WEBVTT 00:40.530 --> 00:43.490 All right, let's see what we can do here. 00:43.490 --> 00:50.530 So we're gonna crack RokU without using RokU. 00:50.530 --> 01:06.450 So all I did was took the RokU dictionary, piped it through MD5, so we have a big-ass list of MD5 hashes now, and let's see what we can do. 02:27.520 --> 02:33.940 Looks like we lost a few hashes in the conversion, but I think we'll be all right. 02:43.320 --> 02:47.360 All right, so most basic, let's do a hashcat 02:54.890 --> 02:56.490 RokU.hash. 02:57.450 --> 03:05.150 We'll do tach E3 and let's just do five character. 03:07.110 --> 03:19.430 So this will do all character classes for five positions, but we're going to start doing one, and then we'll do two, and then we'll do three, then we'll do four, then we'll do five. 03:19.430 --> 03:22.830 So that's what this increment flag does. 03:22.830 --> 03:25.990 So that is one, two, three, four, five. 04:18.120 --> 04:20.540 I think we're doing okay. 04:44.690 --> 04:48.330 All right, almost 300,000 in 27 seconds. 04:49.010 --> 04:50.070 Why not? 05:03.120 --> 05:04.480 So let's try... 05:07.080 --> 05:11.260 We need to grab... We don't have anything. 05:11.900 --> 05:19.340 We can't do a wiki strip, that would take too long. 05:23.580 --> 05:27.700 Let's see if we can find a dictionary. 05:28.680 --> 05:30.500 Something small. 05:33.760 --> 05:43.220 Let's try, like, all words of 10 letters, and we want that in a text file. 06:14.010 --> 06:16.050 Can't I just have a dictionary? 06:32.580 --> 06:35.860 We have... 06:53.070 --> 06:54.430 Oh yeah, good point. 06:54.430 --> 06:56.650 We could use ASPEL, that's true. 06:58.410 --> 07:05.210 Let's grab wiki strip because we can use it regardless. 07:19.260 --> 07:23.060 And then, do we have ASPEL? 07:46.530 --> 07:50.110 Where do ASPEL's dicts go? 08:24.940 --> 08:26.640 There we go. 08:27.000 --> 08:34.280 So I'm guessing we could probably use the ENUS. 08:34.280 --> 08:35.840 Let's do that one. 09:12.360 --> 09:14.520 Yeah, maybe that's not a good one. 09:36.970 --> 09:38.810 Maybe without accents? 09:40.270 --> 09:43.970 I don't think that one's even gonna... That one's gonna matter. 09:46.190 --> 09:48.110 Let's instead... Let's go grab... 10:03.470 --> 10:04.950 There we go. 10:07.610 --> 10:09.290 Let's grab this one. 10:20.090 --> 10:24.390 Some random list of words off of GitHub, this ought to be interesting. 10:28.260 --> 10:38.260 So we're gonna do rocku.hash, and then feed it words.txt, and let's see what we get. 10:39.040 --> 10:41.300 Actually, let's look at what these even look like. 10:46.800 --> 10:49.300 Yeah, this'll work. 11:20.690 --> 11:24.890 Okay, actually, it wasn't terrible, so that's good. 11:24.970 --> 11:26.090 Let's try doing... 11:27.910 --> 11:31.830 Let's do an A6 and see what we get. 11:31.830 --> 11:32.730 And we'll just add... 11:34.110 --> 11:36.050 Let's just add two digits. 11:36.210 --> 11:40.490 No, let's just add... Yeah, let's do two digits, and then let's also increment. 11:41.230 --> 11:43.750 So we exhaust both of those. 11:44.730 --> 11:46.370 Oops, that's gonna fail. 11:46.370 --> 11:46.750 But 12:39.670 --> 12:44.810 yeah, I mean, I guess that works. 12:48.370 --> 12:50.330 We got 2% just off of that. 12:50.330 --> 12:51.530 All right, all right. 12:54.320 --> 13:01.340 What if we do... If we already incremented two spaces, let's not run that again. 13:01.340 --> 13:01.680 Let's do... 13:05.240 --> 13:07.520 Well, let's just do like... What year did this come out? 13:07.640 --> 13:08.460 2009, right? 13:08.460 --> 13:10.020 So let's do 2008. 13:32.930 --> 13:37.290 Oh, we're gonna have to trim this hash file too, because these load times are a bit ridiculous. 13:54.200 --> 13:58.020 All right, so not a whole lot of 2008 passwords. 13:58.540 --> 14:01.920 Let's... We're gonna add remove. 14:04.000 --> 14:06.080 And we're also gonna do an out file. 14:06.080 --> 14:08.280 We don't need to do an out file, because we can do a pop file. 14:08.280 --> 14:09.800 So what this is gonna do is... 14:09.800 --> 14:13.540 So we're gonna take all these words that are in words.txt. 14:13.640 --> 14:15.600 We're gonna add 2009 to it. 14:15.600 --> 14:22.040 Actually, let's just do... Let's do 2000 digit, digit. 14:22.040 --> 14:26.660 So that should cover everything from 0, 0 to 99. 14:26.660 --> 14:30.760 And then we're gonna remove everything that we cracked, because it's gonna go in our pop file anyway. 14:30.800 --> 14:35.880 And then after that, we'll roll our pop file back and we'll try some rule-based attacks. 