Ethical Password Cracking E-Book

James Leyte-Vidal

• Herausgeber: Packt Publishing
• Kategorie: Fachliteratur
• Sprache: Englisch

Seitenzahl: 204

Veröffentlichungsjahr: 2024

Beschreibung

Whether you’re looking to crack passwords as part of a thorough security audit or aiming to recover vital information, this book will equip you with the skills to accomplish your goals. Written by a cybersecurity expert with over fifteen years of experience in penetration testing, Ethical Password Cracking offers a thorough understanding of password protection and the correct approach to retrieving password-protected data.
As you progress through the chapters, you first familiarize yourself with how credentials are stored, delving briefly into the math behind password cracking. Then, the book will take you through various tools and techniques to help you recover desired passwords before focusing on common cracking use cases, hash recovery, and cracking. Real-life examples will prompt you to explore brute-force versus dictionary-based approaches and teach you how to apply them to various types of credential storage.
By the end of this book, you'll understand how passwords are protected and how to crack the most common credential types with ease.

Leseprobe

Ethical Password Cracking

Decode passwords using John the Ripper, hashcat, and advanced methods for password breaking

James Leyte-Vidal

Ethical Password Cracking

Copyright © 2024 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing or its dealers and distributors, will be held liable for any damages caused or alleged to have been caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

Group Product Manager: Pavan Ramchandani

Publishing Product Manager: Prachi Sawant

Book Project Manager: Ashwin Kharwa

Senior Editor: Isha Singh, Sayali Pingale

Technical Editor: Nithik Cheruvakodan

Copy Editor: Safis Editing

Indexer: Subalakshmi Govindhan

Production Designer: Prafulla Nikalje

DevRel Marketing Coordinator: Marylou De Mello

First published: July 2024

Production reference: 1120624

Published by Packt Publishing Ltd.

Grosvenor House

11 St Paul’s Square

Birmingham

B3 1RB, UK

ISBN 978-1-80461-126-5

www.packtpub.com

To my incredibly patient family, as we weathered personal and professional challenges to deliver this book (and a real hurricane as well!). Rachel, Abigail, Brandon, Catherine, and Ethan – I love you all. This work is as much yours as it is mine.

And also, to the incredibly patient team at Packt Publishing, thank you for sticking with me through all this.

Contributors

About the author

James Leyte-Vidal is a 20-plus-year veteran of the computer security industry. After a self-taught career in IT, James worked on a computer security incident that changed his career trajectory to security.

James consults independently and has worked for Fortune 100 companies in various roles, including security architecture, penetration testing, compliance, policy, and much more.

James is also an instructor at the SANS Institute, a global provider of information security training, and a co-author of three SANS courses: SEC467: Social Engineering for Security Professionals, SEC556: IoT Penetration Testing, and SEC617: Wireless Penetration Testing and Ethical Hacking.

When not actively doing security work, James can often be found tinkering with hardware or spending time with his family.

About the reviewers

Matt Edmondson is a principal SANS instructor and author of the SEC497 Practical OSINT course. He has over 21 years of experience as a federal agent and is the founder of Argelius Labs, where he has experience in helping numerous organizations large and small understand their external attack surface and monitor for emerging threats. He is a multiple-time speaker at Black Hat and has featured in multiple publications, including Wired and the official Raspberry Pi magazine.

Rich Robertson has held several leadership and individual contributor roles throughout his 20+ years in IT and cybersecurity. His career covers a variety of industry verticals, including finance, entertainment, retail, and technology. Rich’s passions include mobile devices, hardware hacking, data mining, and uncovering logic flaws. He has worked to secure the technology that powers everything from warehouses to cruise ships to dolphin tanks. Rich received a BSc in business administration and an MBA from Webber International University, and recently his MSc in FinTech at the University of Central Florida. He also holds multiple industry certifications, such as CISSP, ITPM, and SANS GCIH and GPEN.

I would like to thank James for the opportunity to review his book. Thank you also to my beautiful wife, Stacey, for the love, support, and patience throughout the craziness, and my son, Tyler, for helping me pull this off. To my parents, thank you for your faith in me and letting me build my first computer, which jumpstarted my whole career in tech. I would also like to thank the rest of my family, friends, colleagues, and more (JM & LM, LJ, and Mika H) who have pushed me to become who I am today.

