start	end	text
3800	6840	Let's see, how do we do the screen share on this?
42300	43340	Ah, here we go.
51160	54180	Okay, there we go. That's looking a lot better.
54500	57020	All right, so welcome to Advanced HashCat Training.
57660	61540	A quick note about who I am. I am staff here at the DEF CON Password Village.
61560	64160	I am a member of the HashCat Dev Team and Team HashCat.
64300	66640	I am the founder and CEO of Terrahash.
66640	69780	And I'm also a password hashing competition judge.
69780	72380	My name is Jeremy Gosney. I go by the Nick episode.
74900	79260	All right, so number one, let's talk about entropy.
80020	82980	In the password-cracking world, we don't really talk about entropy.
82980	85560	We don't express password strength in terms of entropy.
86240	89480	You know, in academic settings or when we're talking about, like,
89480	94160	symmetric key encryption and such, you know, you'll hear, you know,
94160	99860	this key has X bits of entropy or, you know, that password has 32 bits of entropy.
99860	101860	We don't give a fuck about that as password crackers.
101860	106040	As password crackers, what we care about is keyspace.
106400	109240	Keyspace is the total number of combinations for an attack.
109240	112340	It is essentially a measure of the level of effort for our attack.
113780	116920	To calculate the keyspace for a dictionary attack,
116920	119080	it's simply the number of words in a word list.
119620	124040	For a dictionary and rule-based attack, it is the number of words in the word list
124040	126760	multiplied by the number of rules in the word file.
127680	131460	For a combinator attack, you multiply the keyspace of each dictionary,
131460	133960	so the number of words in the first dictionary
133960	136780	multiplied by the number of words in the second dictionary.
137720	142080	And for a mask attack, you multiply the number of possible characters
142080	143680	in each mask position together.
143680	147780	And we'll get into exactly what that looks like and what that means.
151320	155200	Oh, and for hybrid, of course, it's the keyspace of the word list,
155200	158940	the number of words in the word list multiplied by the keyspace of the mask.
160340	162220	So, keyspace examples.
162760	166480	rocku.txt has 14.3 million words.
166940	170860	best64.rule has 102 rules in the rule file,
170860	174760	which is kind of a misnomer. It's not really best64. It's more like best102.
175040	177740	So we multiply 14.3 million by 102 rules,
177740	181260	gives us a keyspace of 463 billion.
181340	184380	That is the total number of combinations that you need to hash
186620	190730	when you combine rocku.txt with best64.rule.
191840	197300	Let's say we were to do a combinator attack of rocku.txt plus rocku.txt.
197480	202760	That would be 14.34 million words times 14.34 million words
202760	208630	equals 205 quadrillion possible combinations for that keyspace.
209710	215030	So our second attack, the combinator attack, requires 140,000 times more effort
215030	216410	than the first attack.
217570	219750	Now let's look at how we calculate keyspace for masks.
219750	226050	I said that mask was the total of each character in each position, right?
226050	228630	So we have 26 lower letters in all six positions.
228630	232090	Our keyspace is 26 to the power of 6.
232370	236930	That gives us a keyspace of 8 billion.
237710	239850	Now let's look at this mask.
239850	242830	We have special digit lower uppercase digit.
243510	247890	So there's 33 possible special characters multiplied by 10 digits
247890	249910	multiplied by 10 possible lowercase characters
249910	252250	multiplied by 26 possible uppercase characters
252710	261770	multiplied by 10 digits gives us a keyspace of 2.2 billion.
264600	267710	All right, so let's look at using custom character sets.
269490	274870	So in our custom character set, we have the lowercase and a digit.
274870	277810	So 26 plus 10 is 36 custom characters.
277810	283490	And then we have 5 lowercase letters.
283490	285290	So 26 to the 5th.
285290	287630	And then 2 digits is 10 to the 2.
287630	292510	Gives us a total keyspace of 11.8 trillion.
292890	294930	Sorry, billion. 11.8 billion.
296310	298330	Same thing if you have two custom character sets.
298330	301510	Our first custom character set, we have a lower and a digit.
301850	304630	Our second custom character, we have a digit and a special.
305190	307190	So the math, of course, is very similar.
307650	309990	So we have 36 in our custom character set 1
310470	313950	multiplied by 26 to the 5th for our lower digits in our mask
315150	317050	multiplied by 10 possible digits
318330	323150	and then 43 in our second custom character set
324470	327910	for a total of 183 billion possible combinations.
329790	331370	So let's kind of shelve that real quick
331370	333510	and let's kind of pivot and talk about hash rate.
333510	335610	Hash rate is a measure of distance over time
335610	339170	and is expressed as a number of hash calculations per second.
