Brute force

From Grayhat cheatsheets
Jump to navigationJump to search

Online brute force attacks[edit | edit source]

  • Medusa is a ool for online password brute force attacks on different protocols, as the following examples show. The option -t can be used for multiple threads, and the option -T to attack several hosts simultaneously.

Brute force the user root with the passwords in rockyou.txt for an SSH login in the specified IP, using 50 threads: medusa -h 10.11.1.251 -u root -P /usr/share/wordlists/rockyou.txt -M ssh -t 50

It is important to not use too many threads (50 may be too many), if the connection is not very fast, or depending on the server configuration, we may be sending requests faster than they can be handled, and some will be requed for later attempts. We may be actually slowing down the overall process of finding the correct password.

  • Ncrack is another tool for online password attacks. It belongs to Nmap, and is interesting for rdp on windows machines (port 3389):

ncrack -v -f --user administrator -P password_file.txt rdp://192.168.2.233,CL=1

  • Hydra is probably the most used program for online password cracking, although not much really is added to medusa. We can use it to brute force HTML login forms, by including some element we know appears on the webpage after a failed login attempt. It will be used as a reference, and when it is not there, hydra will know the combination of user and password worked.

hydra 192.168.1.100 http-form-post "/webmail/src/login.php:login_username=^USER^&secretkey=^PASS^:Bad login" -L /var/www/html/users.txt -P /usr/share/wordlists/rockyou.txt -t 50 -w 30

Here username and password is where the input user and password will be tested (indicated to hydra by ^USER^ and ^PASS^, and "Bad login" is what we know appears on failed login attempts, so hydra will consider the login successful when that doesn't show up. Here both users and passwords are taken from text files.


One problem is that Burp free edition has a limit in the speed of brute force, and only sends one request for second, making it useless in real scenarios. On the other hand, ZAP's Fuzz feature works much faster, with up to 50 threads at maximum speed. One limitation is that we can only fuzz one field at a time. In the request you capture with ZAP, select any part of the text, right-click and click on Fuzz. There, choose the input from a file, and select the dictionary. Not all work with all encodings. Then select in options, the number of threads, and launch the Fuzzer. Look at the HTTP codes, lengths of the response, or other fields, the accepted login may manifest in different ways. Order by different categories (size, code, etc), and look if any of the attempts has produced a very different result from the rest, it may be the good one. Be careful with accepting redirects.


Offline brute force attacks[edit | edit source]

  • Hash-identifier: tool to paste a hash, and it has a high chance of detecting the hash type, to allow us to more easily crack it by a dictionary attack, for example with hashcat. If the hash type cannot be found (with hash-identifier, or also some websites for password cracking, like crackstation.net), it may be that the hash has been generated with some custom algorithm. In that case, it can be useful to look in the source code of the webapp (in case it is open source, and we can find it on github, etc).


  • Hashcat is an offline cracking tool. It is a good alternative to John the Ripper, since it can use GPU for faster calculations (even though it seems like some recent versions of John also can). The command line arguments to pass to hashcat are, first, the file where results will be stored (this is optional), then the file containing the hashes we want to crack, and finally, the dictionary to be used.

hashcat [options]... hash|hashfile|hccapxfile [dictionary|mask|directory]...

For example, from the folder containing the downloaded files: ./hashcat64.bin -m 0 -a 0 -o ~/Desktop/found.txt --remove ~/Escritorio/root_hash s ./hashcat64.bin -m 7400 -o found.txt ex1400.hash ~/usr/share/wordlists/rockyou.txt

-m represents the hash type. In https://hashcat.net/wiki/doku.php?id=example_hashes we can find the admitted hashes. In the file containing the input hashes we want to crack, we can either copy and paste the contents of /etc/shadow, or enter only the hashes, one per line, hashcat will figure out what it needs to do. Some very old hash types may be only available in the legacy version of hashcat (happens in Vulnhub's Game of Thrones). In this case we execute the binary hashcat-cli64.bin, and this version cannot use GPU.


  • mcrypt, a program to encrypt and decrypt. Can be used in Vulnhub's Game of Thrones.
  • gpp-decrypt is another program to decrypt passwords.
  • Kali linux has a set of dictionaries in /usr/share/wordlists. It may be useful to get some more, like the top 10000 passwords, top 100000 passwords, etc.

 

  • If we know the passwords generated by a certain application follow some pattern, we can use the tool "crunch" to generate passwords following that pattern, with the chosen characters. For example, all the combinations of the first 6 letters and all numbers from 0 to 9, with lengths of 5 and 6 characters are generated and stored in out.txt like this:

  crunch 5 6 0123456789ABCDEF -o out.txt  The 5 and the 6 are the minimum and maximum lengths that the passwords will have, and the long string is the symbols admitted in the passwords.   Also a predefined charset can be chosen:   crunch 4 4 -f  /usr/share/crunch/charset.lst mixalpha    If we know beforehand the pattern used to create a password, we can indicate it with special symbols:   @ ­‐ Lower case alpha characters , ­‐ Upper case alpha characters % -­ Numeric characters ^ ­‐ Special characters including space   Then, we can make all passwords to follow a pattern:   crunch 8 8 -t @@,%^%^%   This has the risk of generating huge files that are not very practical to handle.  

  • In windows, hashes are stored in the Security Account Manager (SAM). Windows NT up to 2003 stored 2 hashes, LM and NTLM. LM hashes are weak, because passwords longer than 7 characters are separated in two parts, of up to 7 characters, each of which is hashed separately. Also, before hashing every part, the plaintexts are converted to uppercase, and there is no salt, which facilitates the use of rainbow table attacks. Can be cracked with crackstation.net, or mode -m 3000 in hashcat. The output of hashcat then needs another cracking with mode -m 1000.

Since Windows Vista, NTLM is used by default. This doesn't separate in parts of 7 characters, and uses all unicode characters, and is case sensitive, but still doesn't use salt. While the OS is running, the SAM file cannot be copied, the kernel locks it, but with memory attacks the file can be mounted. Meterpreter has options for this, like hashdump.