Cool. Thank you very much. And I really appreciate being here, and I really appreciate your time.
So I'm more than happy to answer any of your questions. I'm looking mostly at the Discord
channel right now. My beard is awesome, and I'm not on a boat, but I wish I was.
But just kind of... I didn't plan this out here, but you gotta respect the beard here.
So on more serious questions here, I guess, what can I do to help answer?
And so Markov, it really has very little math actually in it, too. It's just multiplication.
So if you can do multiplication, there's not even any division. So you just look at the
probability of one letter falling after another letter, falling after another letter there.
And the more letters you have, the higher probability it usually is. Omin gets a little
bit more complicated because they have this idea behind it called levels. But then you do it with
some multiplication, and you just do addition instead. So the final level, the password,
is summing all the levels across it. And the reason why you want to do that is because that's
much faster than trying to do a more traditional Markov attack like you would see in John Ripper
Markov mode. But there's a million different ways that you can do Markov. So I could talk
to you all day about that if we want to just go ahead and get into that.
Hashcat needs to update its Markov ability, though, because it is probably, of all the
algorithms, the worst. But Hashcat's really fast, so it can get away with that. And I know you're
just trying to be cheeky about that, but here's a... just trying to give you an answer to that,
because I really enjoy it. It would be nice... the challenge is that the guest generation
port could probably be extracted out, but figuring out what kind of rule to use is pretty
much single-threaded, unfortunately. And that's really what takes all the time, is just trying
to figure out which of the rules is currently the most probable in order to run. And that's why it
takes so much memory, because it's basically building a probability queue of all different
probabilities. It's going through... it has a kind of a tree type of a format there. So,
long story short, I wish I could figure out how to do that. But where you're probably better off
doing is, instead of trying to generate all the guesses in probability order, you could actually
just go ahead and generate guesses behind a different probability threshold. So, all these
guesses that are higher probability than this level here. And in that case, you could absolutely go
ahead and multi-thread it for GPU. So, I've actually talked to some people about potentially
getting this in a way so that you're not doing probability order, but you set that threshold,
and you could actually run this in the GPU. And it's the fact that GPUs have more memory now,
means you can start putting the base grammar inside GPU as well to help speed that up.
So, I'm sorry, I should ask, answer, respond to the question here. So, the question was,
could I run multiple PCFGs at once on multiple different GPUs? So, the short answer is,
theoretically, yes. But I could definitely use some help in actually coding that up
with somebody who's smarter than I am. So, does anyone else have any questions here? Or I could
just keep on rambling here, too. So, one nice thing is being able to run this against a password
list that you're currently cracking, too. Because it does do a pretty good job of stemming that and
creating some really interesting input dictionaries for you to be able to use. So, if you're kind of
going ahead and doing kind of like a fingerprint attack, just kind of run it around again there,
it can actually extract some really useful bits for that to keep on launching against people.
So, since I got like nine minutes left here, unless someone else asked a question. Oh,
ramble away. Okay, sounds good here. So, the question is, or I guess what I could start
talking about is where password crack PCFGs are kind of going in the future. So, one of my big
goals is I really would like to be able to get incorporated into Hashcat. I started, you know,
brainstorming that quite a while ago. That's part of the reason also why it uses the compiled C
version I wrote it in the first place was because Hashcat, for some reason, does not actually run
in Python because it's fast, I guess. So, that is, you know, ultimately kind of the end goal
for that effort there is to actually incorporate it into Hashcat as a new cracking mode. The
initial way I'm going to start looking at is actually having it run as a, Adam calls it a
slow guesser mode, which pretty much defines this exactly. So, I want to be able to incorporate that
as part of the Hashcat slow guessing modes that you can add in. Eventually, though, I would like
to be able to start going ahead and seeing whether I can go ahead and paralyze the way it generates
guesses and put into the GPU to make it much, much faster. So, there's other options too that
potentially you could basically do... what really slows it down is generating all those rules.