Table of Contents

Preface

Part 1: Introduction and Setup

1

Password Storage: Math, Probability, and Complexity

What is password cracking?

Dictionary-based attacks

Combination attacks

Brute-force attacks

Hybrid attacks

Partial knowledge, also known as mask attacks

How are passwords stored and used?

Hashing

Encryption

Why are some passwords easier to crack than others?

Password length

Password complexity

Time to hash/encrypt the password

A word on “ethical” password cracking

Summary

2

Why Crack When OSINT Will Do?

How does OSINT help with password cracking?

Leveraging OSINT to access compromised passwords

Using OSINT to obtain password candidates

Summary

3

Setting Up Your Password Cracking Environment

Technical requirements

Installing and introducing John

Core functions of John

Installing hashcat

Core functions of hashcat

Summary

4

John and Hashcat Rules

Analyzing password complexity rules

Selecting and using John rules

Selecting and using hashcat rules

Summary

Part 2: Collection and Cracking

5

Windows and macOS Password Cracking

Collecting Windows password hashes

Kerberos

Cracking Windows hashes

Collecting macOS password hashes

Formatting/converting hashes into their expected formats

Cracking hashes

Summary

6

Linux Password Cracking

Collecting Linux password hashes

Formatting/converting hashes into their expected formats

Cracking hashes

Summary

7

WPA/WPA2 Wireless Password Cracking

A note about WEP

WPA/WPA2 architecture

Obtaining WPA/WPA2 information to crack

Methods for cracking WPA/WPA2 passphrases

8

WordPress, Drupal, and Webmin Password Cracking

Collecting and formatting WordPress hashes

Cracking WordPress hashes

Collecting and formatting Drupal hashes

Cracking Drupal hashes

Collecting and formatting Webmin hashes

Cracking Webmin hashes

Summary

9

Password Vault Cracking

Collecting KeePass password hashes

Cracking KeePass password hashes

Collecting LastPass password hashes

Cracking LastPass hashes

Collecting 1Password password hashes

Cracking 1Password password hashes

Summary

10

Cryptocurrency Wallet Passphrase Cracking

Cryptocurrencies and blockchain explained

Collecting and formatting Bitcoin/Litecoin wallet hashes

Cracking Bitcoin/Litecoin wallet hashes

Collecting and formatting Ethereum wallet hashes

Cracking Ethereum wallet hashes

Summary

Part 3: Conclusion

11

Protections against Password Cracking Attacks

How to choose a password more resistant to cracking attacks

Additional protections against cracking attacks

Summary

Index

Other Books You May Enjoy

Preface

In this book, we will introduce you to the concepts behind password cracking, as well as make you familiar with the common tools used for this work. After that, we will examine common technologies where these tools may be needed, and show you how to retrieve and crack hashes for those particular technologies. While not exhaustive, these examples of applications of the tools will prepare you to deal with other types of password hashes you may work with later on.

Who this book is for

This book is designed for those with an interest in password cracking, but you do not necessarily need any experience.

What this book covers

Chapter 1, Password Storage: Math, Probability, and Complexity, provides an introduction to the concepts behind password cracking.

Chapter 2, Why Crack When OSINT Will Do?, provides a treatment on Open Source Intelligence (OSINT) as an alternative to password cracking in some cases.

Chapter 3, Setting Up Your Password Cracking Environment, provides an introduction to the tools needed for password cracking.

Chapter 4, John and Hashcat Rules, provides an introduction to permutation rules in John and hashcat and how they work.

Chapter 5, Windows and macOS Password Cracking, covers obtaining, formatting, and cracking Windows and macOS password hashes.

Chapter 6, Linux Password Cracking, covers obtaining, formatting, and cracking Linux password hashes.

Chapter 7, WPA/WPA2 Wireless Password Cracking, covers obtaining, formatting, and cracking hashes for WPA and WPA2 Wi-Fi networks.

Chapter 8, WordPress, Drupal, and Webmin Password Cracking, covers obtaining, formatting, and cracking hashes for the WordPress, Drupal, and Webmin platforms.

Chapter 9, Password Vault Cracking, covers obtaining, formatting, and cracking KeePass, LastPass, and 1Password vault passwords.