14:53.650 --> 14:57.710 So we've only got 13,700,000 more hashes to crack. 15:25.710 --> 15:26.950 Not a lot. 15:27.910 --> 15:36.410 Let's do a cut-d, attack-f2-on from hashcat.popfile. 15:36.410 --> 15:43.070 And we're gonna put that to pop.dict. 15:46.040 --> 15:54.720 And then let's roll... Instead of doing an A6, let's just do generated rules. 15:57.680 --> 16:01.120 And let's do like... Let's do like 5,000 of them. 16:11.180 --> 16:15.720 We'll move that removed so we don't have to keep doing it every time we want to change a command line or a run line. 16:47.980 --> 16:49.660 Probably should have suppressed output. 16:49.660 --> 16:53.920 This is... Get hit status, but we're not gonna see anything. 17:16.620 --> 17:18.300 We're up over a million now. 18:04.440 --> 18:04.800 So that... 18:04.800 --> 18:08.420 That got us almost 11%. 18:08.420 --> 18:10.180 No, 8... 9%. 18:10.180 --> 18:10.920 Almost 9%. 18:10.920 --> 18:11.980 It's pretty good. 18:13.620 --> 18:18.060 And the great thing is, is that if we do that again, we're gonna get a bunch more. 18:18.120 --> 18:26.960 But this time we're gonna write this... We'll start writing this out to a file so we don't slow down at all. 18:28.400 --> 18:32.360 w... We'll call this rocku.out. 18:40.930 --> 18:42.850 It's not w, it's tacho. 18:57.640 --> 18:59.940 This load time's a little bit ridiculous. 19:00.380 --> 19:01.620 I think we'll manage. 19:02.340 --> 19:04.280 Let's just see what our GPU is doing as well. 19:04.280 --> 19:12.660 So down here we'll do like a watchtech n5 nvidia smi. 19:30.970 --> 19:35.790 So even for md5, because there's so many hashes, we're still only going at what's that? 19:36.250 --> 19:43.350 118... 118 million candidates per second, which is a little bit sad, but you know. 19:47.150 --> 19:52.970 So we got 278,000 on that one, or 288,000. 19:53.170 --> 19:56.470 So if we do it again, we'll get even more. 19:56.590 --> 19:58.670 So you just sit here and you loop this attack. 20:15.240 --> 20:18.880 I think after this one we'll just do maybe just an uppercase. 20:18.880 --> 20:19.180 I don't know. 20:19.180 --> 20:19.580 If you have... 20:19.580 --> 20:24.820 If you have an idea, tell me what you want to try in the chat, and we'll give it a shot and see how many you get. 20:57.040 --> 20:58.480 All right, so let's try... 21:01.520 --> 21:04.360 Let's try just uppercasing everything. 21:41.550 --> 21:42.830 Wow, we got nothing. 21:43.130 --> 21:46.730 Probably because we already had an uppercase in our generated rules. 21:48.430 --> 21:50.010 What else can we do? 21:54.360 --> 21:57.460 We could try doing some truncates. 21:58.180 --> 21:59.320 Let's actually do this. 21:59.340 --> 22:01.900 No, no, we'll just do the truncate first. 22:02.960 --> 22:11.080 So we'll just take one character off the right side of the plain text and see what happens. 22:12.600 --> 22:15.340 Normally this is really good if you have a word list that already has 22:19.640 --> 22:21.200 years on the end of it. 22:21.440 --> 22:36.020 So if you've already cracked hashes and somebody's using password 2019 and then they use password 2020, you trim one to two positions off and then you fill that with digits and get back to it. 22:36.160 --> 22:39.040 All right, so let's roll our cracks, because I forgot to do this. 22:39.040 --> 22:43.760 We'll roll our cracks back into our word list. 23:10.640 --> 23:11.940 I already forgot what I called it. 23:11.940 --> 23:12.700 Pot.dict. 23:17.740 --> 23:22.860 And then because we started writing an out file, we're going to do the same thing for the out file. 23:22.860 --> 23:25.780 Well, actually we don't need to do that. 23:34.160 --> 23:35.800 Yeah, we don't need to do that. 24:19.240 --> 24:30.420 All right, so we're going to take from the left side, or sorry, from the right side, using tack k, we're going to truncate the first two positions of the word that's in pot.dict. 24:30.640 --> 24:37.440 And then we're going to try and run everything for two positions and see what we get. 25:21.700 --> 25:24.000 Yep, that'll do it. 26:43.310 --> 26:46.110 It was actually getting a lot more than I expected it would. 27:05.200 --> 27:12.660 All right, so we're, what, 10.48% in. 27:12.660 --> 27:14.880 We've only got a lot more to go. 27:18.850 --> 27:35.790 All right, so if we truncated two, and it did really well, let's truncate three, but instead of adding something, just keep it with the same two positions and see if maybe we can catch some stuff that doesn't have that. 27:35.790 --> 27:43.890 This is a little brute force-y without actually doing a mask attack, but I mean, it still kind of makes sense. 