1 00:00:40,530 --> 00:00:43,490 All right, let's see what we can do here. 2 00:00:43,490 --> 00:00:50,530 So we're gonna crack RokU without using RokU. 3 00:00:50,530 --> 00:01:06,450 So all I did was took the RokU dictionary, piped it through MD5, so we have a big-ass list of MD5 hashes now, and let's see what we can do. 4 00:02:27,520 --> 00:02:33,940 Looks like we lost a few hashes in the conversion, but I think we'll be all right. 5 00:02:43,320 --> 00:02:47,360 All right, so most basic, let's do a hashcat 6 00:02:54,890 --> 00:02:56,490 RokU.hash. 7 00:02:57,450 --> 00:03:05,150 We'll do tach E3 and let's just do five character. 8 00:03:07,110 --> 00:03:19,430 So this will do all character classes for five positions, but we're going to start doing one, and then we'll do two, and then we'll do three, then we'll do four, then we'll do five. 9 00:03:19,430 --> 00:03:22,830 So that's what this increment flag does. 10 00:03:22,830 --> 00:03:25,990 So that is one, two, three, four, five. 11 00:04:18,120 --> 00:04:20,540 I think we're doing okay. 12 00:04:44,690 --> 00:04:48,330 All right, almost 300,000 in 27 seconds. 13 00:04:49,010 --> 00:04:50,070 Why not? 14 00:05:03,120 --> 00:05:04,480 So let's try... 15 00:05:07,080 --> 00:05:11,260 We need to grab... We don't have anything. 16 00:05:11,900 --> 00:05:19,340 We can't do a wiki strip, that would take too long. 17 00:05:23,580 --> 00:05:27,700 Let's see if we can find a dictionary. 18 00:05:28,680 --> 00:05:30,500 Something small. 19 00:05:33,760 --> 00:05:43,220 Let's try, like, all words of 10 letters, and we want that in a text file. 20 00:06:14,010 --> 00:06:16,050 Can't I just have a dictionary? 21 00:06:32,580 --> 00:06:35,860 We have... 22 00:06:53,070 --> 00:06:54,430 Oh yeah, good point. 23 00:06:54,430 --> 00:06:56,650 We could use ASPEL, that's true. 24 00:06:58,410 --> 00:07:05,210 Let's grab wiki strip because we can use it regardless. 25 00:07:19,260 --> 00:07:23,060 And then, do we have ASPEL? 26 00:07:46,530 --> 00:07:50,110 Where do ASPEL's dicts go? 27 00:08:24,940 --> 00:08:26,640 There we go. 28 00:08:27,000 --> 00:08:34,280 So I'm guessing we could probably use the ENUS. 29 00:08:34,280 --> 00:08:35,840 Let's do that one. 30 00:09:12,360 --> 00:09:14,520 Yeah, maybe that's not a good one. 31 00:09:36,970 --> 00:09:38,810 Maybe without accents? 32 00:09:40,270 --> 00:09:43,970 I don't think that one's even gonna... That one's gonna matter. 33 00:09:46,190 --> 00:09:48,110 Let's instead... Let's go grab... 34 00:10:03,470 --> 00:10:04,950 There we go. 35 00:10:07,610 --> 00:10:09,290 Let's grab this one. 36 00:10:20,090 --> 00:10:24,390 Some random list of words off of GitHub, this ought to be interesting. 37 00:10:28,260 --> 00:10:38,260 So we're gonna do rocku.hash, and then feed it words.txt, and let's see what we get. 38 00:10:39,040 --> 00:10:41,300 Actually, let's look at what these even look like. 39 00:10:46,800 --> 00:10:49,300 Yeah, this'll work. 40 00:11:20,690 --> 00:11:24,890 Okay, actually, it wasn't terrible, so that's good. 41 00:11:24,970 --> 00:11:26,090 Let's try doing... 42 00:11:27,910 --> 00:11:31,830 Let's do an A6 and see what we get. 43 00:11:31,830 --> 00:11:32,730 And we'll just add... 44 00:11:34,110 --> 00:11:36,050 Let's just add two digits. 45 00:11:36,210 --> 00:11:40,490 No, let's just add... Yeah, let's do two digits, and then let's also increment. 46 00:11:41,230 --> 00:11:43,750 So we exhaust both of those. 47 00:11:44,730 --> 00:11:46,370 Oops, that's gonna fail. 48 00:11:46,370 --> 00:11:46,750 But 49 00:12:39,670 --> 00:12:44,810 yeah, I mean, I guess that works. 50 00:12:48,370 --> 00:12:50,330 We got 2% just off of that. 51 00:12:50,330 --> 00:12:51,530 All right, all right. 52 00:12:54,320 --> 00:13:01,340 What if we do... If we already incremented two spaces, let's not run that again. 53 00:13:01,340 --> 00:13:01,680 Let's do... 54 00:13:05,240 --> 00:13:07,520 Well, let's just do like... What year did this come out? 55 00:13:07,640 --> 00:13:08,460 2009, right? 56 00:13:08,460 --> 00:13:10,020 So let's do 2008. 57 00:13:32,930 --> 00:13:37,290 Oh, we're gonna have to trim this hash file too, because these load times are a bit ridiculous. 58 00:13:54,200 --> 00:13:58,020 All right, so not a whole lot of 2008 passwords. 59 00:13:58,540 --> 00:14:01,920 Let's... We're gonna add remove. 60 00:14:04,000 --> 00:14:06,080 And we're also gonna do an out file. 61 00:14:06,080 --> 00:14:08,280 We don't need to do an out file, because we can do a pop file. 62 00:14:08,280 --> 00:14:09,800 So what this is gonna do is... 63 00:14:09,800 --> 00:14:13,540 So we're gonna take all these words that are in words.txt. 64 00:14:13,640 --> 00:14:15,600 We're gonna add 2009 to it. 65 00:14:15,600 --> 00:14:22,040 Actually, let's just do... Let's do 2000 digit, digit. 66 00:14:22,040 --> 00:14:26,660 So that should cover everything from 0, 0 to 99. 67 00:14:26,660 --> 00:14:30,760 And then we're gonna remove everything that we cracked, because it's gonna go in our pop file anyway. 