Chapter 10, Cryptocurrency Wallet Passphrase Cracking, covers obtaining, formatting, and cracking Bitcoin, Litecoin, and Ethereum wallet passwords.

Chapter 11, Protections against Password Cracking Attacks, discusses potential defenses against password cracking.

To get the most out of this book

You will need a working knowledge of Windows and Linux command-line syntax and common non-OS tools, such as Git.

Software/hardware covered in the book

Operating system requirements

hashcat

Windows, macOS, or Linux

John the Ripper

Windows, macOS, or Linux

Disclaimer

The information within this book is intended to be used only in an ethical manner. Do not use any information from the book if you do not have written permission from the owner of the equipment. If you perform illegal actions, you are likely to be arrested and prosecuted to the full extent of the law. Packt Publishing does not take any responsibility if you misuse any of the information contained within the book. The information herein must only be used while testing environments with proper written authorizations from the appropriate persons responsible.

Conventions used

There are a number of text conventions used throughout this book.

Code in text: Indicates code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles. Here is an example: “Once we have access to wallet.dat, we can use this file to extract the passphrase hash for cracking.”

Any command-line input or output is written as follows:

python3 /opt/john/run/bitcoin2john.py wallet.dat

Bold: Indicates a new term, an important word, or words that you see onscreen. For instance, words in menus or dialog boxes appear in bold. Here is an example: “Drilling into the LastPassData table by selecting Browse Table, we see several rows of interest to us.”

Tips or important notes

Appear like this.

Get in touch

Feedback from our readers is always welcome.

General feedback: If you have questions about any aspect of this book, email us at [email protected] and mention the book title in the subject of your message.

Errata: Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you have found a mistake in this book, we would be grateful if you would report this to us. Please visit www.packtpub.com/support/errata and fill in the form.

Piracy: If you come across any illegal copies of our works in any form on the internet, we would be grateful if you would provide us with the location address or website name. Please contact us at [email protected] with a link to the material.

If you are interested in becoming an author: If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, please visit authors.packtpub.com.

Share Your Thoughts

Once you’ve read Ethical Password Cracking, we’d love to hear your thoughts! Please click here to go straight to the Amazon review page for this book and share your feedback.

Your review is important to us and the tech community and will help us make sure we’re delivering excellent quality content.

Download a free PDF copy of this book

Thanks for purchasing this book!

Do you like to read on the go but are unable to carry your print books everywhere?

Is your e-book purchase not compatible with the device of your choice?

Don’t worry!, Now with every Packt book, you get a DRM-free PDF version of that book at no cost.

Read anywhere, any place, on any device. Search, copy, and paste code from your favorite technical books directly into your application.

The perks don’t stop there, you can get exclusive access to discounts, newsletters, and great free content in your inbox daily

Follow these simple steps to get the benefits:

Scan the QR code or visit the following link:

https://packt.link/free-ebook/9781804611265

Submit your proof of purchase.That’s it! We’ll send your free PDF and other benefits to your email directly.

Part 1: Introduction and Setup

In this part, we will introduce you to the concepts behind password cracking, alternative means to achieve our goals such as OSINT, and how to set up and configure your cracking environment.

This part has the following chapters:

Chapter 1, Password Storage: Math, Probability, and ComplexityChapter 2, Why Crack When OSINT Will Do?Chapter 3, Setting Up Your Password Cracking EnvironmentChapter 4, John and Hashcat Rules

1

Password Storage: Math, Probability, and Complexity

Password cracking has become a storied element of information security testing, from the days of utilities such as Cain and Abel to more modern tools such as hashcat. While the tools and techniques have changed over the years, the principles behind password cracking remain largely unchanged.

Password cracking can involve many use cases, from recovering access to a system after the user has left a company to penetration testing and red team use cases, where we use password cracking to prove (or disprove) the security of our access control mechanisms.

In this chapter, we’re going to cover the following main topics:

What is password cracking?How are passwords stored and used?Why are some passwords easier to crack than others?

What is password cracking?

Password cracking is the process of recovering a secret from scrambled (typically encrypted or hashed) text. This very broad term encompasses many types of password storage and scrambling. As such, not all password-cracking operations are created equal – some passwords, as well as methods of password storage, are easier to crack than others. We will discuss this more throughout this book.