27:43.890 --> 28:00.710 If somebody prepended, for instance, numbers to a password, if they start with their birth year or something at the beginning, we can strip those off and then start replacing the first digit or the first character that comes after that. 28:23.570 --> 28:24.750 Yeah, see that? 28:25.210 --> 28:26.950 We're still getting stuff. 28:49.050 --> 28:54.430 So one thing I keep seeing in here is there are a lot of passwords that are just digits. 28:54.690 --> 29:06.430 So this would be, to me, tells me that I need to go and brute force all of these, what is that, six, seven characters of digits. 29:06.470 --> 29:12.870 So after this one finishes, we'll see if we can do that, because seven digits will be pretty quick. 29:26.890 --> 29:31.950 I mean, technically, we could probably even go out to 12, but I don't know. 29:32.130 --> 29:33.970 We'll see what the runtime looks like. 30:02.120 --> 30:11.640 All right, so we're going to strip all this stuff off, and then we're just going to say A3, and we only want digits for, we'll say up to eight. 30:14.730 --> 30:18.290 And because there were ones that were less than eight, we're going to increment this as well. 30:20.690 --> 30:25.290 So we'll try one digit, then two digits, then three digits, then four digits. 31:14.050 --> 31:19.970 All right, so that was pretty quick, and that got us, what, almost seven percent. 31:19.970 --> 31:24.950 All right , so let's get rid of this increment, and let's do one more. 31:27.170 --> 31:29.170 Actually, who cares? 31:29.170 --> 31:32.130 Let's just go until it's going to take too long. 31:35.960 --> 31:43.560 So we're going to waste a little bit of time going over the things we already went over, but it was fast enough that it shouldn't really matter too much. 31:48.930 --> 31:55.530 I'm really going to keep getting faster as we keep cracking hashes, because it's less workload to do comparisons against. 32:05.660 --> 32:17.800 So what we should also see down here is our GPU memory is going to spike once the attack gets going, because we've got all that stuff loaded into the video card's memory. 32:47.440 --> 32:51.340 This is kind of a good example of why Rocky was bad in some ways. 32:51.340 --> 33:07.400 Like, it's good, but you could trim all of this crap out, because it's going to be rare that you're ever going to see a password that looks like this in a dump today or during a pen test or something. 33:07.400 --> 33:12.780 Like, if companies had passwords that look like this, their building's probably on fire. 34:59.360 --> 35:01.220 Oh, 24% almost? 35:01.220 --> 35:02.220 I'll take it. 35:16.060 --> 35:19.360 But this also means 24% of this dictionary is crap. 36:20.230 --> 36:21.190 Right? 36:21.530 --> 36:24.610 So we're at... let's see what percent we're at so far. 36:34.640 --> 36:37.000 So we're at almost 24%... 36:40.690 --> 36:42.470 Sorry, almost 25%. 36:49.310 --> 36:51.690 Well, that's what? 36:52.370 --> 36:54.590 14 divided by 4 is math? 37:01.230 --> 37:06.010 So what these probably are are spammer passwords, though, or automated accounts. 37:06.010 --> 37:14.310 So in a lot of ways, you know, like Twitter, for instance, or something... Reddit would be a good one. 37:14.310 --> 37:28.650 When you're doing automated account stuff, you don't really care about the security of the account if all you're going to do is sit there and upvote each other or, you know, do retweets or, you know, maybe it's a Twitch bot or something like that. 37:29.550 --> 37:37.410 So these are likely... I don't know much about the site other than the dictionary. 38:08.150 --> 38:18.190 I mean, it could be telephone numbers, but a five-digit telephone number, like we did have a lot of fives. 38:18.930 --> 38:20.390 Six, even. 38:31.500 --> 38:33.040 Yep, that's true. 38:34.800 --> 38:42.030 Asian countries where sometimes a sentence can be said in a string of numbers, sure. 39:01.060 --> 39:04.840 I kind of want it to stop cracking so we can do something else. 39:06.720 --> 39:07.780 But you know what? 39:07.780 --> 39:08.800 I'm gonna take them. 39:51.860 --> 39:55.660 What if... let's do... let's make a word list. 40:01.730 --> 40:03.570 We'll just use cool again. 40:03.750 --> 40:04.750 That's easy. 40:15.750 --> 40:16.870 Don't tell DT. 40:16.870 --> 40:18.670 I'm gonna scrape Defcon.org. 40:55.070 --> 40:55.770 So what are we doing? 40:55.770 --> 40:57.790 This is only... so this is only 12. 