68 00:14:30,800 --> 00:14:35,880 And then after that, we'll roll our pop file back and we'll try some rule-based attacks. 69 00:14:53,650 --> 00:14:57,710 So we've only got 13,700,000 more hashes to crack. 70 00:15:25,710 --> 00:15:26,950 Not a lot. 71 00:15:27,910 --> 00:15:36,410 Let's do a cut-d, attack-f2-on from hashcat.popfile. 72 00:15:36,410 --> 00:15:43,070 And we're gonna put that to pop.dict. 73 00:15:46,040 --> 00:15:54,720 And then let's roll... Instead of doing an A6, let's just do generated rules. 74 00:15:57,680 --> 00:16:01,120 And let's do like... Let's do like 5,000 of them. 75 00:16:11,180 --> 00:16:15,720 We'll move that removed so we don't have to keep doing it every time we want to change a command line or a run line. 76 00:16:47,980 --> 00:16:49,660 Probably should have suppressed output. 77 00:16:49,660 --> 00:16:53,920 This is... Get hit status, but we're not gonna see anything. 78 00:17:16,620 --> 00:17:18,300 We're up over a million now. 79 00:18:04,440 --> 00:18:04,800 So that... 80 00:18:04,800 --> 00:18:08,420 That got us almost 11%. 81 00:18:08,420 --> 00:18:10,180 No, 8... 9%. 82 00:18:10,180 --> 00:18:10,920 Almost 9%. 83 00:18:10,920 --> 00:18:11,980 It's pretty good. 84 00:18:13,620 --> 00:18:18,060 And the great thing is, is that if we do that again, we're gonna get a bunch more. 85 00:18:18,120 --> 00:18:26,960 But this time we're gonna write this... We'll start writing this out to a file so we don't slow down at all. 86 00:18:28,400 --> 00:18:32,360 w... We'll call this rocku.out. 87 00:18:40,930 --> 00:18:42,850 It's not w, it's tacho. 88 00:18:57,640 --> 00:18:59,940 This load time's a little bit ridiculous. 89 00:19:00,380 --> 00:19:01,620 I think we'll manage. 90 00:19:02,340 --> 00:19:04,280 Let's just see what our GPU is doing as well. 91 00:19:04,280 --> 00:19:12,660 So down here we'll do like a watchtech n5 nvidia smi. 92 00:19:30,970 --> 00:19:35,790 So even for md5, because there's so many hashes, we're still only going at what's that? 93 00:19:36,250 --> 00:19:43,350 118... 118 million candidates per second, which is a little bit sad, but you know. 94 00:19:47,150 --> 00:19:52,970 So we got 278,000 on that one, or 288,000. 95 00:19:53,170 --> 00:19:56,470 So if we do it again, we'll get even more. 96 00:19:56,590 --> 00:19:58,670 So you just sit here and you loop this attack. 97 00:20:15,240 --> 00:20:18,880 I think after this one we'll just do maybe just an uppercase. 98 00:20:18,880 --> 00:20:19,180 I don't know. 99 00:20:19,180 --> 00:20:19,580 If you have... 100 00:20:19,580 --> 00:20:24,820 If you have an idea, tell me what you want to try in the chat, and we'll give it a shot and see how many you get. 101 00:20:57,040 --> 00:20:58,480 All right, so let's try... 102 00:21:01,520 --> 00:21:04,360 Let's try just uppercasing everything. 103 00:21:41,550 --> 00:21:42,830 Wow, we got nothing. 104 00:21:43,130 --> 00:21:46,730 Probably because we already had an uppercase in our generated rules. 105 00:21:48,430 --> 00:21:50,010 What else can we do? 106 00:21:54,360 --> 00:21:57,460 We could try doing some truncates. 107 00:21:58,180 --> 00:21:59,320 Let's actually do this. 108 00:21:59,340 --> 00:22:01,900 No, no, we'll just do the truncate first. 109 00:22:02,960 --> 00:22:11,080 So we'll just take one character off the right side of the plain text and see what happens. 110 00:22:12,600 --> 00:22:15,340 Normally this is really good if you have a word list that already has 111 00:22:19,640 --> 00:22:21,200 years on the end of it. 112 00:22:21,440 --> 00:22:36,020 So if you've already cracked hashes and somebody's using password 2019 and then they use password 2020, you trim one to two positions off and then you fill that with digits and get back to it. 113 00:22:36,160 --> 00:22:39,040 All right, so let's roll our cracks, because I forgot to do this. 114 00:22:39,040 --> 00:22:43,760 We'll roll our cracks back into our word list. 115 00:23:10,640 --> 00:23:11,940 I already forgot what I called it. 116 00:23:11,940 --> 00:23:12,700 Pot.dict. 117 00:23:17,740 --> 00:23:22,860 And then because we started writing an out file, we're going to do the same thing for the out file. 118 00:23:22,860 --> 00:23:25,780 Well, actually we don't need to do that. 119 00:23:34,160 --> 00:23:35,800 Yeah, we don't need to do that. 120 00:24:19,240 --> 00:24:30,420 All right, so we're going to take from the left side, or sorry, from the right side, using tack k, we're going to truncate the first two positions of the word that's in pot.dict. 121 00:24:30,640 --> 00:24:37,440 And then we're going to try and run everything for two positions and see what we get. 122 00:25:21,700 --> 00:25:24,000 Yep, that'll do it. 123 00:26:43,310 --> 00:26:46,110 It was actually getting a lot more than I expected it would. 