So, in an older version, I had actually had the ability to go ahead and pre-compute all those
rules and be able to save those to disks. So, you could actually then completely paralyze it if you
wanted to as well because there's no rule generation. So, that's another thing I could
take a look back at there. The problem is that the rules are really fine grained. So, I almost
want to go ahead and, in order to reduce the size of the rules on the disk, is to
make the rules much kind of fatter, essentially. So, each rule would correspond to more password
guesses. But that's definitely an option that I'm kind of looking at as well, is to make this
more feasible to be able to be used. So, is there such a thing as a random PCFG rule? Are they
human-readable or, well, geek-readable? So, the short answer is yes. So, if you hit this kind of
status output of when you're running a PCFG, a cracking session, you'll kind of print out the
text screen of what the current rule set looks like. And it looks a lot like a hashtag mask,
actually. So, it just has a few extra different features onto it there. So, you'll see something
like the... I use A for alpha string, but A5, so you know it's generating a
five-letter word. And it'll have a number next to it saying what the
probability, or ranking, I should say, of that five-letter word is. So, it'll say the
153rd most probable word, or number one. So, it'd be the first most probable word. So, that'd be
password. So, in that case, you can kind of read it, and then you can see what the capitalization mode is.
So, it'll say the most common capitalization mode for this here. And it'll say D2,
and it'll be a number after that, too. It's the third most common two-letter, or
two-digit number. So, you can kind of look at that and see what that rule is. So, because the way
that it happens there, you could absolutely go ahead and create a random rule for that.
Or you can just kind of look at it and read what it's actually doing. And so, you can go back to
the grammar and say, okay, what is actually the 143rd most probable word? And it's, okay, so that's
the word that it's using. And if the words have the same probability, they'll use just all of them
there. So, there might be multiple different words that you only saw in the train set, let's say,
twice. So, they'd all be used to the same probability in that rule. You can also create, when talking
about random passwords, some work I did in the past was creating what's called honey words. So,
these are passwords that look like human passwords. And PCFGs are really good for that. So,
instead of trying to create the most probable password, you do a random walk through the
grammar. And that way, you know, 1, 2, 3, 4, 5, 6 is still going to be very common. You're going to
create that much more often than normal. But you also create some kind of random looking passwords
too. And where this is really useful, for example, is if you're trying to set out a honeypot server,
and you want to do like a honeypot Active Directory controller, and you don't want to go
ahead and manually create a thousand different passwords for different fake users. So, that way,
you can go ahead and run that. And you create passwords that, you know, if you glance at it,
it looks somewhat real. You're still seeing like the really common passwords. You might see the
company names, you know, the most common there. But you're still seeing some random other stuff
as well. So, that's definitely some work. And improving upon that is I'd like to be able to
create one that or a modification that where it has a biased random walk. So, that way that you
can create passwords that look like they all came from the same user, but once again are, you know,
somewhat different. So, that's definitely an area that's kind of fun to play around with.
What have you seen in terms of variance between, say, company one and company two? So, that's just
a question that was asked. And a short answer is I really haven't seen that. And by that, I mean,
I'm a researcher. This is a hobby for me. So, almost every single dump that I've worked with
has been, I would say, the public dumps. And while there definitely are company passwords that,
you know, get pushed out there, especially if you look for, like, NTLM. But I'm a researcher. So,
you'd actually have to ask, you know, someone like, you know, CoreLogic about that there. So,
I'm not a really good person to answer. And that's why I'm always really interested in hearing these
talks and talking to people who are actually doing this professionally. Because they're able to
provide me that information there. But pretty much all I have from that is secondhand.
So, we're getting to the end here. It looks like there's just a couple more minutes. So,
if anyone has any questions, feel free to ask them. Otherwise, I really do appreciate you
coming in and, you know, viewing this talk. As I said, I'm available on Twitter,
at L-A-K-I-W. And if you really want to get in touch with me, the best way to do it is
submit an issue to the GitLab repo. That's probably the best way. Because I pretty much
obsessively track that there. And I'll definitely try to get back to you. But this
is something that I find is really fun. And I really do appreciate you taking an interest in
this. Cool. Yep. And I'll be on Discord for the rest of the weekend, too. So,
if anyone has any questions, feel free to pop in there, too.