40:57.790 --> 40:59.150 Oh, this is gonna take 30 minutes. 40:59.150 --> 41:00.510 I don't want to wait 30 minutes. 41:12.690 --> 41:17.470 We're only doing the default, so it's only gonna go too deep. 41:17.690 --> 41:20.350 It won't spider too recursively. 41:38.720 --> 41:39.700 All right, screw that. 41:39.700 --> 41:40.540 I'm tired of waiting. 41:40.540 --> 41:41.660 31 minutes to finish. 41:41.660 --> 41:43.040 I don't want to sit around for 31 minutes. 41:43.040 --> 41:45.560 Okay, but we're at 25%, so that's pretty good. 41:46.540 --> 41:47.820 What else can we do? 41:49.660 --> 41:53.400 What if... oh, let's do the Pathwell masks. 42:04.140 --> 42:13.240 And if you're not familiar with what the Pathwell masks are, we will discuss those tomorrow. 42:19.520 --> 42:27.260 So this is the top 100 topologies that were observed in corporate networks. 42:52.190 --> 42:55.890 Since we have a bunch of them, we'll just do this in a loop. 42:59.090 --> 43:01.870 Yep, yep, A3 in the mask. 43:02.270 --> 43:03.750 And then we'll call it done. 43:47.050 --> 43:49.130 Come on, you can do it. 43:50.590 --> 43:51.390 Okay. 43:53.530 --> 43:55.170 Looks like a pretty good result. 44:20.360 --> 44:24.580 So this is all going to be the same structure. 44:24.580 --> 44:27.240 So you see we've got one upper. 44:27.460 --> 44:28.120 What's that? 44:28.120 --> 44:32.580 One, two, three, four, five lowers and two digits. 44:33.240 --> 44:37.080 So that would be numbers. 44:37.080 --> 44:38.980 Six, eight characters. 44:39.280 --> 44:43.780 So we're cracking eight character passwords in... what's our runtime? 44:46.400 --> 44:47.820 Less than a minute. 44:47.820 --> 44:51.340 And the entire attack is going to complete in about a minute. 45:10.660 --> 45:13.580 Oh, we're actually over 25% because we're missing... 45:14.420 --> 45:15.520 what? 45:15.820 --> 45:20.000 200 and... yeah, about 200,000 hashes out of this. 45:20.000 --> 45:23.220 Or no, we're missing like 3 million. 45:23.240 --> 45:26.280 So we're way over 25% at this point. 45:26.280 --> 45:29.480 And we're only 40-45 minutes in. 45:42.410 --> 45:45.910 So let's actually even... let's take pack. 45:53.690 --> 46:01.530 And we'll run pack against our cracks and generate some rules and then run some rules against our cracks and see what happens. 46:23.800 --> 46:27.880 Let's actually pause this for a second. 46:49.740 --> 46:52.300 And what do we call this? 46:53.300 --> 46:55.060 pot.dict, I think. 46:55.060 --> 46:55.860 Yeah. 46:57.820 --> 47:00.760 And we're going to sort this thing before we do this anyway. 47:00.760 --> 47:01.500 So let's do... 47:01.500 --> 47:05.820 what was that out file? 47:05.820 --> 47:08.880 It's like... no, it wasn't hashcut, it was rocku.out. 47:08.880 --> 47:10.740 We'll put those in there. 47:10.740 --> 47:19.820 And then we will do a sort techu.pot.dict to pot.sorted. 47:22.720 --> 47:30.960 And then we'll move pot.sorted to pot.dict. 47:33.800 --> 47:36.180 Such a lewd file name. 47:39.090 --> 47:40.410 Okay. 47:40.610 --> 47:43.610 So let's go... we'll let this keep going. 47:43.610 --> 47:46.550 So we will resume this with R. 47:50.560 --> 47:56.290 And then let's do... let's do mask... no, we don't want maskgen, we want rulegen. 47:58.640 --> 48:00.360 So... uh-oh. 48:00.380 --> 48:04.660 I don't think pack is Python 3. 48:08.140 --> 48:10.980 That doesn't look like it to me. 48:11.420 --> 48:13.240 We'll try it. 48:15.540 --> 48:17.140 Yeah, I didn't think so. 48:17.140 --> 48:17.740 Okay. 48:17.740 --> 48:18.120 So we're going to do... 48:20.940 --> 48:24.420 app.cache.search.python2. 49:00.720 --> 49:03.140 No module named enchant. 49:03.800 --> 49:10.500 So probably the pip to install enchant. 49:18.680 --> 49:21.100 We don't even have pip. 49:24.070 --> 49:25.830 Oh no. 49:26.370 --> 49:28.470 It's all going to hell. 49:35.800 --> 49:37.160 What? 49:49.810 --> 49:54.390 Python 2 doesn't have... that was pip.whl. 49:54.730 --> 49:56.510 No, let's do it. 50:08.010 --> 50:10.050 Yeah, it ain't there, man. 50:11.030 --> 50:19.890 app.install.python.tack.pip. 50:31.790 --> 50:36.110 We need to summon ifelix to port pack to Python 3. 52:04.540 --> 52:06.700 What provides enchant now? 52:25.160 --> 52:26.380 Python 3 enchant? 52:26.380 --> 52:27.840 No, Python 2 enchant. 52:27.840 --> 52:29.660 What happens if we do that? 52:52.620 --> 52:54.340 Oh, it's pyenchant. 52:55.480 --> 52:57.160 Let me smart. 53:09.510 --> 53:11.080 Enchant C library. 