124 00:27:05,200 --> 00:27:12,660 All right, so we're, what, 10.48% in. 125 00:27:12,660 --> 00:27:14,880 We've only got a lot more to go. 126 00:27:18,850 --> 00:27:35,790 All right, so if we truncated two, and it did really well, let's truncate three, but instead of adding something, just keep it with the same two positions and see if maybe we can catch some stuff that doesn't have that. 127 00:27:35,790 --> 00:27:43,890 This is a little brute force-y without actually doing a mask attack, but I mean, it still kind of makes sense. 128 00:27:43,890 --> 00:28:00,710 If somebody prepended, for instance, numbers to a password, if they start with their birth year or something at the beginning, we can strip those off and then start replacing the first digit or the first character that comes after that. 129 00:28:23,570 --> 00:28:24,750 Yeah, see that? 130 00:28:25,210 --> 00:28:26,950 We're still getting stuff. 131 00:28:49,050 --> 00:28:54,430 So one thing I keep seeing in here is there are a lot of passwords that are just digits. 132 00:28:54,690 --> 00:29:06,430 So this would be, to me, tells me that I need to go and brute force all of these, what is that, six, seven characters of digits. 133 00:29:06,470 --> 00:29:12,870 So after this one finishes, we'll see if we can do that, because seven digits will be pretty quick. 134 00:29:26,890 --> 00:29:31,950 I mean, technically, we could probably even go out to 12, but I don't know. 135 00:29:32,130 --> 00:29:33,970 We'll see what the runtime looks like. 136 00:30:02,120 --> 00:30:11,640 All right, so we're going to strip all this stuff off, and then we're just going to say A3, and we only want digits for, we'll say up to eight. 137 00:30:14,730 --> 00:30:18,290 And because there were ones that were less than eight, we're going to increment this as well. 138 00:30:20,690 --> 00:30:25,290 So we'll try one digit, then two digits, then three digits, then four digits. 139 00:31:14,050 --> 00:31:19,970 All right, so that was pretty quick, and that got us, what, almost seven percent. 140 00:31:19,970 --> 00:31:24,950 All right , so let's get rid of this increment, and let's do one more. 141 00:31:27,170 --> 00:31:29,170 Actually, who cares? 142 00:31:29,170 --> 00:31:32,130 Let's just go until it's going to take too long. 143 00:31:35,960 --> 00:31:43,560 So we're going to waste a little bit of time going over the things we already went over, but it was fast enough that it shouldn't really matter too much. 144 00:31:48,930 --> 00:31:55,530 I'm really going to keep getting faster as we keep cracking hashes, because it's less workload to do comparisons against. 145 00:32:05,660 --> 00:32:17,800 So what we should also see down here is our GPU memory is going to spike once the attack gets going, because we've got all that stuff loaded into the video card's memory. 146 00:32:47,440 --> 00:32:51,340 This is kind of a good example of why Rocky was bad in some ways. 147 00:32:51,340 --> 00:33:07,400 Like, it's good, but you could trim all of this crap out, because it's going to be rare that you're ever going to see a password that looks like this in a dump today or during a pen test or something. 148 00:33:07,400 --> 00:33:12,780 Like, if companies had passwords that look like this, their building's probably on fire. 149 00:34:59,360 --> 00:35:01,220 Oh, 24% almost? 150 00:35:01,220 --> 00:35:02,220 I'll take it. 151 00:35:16,060 --> 00:35:19,360 But this also means 24% of this dictionary is crap. 152 00:36:20,230 --> 00:36:21,190 Right? 153 00:36:21,530 --> 00:36:24,610 So we're at... let's see what percent we're at so far. 154 00:36:34,640 --> 00:36:37,000 So we're at almost 24%... 155 00:36:40,690 --> 00:36:42,470 Sorry, almost 25%. 156 00:36:49,310 --> 00:36:51,690 Well, that's what? 157 00:36:52,370 --> 00:36:54,590 14 divided by 4 is math? 158 00:37:01,230 --> 00:37:06,010 So what these probably are are spammer passwords, though, or automated accounts. 159 00:37:06,010 --> 00:37:14,310 So in a lot of ways, you know, like Twitter, for instance, or something... Reddit would be a good one. 160 00:37:14,310 --> 00:37:28,650 When you're doing automated account stuff, you don't really care about the security of the account if all you're going to do is sit there and upvote each other or, you know, do retweets or, you know, maybe it's a Twitch bot or something like that. 161 00:37:29,550 --> 00:37:37,410 So these are likely... I don't know much about the site other than the dictionary. 162 00:38:08,150 --> 00:38:18,190 I mean, it could be telephone numbers, but a five-digit telephone number, like we did have a lot of fives. 163 00:38:18,930 --> 00:38:20,390 Six, even. 164 00:38:31,500 --> 00:38:33,040 Yep, that's true. 165 00:38:34,800 --> 00:38:42,030 Asian countries where sometimes a sentence can be said in a string of numbers, sure. 166 00:39:01,060 --> 00:39:04,840 I kind of want it to stop cracking so we can do something else. 167 00:39:06,720 --> 00:39:07,780 But you know what? 168 00:39:07,780 --> 00:39:08,800 I'm gonna take them. 169 00:39:51,860 --> 00:39:55,660 What if... let's do... let's make a word list. 170 00:40:01,730 --> 00:40:03,570 We'll just use cool again. 