Password cracking can be broken down into various approaches to attempt to recover the secret:

Dictionary-basedCombinationBrute forceHybridPartial knowledge, also known as mask attacks

Let’s discuss each of these in turn.

Dictionary-based attacks

Dictionary-based attacks, as you might have guessed based on the name, use a list of words or phrases as password candidates – the potential password we will test to see if it is the correct password. This list is informally referred to as a dictionary, even though it may or may not contain dictionary words. The wordlist may not resemble a dictionary much at all. This term is mostly a holdover to earlier times when many passwords were based on dictionary words, before password complexity requirements (such as adding uppercase letters, numbers, and symbols to a password) were common.

Speaking of complexity requirements, it seems like traditional dictionary words would not be as effective as password candidates during a password-cracking operation due to complexity requirements becoming more commonplace. We’ll address that in the upcoming sections.

Constructing a wordlist for a dictionary attack can be simple or a time-consuming effort. However, in many cases, spending time upfront for a good wordlist tailored to your target may reap dividends at cracking time. The tradeoff here is that your wordlist may not be as reusable for other password-cracking situations. We’ll discuss using open source intelligence (OSINT) to help build a wordlist in Chapter 2, Why Crack When OSINT Will Do?

A good and fairly large wordlist to start with is often the RockYou wordlist. This is named after the breach of the RockYou company in 2009, where over 32 million user credentials were exposed. While available in several places on the internet, a common location to download the RockYou wordlist is https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt. This list contains over 14 million unique password candidates and is also included in many common penetration testing distributions, such as Kali Linux (available at https://www.kali.org/get-kali/#kali-platforms) and Slingshot Linux (available at https://www.sans.org/tools/slingshot/).

Combination attacks

Combination attacks take two wordlists as input and concatenate (append together) one password candidate from each list to create the password candidate for testing purposes. For example, one wordlist might contain the words word1 and word2, while the second wordlist might contain the words word3and word4.

In this scenario, a combination attack would use a word from both lists to create potential password candidates, such as word1word3, word1word4, word2word3, and word2word4.

Current guidance from the National Institute of Standards and Technology (NIST) recommends password length over complexity for the best resistance to password cracking. This helps encourage our users to create a password that is easy to remember but hard to crack and reflects the current guidance from NIST. This can be performed by stringing several dictionary words together and adding a mnemonic to help the user remember the password. This is only one approach, but this example points out – in conjunction with the current NIST guidance – that combination approaches to password cracking may be more effective as more users follow the guidance to shift to passphrases.

That being said, some standards may slow the adoption of longer, less complex passphrases. For example, the Payment Card Industry Data Security Standard (PCI-DSS) standard, which is required for merchants processing credit card data, requires 12-character passwords, as well as letters and numbers for passwords associated with accounts that have access to cardholder data.

Brute-force attacks

Brute-force attacks do exactly what their name suggests – every position in the password candidate is filled with every possible candidate for that position. For example, if a password can only be eight characters long, a brute-force approach might attempt aaaaaaaa as the password candidate, then attempt aaaaaaab, and so on, until the possibilities for the password are all attempted – exhausted. The problem with this approach is that once a password reaches any reasonable length, the time to perform this style of attack becomes untenable. Additionally, the number of character sets available to use for the password (lowercase, uppercase, numbers, and symbols) will also greatly increase the number of guesses to complete this kind of attack.

The good news for password cracking is that it is possible to crack any password with this approach. However, the amount of time it would take with today’s computing power makes it essentially folly for larger passwords or more complex (more time-consuming for each password guess) algorithms.

Hybrid attacks

Hybrid attacks merge some of the characteristics of combination attacks and brute-force attacks. A hybrid attack uses a wordlist as its base, then modifies the words in the wordlist by adding one or more characters to the word and brute-forcing the character space associated with that. As an example, let’s say I have the following word from my wordlist:

banana

However, I know the password policies of my target require a number in every password. I might try a hybrid attack that takes my word from my wordlist and adds a number after the word. So, now, my password candidates are as follows:

banana1 banana2 banana3 banana4

This allows us to test environments more effectively where users often append (add to the end) or prepend (add to the beginning) some base dictionary word for their password.

Partial knowledge, also known as mask attacks

Mask attacks leverage the idea that we partially understand the format used to construct a password to create a brute-force-like approach that is sped up due to assumptions we make about the password format.