53:11.490 --> 53:12.630 Okay. 53:21.480 --> 53:24.320 lib enchant dove. 53:35.350 --> 53:42.690 Yeah, it kind of looks like they may have pulled it, but we're working around it. 53:45.170 --> 53:46.650 Where are we at? 53:50.400 --> 53:52.980 Going slowly, but we're still going. 53:52.980 --> 53:53.480 Okay. 54:04.010 --> 54:06.170 Okay, we did it. 54:07.990 --> 54:09.010 All right. 54:09.390 --> 54:23.950 So we want to run statsgen on our dictionary. 54:26.170 --> 54:28.530 So that was pot.dict. 54:28.950 --> 54:30.810 We'll let it do its thing. 54:57.020 --> 54:59.020 All right, so we've got... 54:59.020 --> 55:00.560 So these aren't going to help us too much. 55:00.560 --> 55:01.660 I mean, they might... 55:01.660 --> 55:07.460 We could probably run these and get something out of them, but we're kind of unlikely to. 55:10.620 --> 55:15.560 But that's a good example of extracting masks out of dumps that you... 55:15.560 --> 55:17.480 Or not dumps, but cracks that you've done. 55:17.480 --> 55:22.880 So we could take these right here and put them in a new file and then start running them. 55:26.080 --> 55:31.600 But what I want to do is... 55:33.400 --> 55:34.820 Do we have our analysis? 55:35.780 --> 55:37.120 No, we don't. 55:39.600 --> 55:41.400 Why do we not have our analysis? 55:44.590 --> 55:45.990 No, because we didn't output them. 55:45.990 --> 55:46.770 That's why. 55:53.320 --> 55:55.280 So let's write that to masks.out. 56:18.610 --> 56:20.910 All right, and then we'll feed that into maskgen. 56:33.830 --> 56:36.070 I wonder what the math he based. 56:36.070 --> 56:40.290 So that's on a billion per second. 56:41.770 --> 56:43.370 I don't think we're going to be able to... 56:44.750 --> 56:47.650 I don't think we're going to be able to cover that in this stream. 56:52.040 --> 56:53.700 Let's do rulegen though. 56:55.560 --> 56:58.020 And we'll just generate some rules. 57:06.320 --> 57:07.580 Excuse me? 57:38.030 --> 57:42.010 So how does that work for maskgen, but not for rulegen? 57:42.170 --> 57:46.190 Or was it statsgen that failed before? 57:46.190 --> 57:47.990 I don't even remember anymore. 58:30.210 --> 58:32.890 I guess I just forgot to redo it. 58:33.790 --> 58:38.790 Okay, so let's take a look at our options here. 58:38.790 --> 58:41.230 We can make that a little bit smaller. 58:46.810 --> 58:49.710 Take the defaults on everything. 59:36.880 --> 59:38.460 We're going through pack. 59:39.320 --> 59:40.480 Generating some rules. 59:40.480 --> 59:53.460 We've cracked about, I want to say, close to 30% of Rocky right now using nothing but masks, rules, and passwords that we've cracked from those. 01:00:02.820 --> 01:00:06.520 Pack's going to take its sweet time because, you know... 01:00:51.560 --> 01:00:56.200 So pack needs to run through about four and a half million candidates. 01:00:56.200 --> 01:00:57.840 So this is going to take a little bit. 01:00:57.880 --> 01:01:00.780 So we'll let that run down there and we'll let our path while masks keep running. 01:01:09.820 --> 01:01:11.740 The old Minga special. 01:01:12.080 --> 01:01:16.900 You know, this card has like 13 gig of video memory. 01:01:16.900 --> 01:01:18.280 We'd probably be fine. 01:01:19.920 --> 01:01:21.000 Let's do it. 01:01:21.000 --> 01:01:22.020 I ain't scared. 01:01:49.690 --> 01:01:51.150 Right, yeah. 01:01:57.410 --> 01:01:59.930 That dictionary just grew massively for pack. 01:01:59.930 --> 01:02:02.110 So , oh well, it'll get over it. 01:02:22.460 --> 01:02:23.360 Okay. 01:02:26.300 --> 01:02:34.470 So we're gonna do rocky.hash. 01:02:34.490 --> 01:02:35.570 What'd you want? 01:02:35.570 --> 01:02:38.230 You wanted the pot.dict. 01:02:40.350 --> 01:02:44.090 One, two, three, four, five, six. 01:02:44.090 --> 01:02:45.650 All right, here we go. 01:03:06.500 --> 01:03:10.300 So we're auto-generating just shy of a million rules. 01:03:10.300 --> 01:03:13.740 And we're going to run that against every... 01:03:17.600 --> 01:03:18.260 What? 01:03:18.840 --> 01:03:19.840 Because. 01:03:20.120 --> 01:03:21.640 Because I don't want to. 01:03:32.050 --> 01:03:33.310 What if there's... 01:03:33.310 --> 01:03:38.550 What if there is a 65 character password in here? 01:03:40.820 --> 01:03:42.240 I want it. 01:03:42.260 --> 01:03:44.340 And I'm not going to get that with taco. 01:03:50.940 --> 01:03:52.540 Why no w4? 01:03:52.540 --> 01:03:55.360 Yeah, that's a good question. 01:03:56.180 --> 01:03:57.860 Because I'm trying to run pack. 01:03:57.860 --> 01:03:58.840 That's why. 01:04:00.620 --> 01:04:03.660 I would like this box to actually remain accessible. 