340250	343270	The hash rate depends on several variables, of course, like the hardware.
343270	345370	Are we using CPU? Are we using GPU?
345370	348530	Are we using an older GPU? Are we using a newer GPU?
348990	353770	The hash algorithm itself plays a big part in the hash rate.
354050	356870	Some hashes are stupid fast like MD4 and MD5.
356870	360070	Others are brutally slow like Bcrypt and Scrypt.
360750	364250	The attack mode also plays a big part in our hash rate.
365190	369050	Brute force is going to be faster than a wordless attack, for example.
369970	373210	The way the attack is structured, we will get into GPU acceleration
373470	375250	a little bit later in the slide deck,
375250	377850	but basically the way you structure your attack
378410	381550	can negatively or positively impact performance.
382830	385990	And, of course, the key space for the attack also plays a part in hash rate.
385990	389030	If the key space is too small for GPU acceleration,
389030	391110	you will not have a very high hash rate.
391970	393550	And also the number of hashes.
393550	397930	This has more to do with the amount of RAM or video RAM that you have.
397930	402450	If you have an inordinately large number of hashes,
402450	406050	it will affect the hash rate.
407170	411550	So the best case scenario for HashCat is single hash brute force.
412350	417450	With single hash brute force, you will get the absolute highest speed for each algorithm.
418790	421250	Once you get into multi-hash brute force,
421250	423350	the speed is going to drop by about 25%.
425250	428010	Once you start doing single hash dictionary and rules,
428010	431650	it's going to be about 50% slower than single hash brute force.
433270	436770	Multi-hash dictionary and rules is going to be about 75% of the speed
436770	438730	of a single hash brute force attack.
438830	443630	So you can see how the attack itself actually plays a large part in the hash rate.
444590	449090	Now I mentioned that some hash algorithms are faster than others.
450290	453330	Fast hash algorithms like MD4, MD5, SHA1, SHA2,
453330	458610	and even DEScrypt now with BitSlice DES on GPU,
458610	461810	I would definitely consider to be a fast hash these days.
462470	468590	Medium fast hashes would be things like MD5Crypt, Kerberos, and macOS hashes.
469490	471750	And then, of course, we have the very slow hash algorithms.
471750	477930	A lot of these have custom iteration counts, cost variables.
477930	480550	So these can actually be made to be somewhat fast,
480550	484390	but most of the time these are going to use settings that are going to be very painfully slow.
486750	488350	And here's an example of that.
488350	493630	This is a chart that just very quickly will visualize which algorithms we consider to be fast.
494470	496610	And then kind of a medium fast here.
497330	500450	And then, of course, the really painfully slow ones down here at the bottom.
504380	509020	All right, so let's look at how hash rate and keyspace interact with each other
509020	512280	because this is really important for when you start structuring advanced attacks.
513360	518460	Mainly because we want to know, if we go to run an attack, is this a worthwhile attack to run or is it not?
518460	522020	And, of course, Hashcat will tell you, like, yeah, you know, this is going to take a decade to run.
522240	526700	But as a password cracker, you should kind of have a sense for what that's going to look like
526700	529240	in advance of actually starting your attack.
530420	531960	So let's look at the following example.
531960	536180	We have a single hash NTLM brute force here.
536980	542140	Sorry, the command here doesn't actually say single hash, but let's pretend that there is a single hash there.
542780	551580	So four RTX 2080 TIs can pull about 380 billion hashes per second on single hash NTLM brute force.
551680	556280	And, of course, our mask here has a keyspace of 95 to the 8th.
560210	566290	So the math, 95 to the power of 8 divided by our 380 giga hash a second
566290	575410	means that this attack will take us about 17,458 seconds or about 4.77 hours.
575410	579090	So this attack will complete in under five hours, which is likely acceptable to you.
579190	581870	Now let's add a character to our mask.
582490	588950	Keyspace increases to 95 to the 9th at the same speed of 380 giga hash a second.
588950	598170	This attack will now take us 1.6 million seconds to complete, which is a little over 19 days.
600930	601890	Sorry.
602970	607990	So at this point, you understand how to calculate keyspace, you understand fast versus slow hash algorithms,
607990	611130	and you understand the relationship between the keyspace and the hash rate.
611170	613730	But how do we actually leverage this to our advantage?
615970	619110	To do that, let's talk about base and mod.
624790	625670	GPU acceleration...
626830	627930	Excellent, I skipped a slide there.
628790	635310	So to achieve GPU acceleration, we have two concepts in HashScout called the base loop and the mod loop.
