start	end	text
990	9010	All right, we're back. And this is our co-worker. So we felt that we had to give him a quick
9010	14430	introduction because, you know, where would we be if we didn't give him this introduction? So,
14430	20030	you know, this is a statement that Lee asked me to write, that he asked me to prepare for him
20030	25670	before this talk. So this is the direct quote from Lee. So he says, what did you just say about me,
25670	30090	you hecking cowboy? I'll have you know I graduated top of my class in the Hashtag University. I've
30090	34990	been involved in numerous secret pull requests of the Hashcat code repository, and I have over
34990	41210	300 GPUs in my basement. I'm trained in guerrilla password cracking tactics, and I'm the top
41210	46430	contributor to hashes.org in the entire US. You are nothing to me but just another dictionary.
46450	50930	I'll wipe you out with the precision mask attacks like the witch I've never been seen on this earth.
50930	55150	Mark my hecking words. You think you can get away with these pull requests? Think again, cowboy.
55150	59610	As we speak, I am contacting my secret network of GPUs across the USA, and your IP is being
59610	64310	traced right now. So you better prepare for the storm. The cluster that wipes off your pathetic
64310	69230	little thing you call your password. You're cracked, kid. I can crack your password anytime,
69230	74030	and I can use it in over 700 ways, and that's not even including my FPGA. Not only am I extensively
74030	78530	trained in password-free combat, but I also have access to the entire arsenal of your crypto miner
78530	82530	underground. We'll use it to the full extent to wipe your miserable password off the face of the
83230	90850	little hacker. Please welcome the password king, Lee. Welcome to Hashes, Smothered, Covered,
90850	96930	and Scattered. Modern password cracking as a methodology. My name is Lee Wangenheim. I'm a
96930	102750	security consultant here at Optiv. I hack things for fun as well as for a job. If I wasn't getting
102750	108630	paid to do this, I'd be doing it on my own anyway. I've got about five years of InfoSec experience,
108630	113810	mostly focused on the offensive side of the house, and currently I'm helping to run the
113810	122110	crackers that we've got here at Optiv. So why does this matter? Because it only takes one password,
122110	131610	and as we know, people tend to use weak passwords. Some examples that we've seen on actual gigs are
131610	137990	using default passwords for Cisco devices, Microsoft SQL Server. I've even seen iDRAC
137990	146750	accounts using the default root and Kelvin, and everybody's familiar with the fall 2019,
146750	155410	or I guess now it would be summer 2020. This is a real issue, and we run into it more often than
155410	161150	not. Once we've got one foothold into your network, we can use that to move laterally as much as we
161150	170450	want. Some of the hardware that we're using. So we used to use CPUs and Rainbow Tables. CPUs,
170450	176230	not really working, not really worth it anymore. They've kind of been overpassed now that the
176230	181910	modern GPU rigs are out there. We used to use a lot of Rainbow Tables to look up, especially in
181910	188330	NTLM and more common hash types. However, those have been kind of supplanted by the new GPU
189290	196070	cracking machines. The reason behind that is it's actually faster to use a GPU to crack the hashes
196840	203510	via brute force attack than it is to try and do a Rainbow Table lookup. Because again,
203510	210250	you're burning CPU cycles doing Rainbow Table lookups versus GPU cycles with the new
211790	221890	modern GPU setups. We do sometimes use cloud using the AWS boxes, the new GPU boxes.
222310	227650	Those are pretty handy. They are expensive. However, if you do need to throw a lot of power
227650	234790	at a hash or a series of hashes, it can be beneficial to go ahead and do that.
235350	241110	Sometimes if we're on site and clients don't want their hashes leaving, or if we're on a Wi-Fi gig
241110	247850	or something like that, we will use a laptop. Typically, a gaming laptop will do better,
247850	256880	but you use what you have, right? If you do happen to still be running a mining rig in 2020,
257530	266740	you know, for some of the GPU mining rig, GPU crypto algorithms such as Ethereum,
266740	273060	you can use those. And, you know, you can always make a little bit of your money back.
273060	280940	I don't do any more mining, so I don't know exactly how useful that is in today's world.
284090	290870	So talking about AWS, some of the engagements that we do run here at Optiv are
292350	297530	more of an enterprise security assessment, which is where we'll have a company provide
297530	303570	every hash throughout their Windows domain. And then we will throw as many resources as we can
303570	309670	over a certain amount of time, usually about two weeks of just letting the crackers run.