171 00:40:03,750 --> 00:40:04,750 That's easy. 172 00:40:15,750 --> 00:40:16,870 Don't tell DT. 173 00:40:16,870 --> 00:40:18,670 I'm gonna scrape Defcon.org. 174 00:40:55,070 --> 00:40:55,770 So what are we doing? 175 00:40:55,770 --> 00:40:57,790 This is only... so this is only 12. 176 00:40:57,790 --> 00:40:59,150 Oh, this is gonna take 30 minutes. 177 00:40:59,150 --> 00:41:00,510 I don't want to wait 30 minutes. 178 00:41:12,690 --> 00:41:17,470 We're only doing the default, so it's only gonna go too deep. 179 00:41:17,690 --> 00:41:20,350 It won't spider too recursively. 180 00:41:38,720 --> 00:41:39,700 All right, screw that. 181 00:41:39,700 --> 00:41:40,540 I'm tired of waiting. 182 00:41:40,540 --> 00:41:41,660 31 minutes to finish. 183 00:41:41,660 --> 00:41:43,040 I don't want to sit around for 31 minutes. 184 00:41:43,040 --> 00:41:45,560 Okay, but we're at 25%, so that's pretty good. 185 00:41:46,540 --> 00:41:47,820 What else can we do? 186 00:41:49,660 --> 00:41:53,400 What if... oh, let's do the Pathwell masks. 187 00:42:04,140 --> 00:42:13,240 And if you're not familiar with what the Pathwell masks are, we will discuss those tomorrow. 188 00:42:19,520 --> 00:42:27,260 So this is the top 100 topologies that were observed in corporate networks. 189 00:42:52,190 --> 00:42:55,890 Since we have a bunch of them, we'll just do this in a loop. 190 00:42:59,090 --> 00:43:01,870 Yep, yep, A3 in the mask. 191 00:43:02,270 --> 00:43:03,750 And then we'll call it done. 192 00:43:47,050 --> 00:43:49,130 Come on, you can do it. 193 00:43:50,590 --> 00:43:51,390 Okay. 194 00:43:53,530 --> 00:43:55,170 Looks like a pretty good result. 195 00:44:20,360 --> 00:44:24,580 So this is all going to be the same structure. 196 00:44:24,580 --> 00:44:27,240 So you see we've got one upper. 197 00:44:27,460 --> 00:44:28,120 What's that? 198 00:44:28,120 --> 00:44:32,580 One, two, three, four, five lowers and two digits. 199 00:44:33,240 --> 00:44:37,080 So that would be numbers. 200 00:44:37,080 --> 00:44:38,980 Six, eight characters. 201 00:44:39,280 --> 00:44:43,780 So we're cracking eight character passwords in... what's our runtime? 202 00:44:46,400 --> 00:44:47,820 Less than a minute. 203 00:44:47,820 --> 00:44:51,340 And the entire attack is going to complete in about a minute. 204 00:45:10,660 --> 00:45:13,580 Oh, we're actually over 25% because we're missing... 205 00:45:14,420 --> 00:45:15,520 what? 206 00:45:15,820 --> 00:45:20,000 200 and... yeah, about 200,000 hashes out of this. 207 00:45:20,000 --> 00:45:23,220 Or no, we're missing like 3 million. 208 00:45:23,240 --> 00:45:26,280 So we're way over 25% at this point. 209 00:45:26,280 --> 00:45:29,480 And we're only 40-45 minutes in. 210 00:45:42,410 --> 00:45:45,910 So let's actually even... let's take pack. 211 00:45:53,690 --> 00:46:01,530 And we'll run pack against our cracks and generate some rules and then run some rules against our cracks and see what happens. 212 00:46:23,800 --> 00:46:27,880 Let's actually pause this for a second. 213 00:46:49,740 --> 00:46:52,300 And what do we call this? 214 00:46:53,300 --> 00:46:55,060 pot.dict, I think. 215 00:46:55,060 --> 00:46:55,860 Yeah. 216 00:46:57,820 --> 00:47:00,760 And we're going to sort this thing before we do this anyway. 217 00:47:00,760 --> 00:47:01,500 So let's do... 218 00:47:01,500 --> 00:47:05,820 what was that out file? 219 00:47:05,820 --> 00:47:08,880 It's like... no, it wasn't hashcut, it was rocku.out. 220 00:47:08,880 --> 00:47:10,740 We'll put those in there. 221 00:47:10,740 --> 00:47:19,820 And then we will do a sort techu.pot.dict to pot.sorted. 222 00:47:22,720 --> 00:47:30,960 And then we'll move pot.sorted to pot.dict. 223 00:47:33,800 --> 00:47:36,180 Such a lewd file name. 224 00:47:39,090 --> 00:47:40,410 Okay. 225 00:47:40,610 --> 00:47:43,610 So let's go... we'll let this keep going. 226 00:47:43,610 --> 00:47:46,550 So we will resume this with R. 227 00:47:50,560 --> 00:47:56,290 And then let's do... let's do mask... no, we don't want maskgen, we want rulegen. 228 00:47:58,640 --> 00:48:00,360 So... uh-oh. 229 00:48:00,380 --> 00:48:04,660 I don't think pack is Python 3. 230 00:48:08,140 --> 00:48:10,980 That doesn't look like it to me. 231 00:48:11,420 --> 00:48:13,240 We'll try it. 232 00:48:15,540 --> 00:48:17,140 Yeah, I didn't think so. 233 00:48:17,140 --> 00:48:17,740 Okay. 234 00:48:17,740 --> 00:48:18,120 So we're going to do... 235 00:48:20,940 --> 00:48:24,420 app.cache.search.python2. 236 00:49:00,720 --> 00:49:03,140 No module named enchant. 237 00:49:03,800 --> 00:49:10,500 So probably the pip to install enchant. 238 00:49:18,680 --> 00:49:21,100 We don't even have pip. 239 00:49:24,070 --> 00:49:25,830 Oh no. 240 00:49:26,370 --> 00:49:28,470 It's all going to hell. 241 00:49:35,800 --> 00:49:37,160 What? 242 00:49:49,810 --> 00:49:54,390 Python 2 doesn't have... that was pip.whl. 243 00:49:54,730 --> 00:49:56,510 No, let's do it. 244 00:50:08,010 --> 00:50:10,050 Yeah, it ain't there, man. 245 00:50:11,030 --> 00:50:19,890 app.install.python.tack.pip. 246 00:50:31,790 --> 00:50:36,110 We need to summon ifelix to port pack to Python 3. 