01:04:04.700 --> 01:04:05.580 I don't... 01:04:05.580 --> 01:04:06.360 You know what, dude? 01:04:06.360 --> 01:04:09.280 My armpits smell like free birds right now. 01:04:09.280 --> 01:04:10.340 It smells delicious. 01:04:16.820 --> 01:04:18.640 Nope, that's too close. 01:04:18.640 --> 01:04:21.140 Oh, well, you're throwing prints in there. 01:04:23.340 --> 01:04:25.100 That's a little close to cheating. 01:04:25.100 --> 01:04:25.960 We don't want to use... 01:04:25.960 --> 01:04:29.720 We don't want to use rocky.hash to crack rocky.hash. 01:04:29.720 --> 01:04:31.940 That kind of defeats the purpose. 01:04:42.320 --> 01:04:43.280 If we did that... 01:04:45.300 --> 01:04:47.540 Imagine Rocky just came out, right? 01:04:47.540 --> 01:04:53.300 Like we're all we're all fawning over the fact that we have 14.3 million hashes and we want to crack them. 01:04:53.520 --> 01:04:54.600 We wouldn't have that. 01:04:54.600 --> 01:04:56.860 We wouldn't know what rules Rocky was using. 01:04:56.860 --> 01:04:58.400 It's totally unfair. 01:05:01.170 --> 01:05:06.750 It's like walking in to do a pen test with a domain admin account and then claiming you own the entire network. 01:05:06.750 --> 01:05:07.810 Get out of here. 01:05:25.570 --> 01:05:26.690 Almost at 20... 01:05:26.690 --> 01:05:28.030 Almost at 25. 01:05:28.990 --> 01:05:30.150 We can do it. 01:05:36.100 --> 01:05:37.640 Do you put on your Bon Jovi? 01:05:37.640 --> 01:05:38.460 Let's go. 01:06:03.670 --> 01:06:06.410 It probably would have been smarter to write the cracks to a file. 01:06:06.410 --> 01:06:07.930 So this would go a little bit quicker. 01:06:07.930 --> 01:06:14.370 But it's also a little less interesting because then you just sit there and look at a status screen updating every 20 seconds. 01:06:39.380 --> 01:06:42.680 See, but this looks like it could actually be an interesting mask to run. 01:06:44.960 --> 01:06:47.200 So we've got a big string of these. 01:06:50.880 --> 01:06:52.260 There's some with E. 01:06:52.260 --> 01:06:57.620 Let's try doing a lower in six digits. 01:07:04.540 --> 01:07:06.180 So we'll do A3. 01:07:06.180 --> 01:07:10.660 We're going to do lower 2, 3, 4, 5, 6. 01:07:10.660 --> 01:07:20.480 And then just in case there's some that are maybe five, we'll do increment. 01:07:20.520 --> 01:07:22.680 And we're actually going to write these to 01:07:26.700 --> 01:07:30.360 rocky.out, because this should run fast enough, it won't matter. 01:08:02.260 --> 01:08:03.140 Better? 01:08:29.810 --> 01:08:32.430 All right, so 25, 21. 01:08:33.970 --> 01:08:35.750 So we're definitely getting cracks. 01:08:35.750 --> 01:08:43.990 So we started at 25.07, so we got, what, 14 or 0.14% out of that. 01:08:44.790 --> 01:08:46.830 That's not as good as I thought it would be. 01:08:47.050 --> 01:08:48.490 This is more... this one was more fun. 01:08:48.490 --> 01:08:51.530 Actually, let's not even do that yet. 01:08:53.630 --> 01:08:55.770 Let's roll our cracks back in. 01:09:01.900 --> 01:09:04.540 And this is pot.dict. 01:09:11.740 --> 01:09:13.360 I'm going to sort u. 01:10:36.880 --> 01:10:39.080 Did that just say it's close to the end? 01:11:46.710 --> 01:11:49.690 We need to roll the old hashes back in too, though. 01:14:45.830 --> 01:14:47.330 Dude, is this going to finish? 01:14:48.870 --> 01:14:50.350 In nine hours? 01:14:50.590 --> 01:14:51.970 Oh my god. 01:14:55.520 --> 01:14:57.180 Ain't nobody got time for that. 01:15:00.900 --> 01:15:02.740 Once pack's done, we'll... 01:15:02.740 --> 01:15:03.460 Actually, you know what? 01:15:03.460 --> 01:15:05.100 If I kill this pack, we'll go faster. 01:15:05.100 --> 01:15:09.600 So we'll let pack do its thing, and then we'll run the pack rules. 01:15:34.000 --> 01:15:34.900 Now, you know what? 01:15:34.900 --> 01:15:37.780 I want to run... 01:15:38.220 --> 01:15:39.020 What was that? 01:15:39.020 --> 01:15:41.380 Lower, one, two, three. 01:15:41.580 --> 01:15:42.560 We already do this? 01:15:44.760 --> 01:15:45.980 I think we did. 01:15:46.300 --> 01:15:48.240 Let's do the opposite of that. 01:15:48.240 --> 01:15:52.360 So we've got this one, which seems to be doing a thing. 01:15:52.980 --> 01:15:56.660 One, two, three, four, five, six, lower. 01:15:57.020 --> 01:16:00.640 One, two, three, four, five, six, lower. 01:17:15.900 --> 01:17:16.640 Uh-oh. 01:17:16.640 --> 01:17:17.700 Did we break it? 01:17:37.090 --> 01:17:38.550 I think it's broken. 01:17:55.520 --> 01:18:02.640 We ran out of memory because pack is trying to do four million rules. 