635390	640950	The base loop gets executed on the host CPU and the mod loop gets executed on the GPU devices.
644370	650190	If the mod loop is too small or if it's completely non-existent, you will not gain GPU acceleration on fast hash algorithms.
650190	658830	This means that while your GPUs may be capable of doing the 380 billion hashes per second like you saw in the previous examples,
658830	662910	they will not do so if the mod loop is too small.
662910	668050	You will get no GPU acceleration, your hash rate will be abysmal down in the single digit kilohash a second.
669370	674850	And we absolutely want GPU acceleration. That's kind of the entire point of GPU password cracking.
676790	684230	So if you do a straight dictionary attack on GPU with no rules, then you have a base loop which is the dictionary,
684230	688910	but you have no modifier whatsoever. You will not get GPU acceleration with this attack.
688910	693010	It will be abysmally slow. It will actually be faster on CPU than on GPU.
693770	699630	The second example here, where we're using the same dictionary, but now we're adding a modifier, rules.
701210	708010	The words will be looped over from Rocky.txt on the CPU, but then the rules will be applied in the onGPU rule engine
708690	713330	on each of the GPU devices, and that's where our GPU acceleration comes from.
714010	720630	So the more rules you have, the more GPU acceleration you're going to gain to a point.
721490	728570	I believe the tipping point there is somewhere around... well, last I looked, it was probably 50,000 rules.
728570	731710	It may be a little bit higher now with larger VRAM values.
734010	741570	But 30,000 to 50,000 rules is kind of the sweet spot for achieving maximum GPU acceleration with a rule-based attack.
743530	749590	For a combinator attack, the base loop is going to be the inner dictionary, while the mod loop is going to be the outer dictionary.
749590	757650	And then for mask attacks, it's kind of interesting, because the mask itself doesn't have any kind of obvious split like a combinator or rule-based attack does.
757910	763670	So what Hashcat actually does internally is it's going to split the mask into two parts.
763670	767770	So the first half is going to be the base loop, while the second half of the mask is going to be the mod loop.
771300	777080	And then for hybrid attacks, again, it's pretty straightforward because it's actually logically separated in the command itself.
777080	780820	The base loop is the dictionary, and the mask is the mod for A6.
780820	784540	Then for A7, it's the reverse. The mask is the mod, and the dictionary is the base.
785960	788280	So let's look at this in an applied example.
788420	795360	So we have the same single hash NTLM brute force command that we had from the previous slides.
796980	800420	Hash rate is still, let's say, 380 gigahash a second.
800420	803400	Our keyspace is still 95 to the 9th.
804480	813000	So per our previous math, this will take 1.6 million seconds to complete, which again is a little bit over 19 days.
813000	818280	But let's say we don't want that to take 19 days. Let's say we want this attack to complete in 8 hours.
820140	823800	So 8 hours is about 29,000 seconds.
824240	829900	So what we're going to do is we say our hash rate is 380 billion hashes per second.
829900	833720	And we want to let it run for a little over 29,000 seconds.
833720	840600	So we simply multiply that to find out the number of hash calculations that we can make with our 4 2080 TIs in that amount of seconds.
840600	850740	And that gives us 11.1 quadrillion guesses in 8 hours with this attack.
851180	853980	So now we sit here and we flip it around.
853980	865380	We want to find out what we need our base loop to look like to hit that 8 hour target.
865380	873600	So right now with the mask of question mark A, the base is 95 for each character set.
873600	880980	But if we take this 11.1 quadrillion and we raise it to the 1 over 9th power, we get 60.
880980	890420	And what we can do with that is HashCat, for anywhere you're using a mask, actually uses Markov tables to do a probabilistic brute force.
890500	896980	Instead of a classic dumb brute force where you're going A, A, A, A, A, etc. all the way through Z, Z, Z, Z.
897500	908540	HashCat generates some Markov statistics and will order the search space for each character position probabilistically based on those Markov tables.
909660	915380	So we can take our HashCat command and we can append this dash T 60.
915400	919080	And what that does is that sets our Markov table threshold to 60.
919080	931540	And what that simultaneously does is that lowers our base loop from using the 95s to using 60 instead.
931540	939540	So instead of 95 to the 9th, the key space is now only 60 to the 9th, using only the top 60 characters in each mask position.
943310	949270	All right. Let's kind of shift gears here and talk about loopback attacks.
949290	954350	So by and large, password cracking is mostly just a feedback loop.
955230	962450	You know, we crack passwords so that we can learn new passwords, which we then turn around and use to crack future passwords.
962450	966570	And this cycle happens over and over for decades.
967650	971410	And it holds true for every large password breach we've ever had, right?