247 00:52:04,540 --> 00:52:06,700 What provides enchant now? 248 00:52:25,160 --> 00:52:26,380 Python 3 enchant? 249 00:52:26,380 --> 00:52:27,840 No, Python 2 enchant. 250 00:52:27,840 --> 00:52:29,660 What happens if we do that? 251 00:52:52,620 --> 00:52:54,340 Oh, it's pyenchant. 252 00:52:55,480 --> 00:52:57,160 Let me smart. 253 00:53:09,510 --> 00:53:11,080 Enchant C library. 254 00:53:11,490 --> 00:53:12,630 Okay. 255 00:53:21,480 --> 00:53:24,320 lib enchant dove. 256 00:53:35,350 --> 00:53:42,690 Yeah, it kind of looks like they may have pulled it, but we're working around it. 257 00:53:45,170 --> 00:53:46,650 Where are we at? 258 00:53:50,400 --> 00:53:52,980 Going slowly, but we're still going. 259 00:53:52,980 --> 00:53:53,480 Okay. 260 00:54:04,010 --> 00:54:06,170 Okay, we did it. 261 00:54:07,990 --> 00:54:09,010 All right. 262 00:54:09,390 --> 00:54:23,950 So we want to run statsgen on our dictionary. 263 00:54:26,170 --> 00:54:28,530 So that was pot.dict. 264 00:54:28,950 --> 00:54:30,810 We'll let it do its thing. 265 00:54:57,020 --> 00:54:59,020 All right, so we've got... 266 00:54:59,020 --> 00:55:00,560 So these aren't going to help us too much. 267 00:55:00,560 --> 00:55:01,660 I mean, they might... 268 00:55:01,660 --> 00:55:07,460 We could probably run these and get something out of them, but we're kind of unlikely to. 269 00:55:10,620 --> 00:55:15,560 But that's a good example of extracting masks out of dumps that you... 270 00:55:15,560 --> 00:55:17,480 Or not dumps, but cracks that you've done. 271 00:55:17,480 --> 00:55:22,880 So we could take these right here and put them in a new file and then start running them. 272 00:55:26,080 --> 00:55:31,600 But what I want to do is... 273 00:55:33,400 --> 00:55:34,820 Do we have our analysis? 274 00:55:35,780 --> 00:55:37,120 No, we don't. 275 00:55:39,600 --> 00:55:41,400 Why do we not have our analysis? 276 00:55:44,590 --> 00:55:45,990 No, because we didn't output them. 277 00:55:45,990 --> 00:55:46,770 That's why. 278 00:55:53,320 --> 00:55:55,280 So let's write that to masks.out. 279 00:56:18,610 --> 00:56:20,910 All right, and then we'll feed that into maskgen. 280 00:56:33,830 --> 00:56:36,070 I wonder what the math he based. 281 00:56:36,070 --> 00:56:40,290 So that's on a billion per second. 282 00:56:41,770 --> 00:56:43,370 I don't think we're going to be able to... 283 00:56:44,750 --> 00:56:47,650 I don't think we're going to be able to cover that in this stream. 284 00:56:52,040 --> 00:56:53,700 Let's do rulegen though. 285 00:56:55,560 --> 00:56:58,020 And we'll just generate some rules. 286 00:57:06,320 --> 00:57:07,580 Excuse me? 287 00:57:38,030 --> 00:57:42,010 So how does that work for maskgen, but not for rulegen? 288 00:57:42,170 --> 00:57:46,190 Or was it statsgen that failed before? 289 00:57:46,190 --> 00:57:47,990 I don't even remember anymore. 290 00:58:30,210 --> 00:58:32,890 I guess I just forgot to redo it. 291 00:58:33,790 --> 00:58:38,790 Okay, so let's take a look at our options here. 292 00:58:38,790 --> 00:58:41,230 We can make that a little bit smaller. 293 00:58:46,810 --> 00:58:49,710 Take the defaults on everything. 294 00:59:36,880 --> 00:59:38,460 We're going through pack. 295 00:59:39,320 --> 00:59:40,480 Generating some rules. 296 00:59:40,480 --> 00:59:53,460 We've cracked about, I want to say, close to 30% of Rocky right now using nothing but masks, rules, and passwords that we've cracked from those. 297 01:00:02,820 --> 01:00:06,520 Pack's going to take its sweet time because, you know... 298 01:00:51,560 --> 01:00:56,200 So pack needs to run through about four and a half million candidates. 299 01:00:56,200 --> 01:00:57,840 So this is going to take a little bit. 300 01:00:57,880 --> 01:01:00,780 So we'll let that run down there and we'll let our path while masks keep running. 301 01:01:09,820 --> 01:01:11,740 The old Minga special. 302 01:01:12,080 --> 01:01:16,900 You know, this card has like 13 gig of video memory. 303 01:01:16,900 --> 01:01:18,280 We'd probably be fine. 304 01:01:19,920 --> 01:01:21,000 Let's do it. 305 01:01:21,000 --> 01:01:22,020 I ain't scared. 306 01:01:49,690 --> 01:01:51,150 Right, yeah. 307 01:01:57,410 --> 01:01:59,930 That dictionary just grew massively for pack. 308 01:01:59,930 --> 01:02:02,110 So , oh well, it'll get over it. 309 01:02:22,460 --> 01:02:23,360 Okay. 310 01:02:26,300 --> 01:02:34,470 So we're gonna do rocky.hash. 311 01:02:34,490 --> 01:02:35,570 What'd you want? 312 01:02:35,570 --> 01:02:38,230 You wanted the pot.dict. 313 01:02:40,350 --> 01:02:44,090 One, two, three, four, five, six. 314 01:02:44,090 --> 01:02:45,650 All right, here we go. 315 01:03:06,500 --> 01:03:10,300 So we're auto-generating just shy of a million rules. 316 01:03:10,300 --> 01:03:13,740 And we're going to run that against every... 317 01:03:17,600 --> 01:03:18,260 What? 318 01:03:18,840 --> 01:03:19,840 Because. 