An example will be helpful here. Let’s say that we are testing passwords for a company that requires one uppercase character, one lowercase character, and a number for their passwords. This is a common password complexity requirement in many companies, and many users will meet this requirement by taking a word (dictionary or otherwise), capitalizing the first letter of the word, and appending one or two numbers to the word.

Incidentally, this type of password requirement, along with 90-day password rotation intervals, can lead to the dreaded season-year password, where users will set their password to the name of the current season (Spring, Summer, and so on) and append a two or four-digit year to the password (Spring22/Spring2022, Summer22/Summer2022, and so on).

These complexity requirements may lead us to construct a mask for the password that assumes the user will choose a password that starts with a capital letter, then has five or six characters of lowercase letters, and ends with two or two digits from base10 numbering (0-9). This mask will attempt to brute-force any passwords meeting these lengths and criteria. While this will not retrieve every password in a given list, this approach historically yields high percentages of cracked passwords since this approach is a common one for users to take when constructing passwords.

Important note

We will suggest better methods for password construction and mitigations in Chapter 11.

How are passwords stored and used?

While it may seem simple, how a password is stored on a system can have a huge effect on its ability to be recovered via password-cracking operations and how long this can take.

You don’t always need to crack!

Most passwords are stored in authentication systems via some process that renders the password difficult to recover. However, it is not unheard of to come across systems that do not protect user credentials appropriately. You may recall that earlier in this chapter, we discussed the RockYou breach. In the case of RockYou, the company stored user passwords in plaintext (no hashing or encryption), which made recovering user passwords trivial. This meant that once user passwords were made publicly available, they were completely exposed – no password cracking or other complex operations were required; they were simply there for the taking.

Let’s talk about the two types of responsible password storage that we typically see: hashingand encryption.

Hashing

The idea behind password hashing is to store the user’s password so that it cannot be retrieved by anyone. There are several advantages to this approach:

For the company that stores the password, this represents a strong level of due diligence and may provide some protections legallyPasswords cannot be reverted to plaintext (the original password) from hash values, which means malicious insiders with access to the password storage cannot retrieve the passwordThe existence of standard functions to perform this hashing in many application frameworks means it is easy to implement

At its core, hashing takes a string of plaintext (the password) and converts it into a fixed-length string of unreadable data. This value cannot be reverted to plaintext, which is one of the core differences between hashing and encryption. Also, this hashing process will always return the same value for the same input; this is known as being deterministic. Some types of hashing can also add a salt, which adds additional entropy (randomness) to the generation of the hash value. This salt will be different for every password, which can negate the effectiveness of precomputation attacks – a type of attack that generates all possible hashes in advance of a cracking operation (you may have heard of rainbow tables, which are one type of precomputation attack). Hashing algorithms vary in terms of the number of rounds (hash operations) used to create the hash to be stored, the output length, and several other factors. We will discuss various hashing algorithms later when we dive into different types of password retrieval.

In the case of hashing, passwords are validated during the authentication process by taking the password from the user, hashing it, and comparing it against the stored hash. If they match, the password is correct; if they do not, the password that was entered was incorrect. Once again, hashing further protects the plaintext password during this process by ensuring the plaintext password is never handled by the system after hashing.

Encryption

Encryption differs from hashing in that the ciphertext (the product of the encryption algorithm) can be reversed back to the original plaintext (the password). To do this, one or more encryption keys must be generated and used for encrypt and decrypt operations.

Encryption has some liabilities for use as password storage. The most prominent one is that the ciphertext is reversible, which means that a malicious insider or an external party can retrieve the plaintext passwords if they can obtain the ciphertext and the encryption key(s). Additionally, because it is used in encrypt and decrypt operations, the key(s) must be retrievable, which further increases the potential for mishandling and/or disclosure of the keys.

Easy check for encryption as password hashing (or worse)

Have you ever forgotten a password and used a Forgot Password link or workflow in an application? Odds are, you probably have. If you have ever used the Forgot Password functionality and had your password sent to you via email or some other cleartext method (rather than being prompted to set a new password), this means that your password is stored on that system in an encrypted format. If password hashing was in use, they would not be able to retrieve your plaintext password.Well, there’s one other possibility – the system is storing your password in cleartext, similar to what RockYou did. We have seen how that is a very bad idea, but unfortunately, it is