971410	976870	So starting with probably the most famous in recent history, which would be Roku.
977070	982110	Roku.txt, while dated, is still kind of like the de facto example when we're talking about a word list.
982110	985170	Even in this slide deck, I've used Roku.txt extensively.
986770	988790	So, you know, we have the Roku passwords.
988790	996590	That allowed us to identify new passwords by adding rules and, you know, basically mangling up those words to crack new passwords.
996590	1000530	And then once we got those new passwords, we add those to our word list collection, right?
1000730	1003030	And then we're going to turn around and add rules to those.
1003030	1007870	And we're going to continuously find new passwords based on the previous passwords that we've cracked.
1010510	1015970	So in a loopback attack, which, again, you can do a loopback attack on a single run, right?
1015970	1018770	For whatever run you're working on at that point in time.
1019010	1024910	Or, you know, when you use previously cracked passwords, you're essentially still doing a loopback attack
1024910	1029050	because you're taking the passwords found in your previous runs, even if those runs were a decade ago,
1029050	1032790	and you're iterating on those to discover new passwords in your current run.
1034050	1038810	So to do that, we'll just strip the plaintext passwords out of our hashcat.py file.
1040190	1043870	And then we'll use that as a word list with some rules.
1043870	1047530	Throw some best64 at it, throw some dead1 at it, you know, what have you.
1047970	1052930	Now, we can take that a little bit further with what's called a fingerprint attack.
1054010	1056750	Instead of using the plaintext passwords themselves,
1056750	1063630	we can break each plaintext password down into what are known as fingerprints.
1064030	1066890	A fingerprint would just be like, let's say, the word password.
1066890	1076230	So it's going to split that up into P, P-A, P-A-S, P-A-S-S, P-S-S, P-A-S-S-W, so on and so forth.
1076830	1082610	Basically expanding each word into each, you know, individual cluster of letters of itself.
1083530	1089370	So to do that, we take our cracked passwords, whether it be looped back from your current hashcat.pot
1089370	1097010	or cracked passwords from a previous run, you know, maybe like the RockyLeague or, you know, LinkedIn breach
1097010	1101850	or Ashley Madison, Edmodo, Gizmodo, whatever.
1102070	1106570	Literally dozens and dozens, if not thousands and thousands of public password breaches out there
1106570	1110030	that have all sorts of, you know, plaintext or easy-to-crack passwords.
1110030	1114770	And we use those to generate the fingerprints using expander.bin from hashcatutils.
1115030	1122350	Once we have the fingerprints, we can either run that as a combinator attack or we can use that in a hybrid attack.
1123910	1126910	You can do, you know, any numerous things with them.
1128490	1131170	And you can also add rules to nearly any attack as well.
1131170	1138530	So let's say you're using your fingerprints, right, and you're doing your combinator attack.
1138530	1141550	Let's say you're using RockYou with your fingerprint file.
1141830	1143650	Let's throw some rules on that.
1143830	1151150	So the "-J rule is going to operate on the left-hand side there, the base loop.
1151350	1157010	And in this example, we're deleting the last two characters from every word from the word list.
1157290	1163850	And then we are appending our fingerprints from our loopback attacks to every word in that word list.
1165250	1167330	This is kind of a favorite attack I like to run.
1167330	1172130	I like to do "-J", right bracket, and then "-J", two right brackets,
1172130	1175450	then "-J", three right brackets, so on and so forth.
1177270	1181030	And that's going to enable you to find some pretty interesting new planes
1181030	1184010	as we continue to cut characters off the end of the left dictionary
1184010	1188570	and then continue to append our fingerprints to the right.
1190950	1192830	Same thing with this example here.
1192830	1198070	So like I said, "-J operates on the left-hand side, while "-K operates on the right-hand side.
1198330	1201130	And of course, the C rule means to capitalize the word.
1201130	1205430	So let's say we want to capitalize the rules from RockYou
1205430	1209230	and then capitalize the words from our fingerprints.
1209330	1213470	We can append "-JC", "-KC", to our command line,
1213470	1221150	and that will enable us to capitalize each of the words on each side before combining them.
1223230	1228430	And you can do the same thing with hybrid attacks as well.
1228610	1231770	So let's say we have our fingerprints file, and we want to append double digits
1231770	1233570	to every word in our fingerprints.
1235030	1239010	We can add a "-JC", say we want to remove the last character
1239010	1242950	from each word in our fingerprints, and then capitalize that word
1242950	1246090	before appending the double digits.
1248170	1250590	All right, now let's talk about stemming.
1250590	1253930	It sounds sexual, but it isn't.
1253930	1258230	Stemming is essentially identifying base words from each password.