319 01:03:20,120 --> 01:03:21,640 Because I don't want to. 320 01:03:32,050 --> 01:03:33,310 What if there's... 321 01:03:33,310 --> 01:03:38,550 What if there is a 65 character password in here? 322 01:03:40,820 --> 01:03:42,240 I want it. 323 01:03:42,260 --> 01:03:44,340 And I'm not going to get that with taco. 324 01:03:50,940 --> 01:03:52,540 Why no w4? 325 01:03:52,540 --> 01:03:55,360 Yeah, that's a good question. 326 01:03:56,180 --> 01:03:57,860 Because I'm trying to run pack. 327 01:03:57,860 --> 01:03:58,840 That's why. 328 01:04:00,620 --> 01:04:03,660 I would like this box to actually remain accessible. 329 01:04:04,700 --> 01:04:05,580 I don't... 330 01:04:05,580 --> 01:04:06,360 You know what, dude? 331 01:04:06,360 --> 01:04:09,280 My armpits smell like free birds right now. 332 01:04:09,280 --> 01:04:10,340 It smells delicious. 333 01:04:16,820 --> 01:04:18,640 Nope, that's too close. 334 01:04:18,640 --> 01:04:21,140 Oh, well, you're throwing prints in there. 335 01:04:23,340 --> 01:04:25,100 That's a little close to cheating. 336 01:04:25,100 --> 01:04:25,960 We don't want to use... 337 01:04:25,960 --> 01:04:29,720 We don't want to use rocky.hash to crack rocky.hash. 338 01:04:29,720 --> 01:04:31,940 That kind of defeats the purpose. 339 01:04:42,320 --> 01:04:43,280 If we did that... 340 01:04:45,300 --> 01:04:47,540 Imagine Rocky just came out, right? 341 01:04:47,540 --> 01:04:53,300 Like we're all we're all fawning over the fact that we have 14.3 million hashes and we want to crack them. 342 01:04:53,520 --> 01:04:54,600 We wouldn't have that. 343 01:04:54,600 --> 01:04:56,860 We wouldn't know what rules Rocky was using. 344 01:04:56,860 --> 01:04:58,400 It's totally unfair. 345 01:05:01,170 --> 01:05:06,750 It's like walking in to do a pen test with a domain admin account and then claiming you own the entire network. 346 01:05:06,750 --> 01:05:07,810 Get out of here. 347 01:05:25,570 --> 01:05:26,690 Almost at 20... 348 01:05:26,690 --> 01:05:28,030 Almost at 25. 349 01:05:28,990 --> 01:05:30,150 We can do it. 350 01:05:36,100 --> 01:05:37,640 Do you put on your Bon Jovi? 351 01:05:37,640 --> 01:05:38,460 Let's go. 352 01:06:03,670 --> 01:06:06,410 It probably would have been smarter to write the cracks to a file. 353 01:06:06,410 --> 01:06:07,930 So this would go a little bit quicker. 354 01:06:07,930 --> 01:06:14,370 But it's also a little less interesting because then you just sit there and look at a status screen updating every 20 seconds. 355 01:06:39,380 --> 01:06:42,680 See, but this looks like it could actually be an interesting mask to run. 356 01:06:44,960 --> 01:06:47,200 So we've got a big string of these. 357 01:06:50,880 --> 01:06:52,260 There's some with E. 358 01:06:52,260 --> 01:06:57,620 Let's try doing a lower in six digits. 359 01:07:04,540 --> 01:07:06,180 So we'll do A3. 360 01:07:06,180 --> 01:07:10,660 We're going to do lower 2, 3, 4, 5, 6. 361 01:07:10,660 --> 01:07:20,480 And then just in case there's some that are maybe five, we'll do increment. 362 01:07:20,520 --> 01:07:22,680 And we're actually going to write these to 363 01:07:26,700 --> 01:07:30,360 rocky.out, because this should run fast enough, it won't matter. 364 01:08:02,260 --> 01:08:03,140 Better? 365 01:08:29,810 --> 01:08:32,430 All right, so 25, 21. 366 01:08:33,970 --> 01:08:35,750 So we're definitely getting cracks. 367 01:08:35,750 --> 01:08:43,990 So we started at 25.07, so we got, what, 14 or 0.14% out of that. 368 01:08:44,790 --> 01:08:46,830 That's not as good as I thought it would be. 369 01:08:47,050 --> 01:08:48,490 This is more... this one was more fun. 370 01:08:48,490 --> 01:08:51,530 Actually, let's not even do that yet. 371 01:08:53,630 --> 01:08:55,770 Let's roll our cracks back in. 372 01:09:01,900 --> 01:09:04,540 And this is pot.dict. 373 01:09:11,740 --> 01:09:13,360 I'm going to sort u. 374 01:10:36,880 --> 01:10:39,080 Did that just say it's close to the end? 375 01:11:46,710 --> 01:11:49,690 We need to roll the old hashes back in too, though. 376 01:14:45,830 --> 01:14:47,330 Dude, is this going to finish? 377 01:14:48,870 --> 01:14:50,350 In nine hours? 378 01:14:50,590 --> 01:14:51,970 Oh my god. 379 01:14:55,520 --> 01:14:57,180 Ain't nobody got time for that. 380 01:15:00,900 --> 01:15:02,740 Once pack's done, we'll... 381 01:15:02,740 --> 01:15:03,460 Actually, you know what? 382 01:15:03,460 --> 01:15:05,100 If I kill this pack, we'll go faster. 383 01:15:05,100 --> 01:15:09,600 So we'll let pack do its thing, and then we'll run the pack rules. 384 01:15:34,000 --> 01:15:34,900 Now, you know what? 385 01:15:34,900 --> 01:15:37,780 I want to run... 386 01:15:38,220 --> 01:15:39,020 What was that? 387 01:15:39,020 --> 01:15:41,380 Lower, one, two, three. 388 01:15:41,580 --> 01:15:42,560 We already do this? 389 01:15:44,760 --> 01:15:45,980 I think we did. 390 01:15:46,300 --> 01:15:48,240 Let's do the opposite of that. 391 01:15:48,240 --> 01:15:52,360 So we've got this one, which seems to be doing a thing. 