets not found
'cause it hasn't cracked that part of the password yet.
So at the very bottom
you can see the first half not found then ME2016.
So if we do the --username,
it'll put the usernames with the associated passwords.
So it is the same idea if we are going to crack
the NT passwords.
We're changing 3000 to 1000,
and now it's cracking NT passwords using brute force.
So the NT passwords are not all uppercase,
they're upper and lowercase.
So we can quickly see how it's cracking those passwords.
It cracked one through five-character passwords
really quickly.
Now it's on seven-character passwords.
And with NT hashes
they can be many more characters than this.
So, you see that right here,
it says it'll finish cracking all seven-character passwords
within four minutes.
And now let's see all the passwords using the show.
And you can see the individuals with the NT hash
and their NT password.
Let's try a dictionary attack.
We're gonna use the RockYou password file.
Pretty popular password file for cracking passwords
using a dictionary.
And you could see really quickly,
we're able to pick up a lot of the passwords that are
in the file.
It's a really large text file that we're using.
So it says it's gonna take 24 minutes
to crack all the passwords.
It's not only going through each of the passwords
that are in the file, but it's also, you could see,
using different types of mangling rules.
We're using the InsidePro-PasswordsPro rule,
which comes with Hashcat, for cracking the password.
These are LM hashes that we're cracking.
Really the same idea for NT password cracking
using this word list.
And within seconds it has cracked a lot of the NT hashes
as well.
So we can quit out of that.
Just so you can see the actual speed of this.
I mean, you know that it's going really fast.
But let's look at an English dictionary
and see how quickly it can go through this list.
So you can see within a few seconds
it went through the entire English dictionary
to see if any of the passwords were in there.
And these are NT hashes
that it quickly cracked using the English dictionary
and the pro mangling rules.
We can show the passwords that it has cracked.
You can see them all right there.
So, amazingly fast password cracker using the GPU.
And what would most likely happen in this scenario,
was you could use John the Ripper
when you're on site doing the password cracking.
But once you have a significant number
of passwords that you need to crack,
or you have some more difficult passwords
that you need to crack,
you'd probably bring them to your password cracking station.
That's using your graphics card
instead of the CPU on the machine,
or multiple graphics cards.
And you'd run the password cracking
on that password cracking machine.
That is Hashcat.