01:18:04.020 --> 01:18:04.720 Yeah. 01:18:09.000 --> 01:18:10.900 I need a sad trombone. 01:18:25.070 --> 01:18:26.710 Should've let pack finish. 01:18:27.610 --> 01:18:28.690 Oh shit. 01:18:48.260 --> 01:18:50.260 Well, we didn't do too bad before we crashed. 01:18:50.260 --> 01:18:51.100 I mean, I can't even... 01:18:51.100 --> 01:18:52.260 I can't even scroll. 01:18:52.260 --> 01:18:52.940 Like, this thing is... 01:18:54.100 --> 01:18:55.440 This thing is toast. 01:18:58.700 --> 01:18:59.420 So we did... 01:19:00.900 --> 01:19:02.160 What do we have here? 01:19:03.620 --> 01:19:05.700 2.9, so we're at three million there. 01:19:05.700 --> 01:19:09.220 And then we trimmed out about three million. 01:19:09.220 --> 01:19:09.860 So we cracked about... 01:19:12.600 --> 01:19:16.260 Well, I guess that would be almost 50% then, right? 01:19:17.240 --> 01:19:25.900 So we've cracked half of Rock You in an hour and 19 minutes using nothing but masks and a couple word lists. 01:19:25.900 --> 01:19:28.820 I think we used the English dictionary. 01:19:29.100 --> 01:19:31.900 Got a bunch of stuff with some hybrid attacks. 01:19:34.560 --> 01:19:37.080 Did some mask attacks with digits. 01:19:38.160 --> 01:19:41.460 Because for whatever reason, Rock You has a million digit passwords. 01:20:31.480 --> 01:20:33.380 No, this is it. 01:20:34.100 --> 01:20:34.800 You have to... 01:20:35.860 --> 01:20:37.420 Britney Spears forum. 01:20:44.110 --> 01:20:45.950 Oh shit, we're back. 01:20:49.960 --> 01:20:51.300 Pack did its thing. 01:21:01.180 --> 01:21:02.640 Really inopportune time, too. 01:21:02.640 --> 01:21:04.220 I just shoved food in my mouth. 01:21:07.380 --> 01:21:12.660 All right, so pack went and took a look at all the words that we had in our word list. 01:21:12.660 --> 01:21:16.620 And I built a rule set out of that. 01:21:17.960 --> 01:21:19.560 And then it sorted that rule set. 01:21:19.560 --> 01:21:24.150 So we can take this analysisSorted.rule and feed this in on our... 01:21:28.440 --> 01:21:30.700 feed this in using our pot.dict. 01:21:31.300 --> 01:21:33.320 We should get a shit ton of cracks. 01:21:33.540 --> 01:21:34.620 Let's see what happens. 01:21:45.220 --> 01:21:51.840 pot.dict techr pack analysisSorted rule 01:23:17.500 --> 01:23:17.760 . 01:23:18.340 --> 01:23:24.640 No, and we don't have to cover those because hashcat defaults to MD5 as it's... 01:23:26.540 --> 01:23:29.060 It defaults to MD5 as the hash type. 01:23:29.060 --> 01:23:31.580 And since we're running MD5s, we don't need to worry about it. 01:23:31.580 --> 01:23:39.480 And because we're still doing dictionary attacks, we don't need to specify A because the default value is to do a dictionary attack. 01:23:39.800 --> 01:23:44.440 So adding rules to a dictionary is still a dictionary attack. 01:23:45.640 --> 01:23:47.620 It's just mangled by rules. 01:24:01.600 --> 01:24:04.380 I mean, at this point, we might just crack everything. 01:24:49.430 --> 01:24:52.090 I think I just saw my password fly by too. 01:24:56.750 --> 01:24:59.190 The hell's with the 727s? 01:25:00.950 --> 01:25:03.050 A bunch of Boeing fans at Rocky. 01:25:51.280 --> 01:25:52.820 Yeah, I saw that. 01:26:33.680 --> 01:26:34.960 I think so. 01:26:38.020 --> 01:26:39.240 Let's do it. 01:26:53.410 --> 01:26:56.730 And if only that were the case. 01:26:57.650 --> 01:27:00.370 All right, so password.dict. 01:27:00.370 --> 01:27:03.010 And then we're going to run... 01:27:04.030 --> 01:27:05.930 We're not going to run pack again because... 01:27:07.890 --> 01:27:09.190 No. 01:27:10.730 --> 01:27:17.530 And we want analysis rule sorted. 01:27:58.360 --> 01:28:00.940 I would laugh if this got nothing. 01:28:02.700 --> 01:28:05.680 I think it did it. 01:28:09.780 --> 01:28:11.520 2787, yeah. 01:28:15.940 --> 01:28:17.860 Good work, Manga, you got nothing. 01:29:05.540 --> 01:29:06.420 I don't know. 01:29:06.420 --> 01:29:10.040 It's only one word, why would it have queued? 01:29:10.040 --> 01:29:11.920 Maybe because it split the workload? 01:29:20.340 --> 01:29:21.720 No, there's an R. 01:29:22.920 --> 01:29:24.020 Oh, wait. 01:29:33.520 --> 01:29:34.640 All right. 01:30:00.700 --> 01:30:02.100 Yeah, yeah, yeah. 01:30:04.870 --> 01:30:06.310 I missed an R. 01:30:55.140 --> 01:30:56.300 What was that? 01:30:56.340 --> 01:30:58.760 Two percent, roughly. 01:31:03.600 --> 01:31:07.260 2787 to 3074, almost three percent. 01:31:11.370 --> 01:31:12.330 Now, what if... 01:31:16.220 --> 01:31:19.740 I don't want to do the whole thing because that's going to take way too long. 01:31:22.080 --> 01:31:23.020 What if 01:31:41.860 --> 01:31:45.640 s -w-o-r-d... 01:31:49.050 --> 01:31:50.650 We'll do two to start. 