392 01:15:52,980 --> 01:15:56,660 One, two, three, four, five, six, lower. 393 01:15:57,020 --> 01:16:00,640 One, two, three, four, five, six, lower. 394 01:17:15,900 --> 01:17:16,640 Uh-oh. 395 01:17:16,640 --> 01:17:17,700 Did we break it? 396 01:17:37,090 --> 01:17:38,550 I think it's broken. 397 01:17:55,520 --> 01:18:02,640 We ran out of memory because pack is trying to do four million rules. 398 01:18:04,020 --> 01:18:04,720 Yeah. 399 01:18:09,000 --> 01:18:10,900 I need a sad trombone. 400 01:18:25,070 --> 01:18:26,710 Should've let pack finish. 401 01:18:27,610 --> 01:18:28,690 Oh shit. 402 01:18:48,260 --> 01:18:50,260 Well, we didn't do too bad before we crashed. 403 01:18:50,260 --> 01:18:51,100 I mean, I can't even... 404 01:18:51,100 --> 01:18:52,260 I can't even scroll. 405 01:18:52,260 --> 01:18:52,940 Like, this thing is... 406 01:18:54,100 --> 01:18:55,440 This thing is toast. 407 01:18:58,700 --> 01:18:59,420 So we did... 408 01:19:00,900 --> 01:19:02,160 What do we have here? 409 01:19:03,620 --> 01:19:05,700 2.9, so we're at three million there. 410 01:19:05,700 --> 01:19:09,220 And then we trimmed out about three million. 411 01:19:09,220 --> 01:19:09,860 So we cracked about... 412 01:19:12,600 --> 01:19:16,260 Well, I guess that would be almost 50% then, right? 413 01:19:17,240 --> 01:19:25,900 So we've cracked half of Rock You in an hour and 19 minutes using nothing but masks and a couple word lists. 414 01:19:25,900 --> 01:19:28,820 I think we used the English dictionary. 415 01:19:29,100 --> 01:19:31,900 Got a bunch of stuff with some hybrid attacks. 416 01:19:34,560 --> 01:19:37,080 Did some mask attacks with digits. 417 01:19:38,160 --> 01:19:41,460 Because for whatever reason, Rock You has a million digit passwords. 418 01:20:31,480 --> 01:20:33,380 No, this is it. 419 01:20:34,100 --> 01:20:34,800 You have to... 420 01:20:35,860 --> 01:20:37,420 Britney Spears forum. 421 01:20:44,110 --> 01:20:45,950 Oh shit, we're back. 422 01:20:49,960 --> 01:20:51,300 Pack did its thing. 423 01:21:01,180 --> 01:21:02,640 Really inopportune time, too. 424 01:21:02,640 --> 01:21:04,220 I just shoved food in my mouth. 425 01:21:07,380 --> 01:21:12,660 All right, so pack went and took a look at all the words that we had in our word list. 426 01:21:12,660 --> 01:21:16,620 And I built a rule set out of that. 427 01:21:17,960 --> 01:21:19,560 And then it sorted that rule set. 428 01:21:19,560 --> 01:21:24,150 So we can take this analysisSorted.rule and feed this in on our... 429 01:21:28,440 --> 01:21:30,700 feed this in using our pot.dict. 430 01:21:31,300 --> 01:21:33,320 We should get a shit ton of cracks. 431 01:21:33,540 --> 01:21:34,620 Let's see what happens. 432 01:21:45,220 --> 01:21:51,840 pot.dict techr pack analysisSorted rule 433 01:23:17,500 --> 01:23:17,760 . 434 01:23:18,340 --> 01:23:24,640 No, and we don't have to cover those because hashcat defaults to MD5 as it's... 435 01:23:26,540 --> 01:23:29,060 It defaults to MD5 as the hash type. 436 01:23:29,060 --> 01:23:31,580 And since we're running MD5s, we don't need to worry about it. 437 01:23:31,580 --> 01:23:39,480 And because we're still doing dictionary attacks, we don't need to specify A because the default value is to do a dictionary attack. 438 01:23:39,800 --> 01:23:44,440 So adding rules to a dictionary is still a dictionary attack. 439 01:23:45,640 --> 01:23:47,620 It's just mangled by rules. 440 01:24:01,600 --> 01:24:04,380 I mean, at this point, we might just crack everything. 441 01:24:49,430 --> 01:24:52,090 I think I just saw my password fly by too. 442 01:24:56,750 --> 01:24:59,190 The hell's with the 727s? 443 01:25:00,950 --> 01:25:03,050 A bunch of Boeing fans at Rocky. 444 01:25:51,280 --> 01:25:52,820 Yeah, I saw that. 445 01:26:33,680 --> 01:26:34,960 I think so. 446 01:26:38,020 --> 01:26:39,240 Let's do it. 447 01:26:53,410 --> 01:26:56,730 And if only that were the case. 448 01:26:57,650 --> 01:27:00,370 All right, so password.dict. 449 01:27:00,370 --> 01:27:03,010 And then we're going to run... 450 01:27:04,030 --> 01:27:05,930 We're not going to run pack again because... 451 01:27:07,890 --> 01:27:09,190 No. 452 01:27:10,730 --> 01:27:17,530 And we want analysis rule sorted. 453 01:27:58,360 --> 01:28:00,940 I would laugh if this got nothing. 454 01:28:02,700 --> 01:28:05,680 I think it did it. 455 01:28:09,780 --> 01:28:11,520 2787, yeah. 456 01:28:15,940 --> 01:28:17,860 Good work, Manga, you got nothing. 457 01:29:05,540 --> 01:29:06,420 I don't know. 458 01:29:06,420 --> 01:29:10,040 It's only one word, why would it have queued? 459 01:29:10,040 --> 01:29:11,920 Maybe because it split the workload? 460 01:29:20,340 --> 01:29:21,720 No, there's an R. 461 01:29:22,920 --> 01:29:24,020 Oh, wait. 462 01:29:33,520 --> 01:29:34,640 All right. 463 01:30:00,700 --> 01:30:02,100 Yeah, yeah, yeah. 464 01:30:04,870 --> 01:30:06,310 I missed an R. 465 01:30:55,140 --> 01:30:56,300 What was that? 466 01:30:56,340 --> 01:30:58,760 Two percent, roughly. 