1259130	1263710	And this is going to be very useful for when you're doing your loopback attacks,
1263710	1267970	whether, again, that's the looping back over passwords you just cracked in a previous run,
1267970	1272630	or you're talking about looping back over passwords you've cracked
1272630	1275850	from anything over the years.
1276530	1279530	And essentially what we're doing in identifying these base words
1279530	1284930	is we're unrolling the rules that people apply when they create passwords.
1284990	1288470	So, you know, most people, when they're told to make a password stronger,
1288470	1290010	they will uppercase the first letter.
1290170	1294530	They'll substitute, like, an A for a four, or an E for a three, etc.,
1295730	1297890	and probably put a couple of digits on the end.
1298090	1300670	So when we stem, the first thing we're going to do
1300670	1303270	is we're going to remove any leading and trailing digits and specials.
1303930	1307110	We're going to convert it all to lowercase to normalize it.
1307110	1311410	And any midstream digits and specials, we're going to convert those back to letters.
1311890	1313150	And, of course, there's a lot more you can do here.
1313150	1315050	This is kind of a very basic example of stemming,
1315050	1317970	and there's also multiple tools out there that can do this for you.
1318470	1322810	Like, I have some small scripts on the Hashcat forums that can do this.
1322810	1325030	I think Pack can do this as well.
1326150	1328450	And probably a dozen other tools that people have made on GitHub
1328450	1330230	that can do wordless stemming.
1331750	1333790	But once you have those stemmed words,
1333790	1336670	you have a nice set of base words that you can use
1336670	1340450	to either do fingerprint attack or hybrid attack,
1340450	1344030	or you can use those with, like, rulegen.py from Pack
1344030	1347070	to generate new Hashcat rules off of.
1349630	1351430	So stemming, of course, is very powerful
1351430	1355230	based on the things we can do with it once we have the common base words.
1357070	1361390	All right, here's some more advanced things you can do with Hashcat.
1361390	1364270	temesis.pl, again, from Hashcat Utils.
1364650	1367630	What this is going to do is it's going to basically take fingerprints
1368210	1372450	from each word, and it's going to create rules
1372450	1375690	that will insert that word and fragments of that word
1377550	1379770	throughout the word list that you pick.
1381230	1384410	So let's say we pick rockyu, and we've created our temesis rule
1384410	1386450	from our base words.
1386710	1388690	It's going to go through and take every word from rockyu
1388690	1392630	and insert patterns based on our base words.
1393030	1396330	It's going to interlace those throughout the words in rockyu.
1397050	1400910	And, of course, you can chain rules as well.
1401170	1404670	So when you chain rules, the rules are applied in order.
1404670	1407090	So we're starting with rockyu.txt,
1407090	1411630	and then every word from rockyu is going to be...
1411630	1414650	have the rules from our temesis.rule file applied to it.
1414710	1418410	And then, after we apply temesis rule,
1418410	1422070	it's going to then apply the best64 rules on top of that.
1422390	1424610	So the key space for this can actually get really large really quick
1424610	1427750	because it's going to be the number of words in rockyu
1427750	1429470	times the number of rules in temesis
1430090	1432330	times the number of rules in best64.
1432570	1434370	So when you're performing this attack,
1434370	1437810	it can get really large really quick.
1437890	1440190	But it can also be really powerful.
1442890	1446930	Rule chain like best64 and best64 is usually a good one.
1446930	1452170	Sometimes, depending on your hash rate, you can chain dead1.rule
1452170	1455690	or rockyu30000.rule with best64.
1456870	1459870	But yeah, you can come up with some pretty cool attacks
1459870	1461690	using rule chaining in this fashion.
1462950	1466270	And sometimes it's a necessity if you have, like,
1468690	1470610	a really targeted pattern that you want to hit
1470610	1473150	that you can't just hit with a single rule file.
1473330	1475550	You can create multiple rule files and chain them
1475550	1477810	to try to generate the type of plain text you're after.
1479770	1481650	And then, of course, there's PrinceProcessor,
1481650	1483810	which is also available on hashcat.github.
1484770	1488650	PrinceProcessor is sort of a more advanced combinator attack.
1489790	1493790	It's kind of difficult to describe, but just think of it
1493790	1495490	like a more advanced combinator attack,
1495490	1497730	which you can pipe into hashcat through standardin.
1500190	1503410	And that's it for advanced stuff.
1503410	1506170	There's a lot more fun things that we can do,
1507630	1511270	and we can cover that in a future session.
1511310	1515390	But yeah, that's some of the really cool advanced stuff
1515390	1516410	that you can do with hashcat.