01:31:50.650 --> 01:31:52.050 No, we'll do one to start. 01:31:57.850 --> 01:31:59.230 Forgetting all kinds of stuff. 01:31:59.610 --> 01:32:00.110 I 01:32:36.230 --> 01:32:42.170 probably should have done this as increment because these startup times are getting a bit ridiculous. 01:33:05.970 --> 01:33:07.630 Word pass. 01:33:10.230 --> 01:33:12.310 No one will ever guess. 01:34:27.300 --> 01:34:28.620 Oh, we're getting faster. 01:34:28.620 --> 01:34:33.800 We're up to 500 million, almost 500 million. 01:35:12.460 --> 01:35:15.080 Yeah, drosap, drosap's always a good one. 01:40:21.720 --> 01:40:24.040 I mean, that did pretty good. 01:40:29.280 --> 01:40:30.080 Nope. 01:40:30.080 --> 01:40:33.920 So that doesn't matter because we already specified it here. 01:40:48.260 --> 01:40:51.100 Let's run it out a few more characters and see what it gets. 01:41:05.760 --> 01:41:12.080 Something that would have been smart is if we did the lowercase o, the uppercase o, and then a zero. 01:41:12.460 --> 01:41:16.640 And then for i, we do lower i, upper i, and a one. 01:41:19.660 --> 01:41:21.220 Run that file. 01:41:21.680 --> 01:41:23.680 Yeah, I did that. 01:41:24.680 --> 01:41:28.860 We ran the top 100 pathway masks. 01:41:46.660 --> 01:41:48.000 Yeah, yeah, yeah. 01:41:48.000 --> 01:41:49.440 I'm not doing that. 01:41:49.440 --> 01:41:51.140 Dude, on a Tesla? 01:41:52.720 --> 01:41:53.600 No. 01:42:24.500 --> 01:42:27.440 All right, after this one, we'll run it. 01:42:28.640 --> 01:42:29.860 That's going to take 10 minutes. 01:42:29.860 --> 01:42:30.920 I don't want to do that. 01:42:31.900 --> 01:42:41.380 If you're over there analyzing what the fastest thing you can run to crack as much as you can, be disappointed. 01:42:41.780 --> 01:42:43.000 So what do we have? 01:42:43.000 --> 01:42:52.660 So we have A3 incrementing from a minimum of 8 with a runtime of 17 seconds. 01:42:52.660 --> 01:42:58.380 We have 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11. 01:42:58.380 --> 01:42:59.200 Okay. 01:43:03.760 --> 01:43:05.340 Oh, this changed. 01:43:18.420 --> 01:43:21.340 Yeah, increment min. 01:44:44.500 --> 01:44:48.660 Yeah, the tools haven't been updated in a while though. 01:45:12.860 --> 01:45:26.780 I don't know, I mean, there comes a point where, you know, you get used to or you've already generated the things that you need to generate, and you've already found other ways of doing something that you don't need to pull the tools back into it. 01:45:28.680 --> 01:45:31.280 Yeah, no, I still pwmin. 01:45:40.780 --> 01:45:44.800 I mean, hell, I didn't even catch it when you typed it and typed it myself, so, you know. 01:46:31.470 --> 01:46:36.790 It's not cheating that much because we're still running the attacks. 01:46:36.790 --> 01:46:38.090 Yeah, yeah, I know. 01:46:39.010 --> 01:46:45.930 But there's a very big difference between, let's use the rules generated from RockYou against RockYou versus hcstat. 01:46:51.400 --> 01:46:52.780 Because you still have to base... 01:46:52.780 --> 01:46:55.440 You still have to get your baseline in before you do that. 01:46:55.660 --> 01:46:56.720 It is cheating. 01:47:00.370 --> 01:47:01.770 That's why we regenerated... 01:47:03.430 --> 01:47:05.470 We regenerated the rule set down here. 01:47:13.280 --> 01:47:15.140 Yeah, yeah. 01:47:27.620 --> 01:47:28.980 Oh, no, no, no, no. 01:47:32.470 --> 01:47:42.480 But I'm done in about 30 seconds anyway because it's 11 o'clock and I want to take a break from sitting here. 01:48:18.980 --> 01:48:26.620 All right, so we did 4.4 million plus... 01:48:38.030 --> 01:48:39.830 Math is hard. 01:48:39.970 --> 01:48:45.010 One, four, three, four, four, three, nine, one, minus... 01:48:50.270 --> 01:48:55.390 One, one, nine, two, five, two, five, four, seven, two. 01:49:03.550 --> 01:49:08.730 So, four, that's 5.8 million. 01:49:09.250 --> 01:49:12.950 So we did just under 50% in an hour and 40 minutes. 01:49:14.090 --> 01:49:15.590 It's pretty good. 01:49:20.990 --> 01:49:22.410 So I'm gonna blow this box away. 01:49:22.410 --> 01:49:23.410 That was fun. 01:49:24.870 --> 01:49:28.010 Maybe tomorrow we can do something similar. 01:49:28.010 --> 01:49:28.750 I'll save the... 01:49:28.750 --> 01:49:30.950 I'll save the cracks, but we'll see. 01:49:30.950 --> 01:49:32.490 Saturday night's gonna be crazy. 01:49:32.610 --> 01:49:33.630 Anyway, that's it for now. 01:49:33.630 --> 01:49:34.210 Thanks, guys.