467 01:31:03,600 --> 01:31:07,260 2787 to 3074, almost three percent. 468 01:31:11,370 --> 01:31:12,330 Now, what if... 469 01:31:16,220 --> 01:31:19,740 I don't want to do the whole thing because that's going to take way too long. 470 01:31:22,080 --> 01:31:23,020 What if 471 01:31:41,860 --> 01:31:45,640 s -w-o-r-d... 472 01:31:49,050 --> 01:31:50,650 We'll do two to start. 473 01:31:50,650 --> 01:31:52,050 No, we'll do one to start. 474 01:31:57,850 --> 01:31:59,230 Forgetting all kinds of stuff. 475 01:31:59,610 --> 01:32:00,110 I 476 01:32:36,230 --> 01:32:42,170 probably should have done this as increment because these startup times are getting a bit ridiculous. 477 01:33:05,970 --> 01:33:07,630 Word pass. 478 01:33:10,230 --> 01:33:12,310 No one will ever guess. 479 01:34:27,300 --> 01:34:28,620 Oh, we're getting faster. 480 01:34:28,620 --> 01:34:33,800 We're up to 500 million, almost 500 million. 481 01:35:12,460 --> 01:35:15,080 Yeah, drosap, drosap's always a good one. 482 01:40:21,720 --> 01:40:24,040 I mean, that did pretty good. 483 01:40:29,280 --> 01:40:30,080 Nope. 484 01:40:30,080 --> 01:40:33,920 So that doesn't matter because we already specified it here. 485 01:40:48,260 --> 01:40:51,100 Let's run it out a few more characters and see what it gets. 486 01:41:05,760 --> 01:41:12,080 Something that would have been smart is if we did the lowercase o, the uppercase o, and then a zero. 487 01:41:12,460 --> 01:41:16,640 And then for i, we do lower i, upper i, and a one. 488 01:41:19,660 --> 01:41:21,220 Run that file. 489 01:41:21,680 --> 01:41:23,680 Yeah, I did that. 490 01:41:24,680 --> 01:41:28,860 We ran the top 100 pathway masks. 491 01:41:46,660 --> 01:41:48,000 Yeah, yeah, yeah. 492 01:41:48,000 --> 01:41:49,440 I'm not doing that. 493 01:41:49,440 --> 01:41:51,140 Dude, on a Tesla? 494 01:41:52,720 --> 01:41:53,600 No. 495 01:42:24,500 --> 01:42:27,440 All right, after this one, we'll run it. 496 01:42:28,640 --> 01:42:29,860 That's going to take 10 minutes. 497 01:42:29,860 --> 01:42:30,920 I don't want to do that. 498 01:42:31,900 --> 01:42:41,380 If you're over there analyzing what the fastest thing you can run to crack as much as you can, be disappointed. 499 01:42:41,780 --> 01:42:43,000 So what do we have? 500 01:42:43,000 --> 01:42:52,660 So we have A3 incrementing from a minimum of 8 with a runtime of 17 seconds. 501 01:42:52,660 --> 01:42:58,380 We have 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11. 502 01:42:58,380 --> 01:42:59,200 Okay. 503 01:43:03,760 --> 01:43:05,340 Oh, this changed. 504 01:43:18,420 --> 01:43:21,340 Yeah, increment min. 505 01:44:44,500 --> 01:44:48,660 Yeah, the tools haven't been updated in a while though. 506 01:45:12,860 --> 01:45:26,780 I don't know, I mean, there comes a point where, you know, you get used to or you've already generated the things that you need to generate, and you've already found other ways of doing something that you don't need to pull the tools back into it. 507 01:45:28,680 --> 01:45:31,280 Yeah, no, I still pwmin. 508 01:45:40,780 --> 01:45:44,800 I mean, hell, I didn't even catch it when you typed it and typed it myself, so, you know. 509 01:46:31,470 --> 01:46:36,790 It's not cheating that much because we're still running the attacks. 510 01:46:36,790 --> 01:46:38,090 Yeah, yeah, I know. 511 01:46:39,010 --> 01:46:45,930 But there's a very big difference between, let's use the rules generated from RockYou against RockYou versus hcstat. 512 01:46:51,400 --> 01:46:52,780 Because you still have to base... 513 01:46:52,780 --> 01:46:55,440 You still have to get your baseline in before you do that. 514 01:46:55,660 --> 01:46:56,720 It is cheating. 515 01:47:00,370 --> 01:47:01,770 That's why we regenerated... 516 01:47:03,430 --> 01:47:05,470 We regenerated the rule set down here. 517 01:47:13,280 --> 01:47:15,140 Yeah, yeah. 518 01:47:27,620 --> 01:47:28,980 Oh, no, no, no, no. 519 01:47:32,470 --> 01:47:42,480 But I'm done in about 30 seconds anyway because it's 11 o'clock and I want to take a break from sitting here. 520 01:48:18,980 --> 01:48:26,620 All right, so we did 4.4 million plus... 521 01:48:38,030 --> 01:48:39,830 Math is hard. 522 01:48:39,970 --> 01:48:45,010 One, four, three, four, four, three, nine, one, minus... 523 01:48:50,270 --> 01:48:55,390 One, one, nine, two, five, two, five, four, seven, two. 524 01:49:03,550 --> 01:49:08,730 So, four, that's 5.8 million. 525 01:49:09,250 --> 01:49:12,950 So we did just under 50% in an hour and 40 minutes. 526 01:49:14,090 --> 01:49:15,590 It's pretty good. 527 01:49:20,990 --> 01:49:22,410 So I'm gonna blow this box away. 528 01:49:22,410 --> 01:49:23,410 That was fun. 529 01:49:24,870 --> 01:49:28,010 Maybe tomorrow we can do something similar. 530 01:49:28,010 --> 01:49:28,750 I'll save the... 531 01:49:28,750 --> 01:49:30,950 I'll save the cracks, but we'll see. 532 01:49:30,950 --> 01:49:32,490 Saturday night's gonna be crazy. 533 01:49:32,610 --> 01:49:33,630 Anyway, that's it for now. 534 01:49:33,630 --> 01:49:34,210 Thanks, guys.