310190	314010	And we'll try and crack as many of their passwords as we possibly can.
314270	320070	That kind of engagement is sort of where this methodology really was born out of,
320070	324210	as well as some of the tools that we've built internally that I'll be talking about later
325030	336170	have come from. So this is sort of where the cloud is as of 2017. Unfortunately,
336170	341070	we don't have too many updated stats, but it's just about the same.
341350	350090	So it used to be about $0.14 per gigahash hour, and now it's close to $0.03 per gigahash hour.
350090	357850	Now we do have our internal crackers, which you can see are running at about $0.07 per gigahash
357850	366150	hour. And we built those for about $25,000. So if you're working for a large consulting firm,
366170	373230	that has the capital to invest in their onsite cracking machine, you can absolutely save money
373230	379990	by doing that. However, if you're either like a small time consulting firm, or you're doing this
379990	388930	as kind of like a single contractor or something like that, absolutely look into some of the AWS
389630	400090	machines. So the P316 is currently the largest instance that you can get with GPUs.
400950	407030	So and so yeah, that's going to be kind of the best thing for your buck if you're looking to
407030	413110	throw a lot of power, as well as using a new tool that we'll touch on in a little bit called
413110	420310	Hashtopolis, which allows you to do distributed cracking, by attaching multiple versions of those
421370	427670	multiple instances of Hashcat together. And Hashtopolis kind of acts as an orchestration
427670	432690	engine handling the binaries and farming jobs out across all of those different
433970	440270	those different platforms, which will allow you to combine both your in house and your cloud
440270	446890	cloud instances, and really start throwing massive amounts of power.
447370	452230	You just do have to keep in mind that everything will come with a cost.
452230	456730	Hashtopolis is free, AWS instances are definitely not.
458170	465310	So this slide is shamelessly borrowed from the Terahash Corporation. They run the Brutalis,
465310	471890	or they produce the Brutalis machines. So currently, you can see their largest one
471890	482410	is running 448 NVIDIA RTX 2080s. So if you're looking at running against like running a brute
482410	492610	force attack, you're talking, doing the entire eight character key space, you know, instantly.
492610	501170	Um, so a character passwords are absolutely in 2020 dead. I gave a version of this talk in 2019
501170	509450	and said that they're dead. The same was true in 2018. It's definitely true now. The amount
509450	517470	of power that firms are able to throw at brute forcing, especially in TLM hashes, is just
517470	527390	absolutely incredible at this point. And so really you want to work on, you know, instructing
527390	534010	your, your individuals to have, you know, strong 12 character passwords. As you can see, the
534010	540230	exponential growth is just incredible. So you have from an 11 character password to a 12 character
540230	545830	password, it goes from a two week crack time on an NTLM hash to a three year crack time.
545830	552070	And, you know, this is obviously assuming that that password is not going to be in any sort of
552210	559970	a word list or any sort of a mask that, that we can create. So just so that we're all speaking
559970	564310	the same language, I'll go over a few key terms, some of which you've probably heard me using
564850	569590	previously in this talk. And, you know, I'll continue to use throughout the talk.
570260	575810	So masks are the makeup of a word broken into its character set. This is pretty important
575810	580910	because this is, so for instance, if you had a password one with a capital P
581680	591350	and then all lowercase letters, and then a one, the mask is going to be, you know, capital letter,
592370	596230	seven lowercase letters, and then one digit.
596850	600110	This becomes really important when you're talking about
601550	607310	attacking large numbers of passwords, as you can sort of guess at the makeup of people's passwords.
607730	611950	For instance, if I told somebody that they're going to make, they need to make a 12 character
611950	621690	password that has a capital letter, lowercase letters, and digits, the vast majority of English
621690	627150	speaking individuals are going to create a password that starts with a capital letter,
627150	635070	has, you know, 10 or 11 lowercase letters, and then has trailing digits, you know, password one,
635070	643110	summer 2020, you know, we've all seen all of those on engagements. It's very, very common.
643110	649390	Very rarely will you see them shift where the middle characters have your uppercasing
650250	655030	or things like that. It's kind of attacking that human psychology and the human
656190	661950	linguistics of how we form words, especially in the English speaking. I did read a very
661950	669170	interesting article written by a linguistics professor that kind of touched on differences
669170	674650	that you'll see in Asian languages, especially in also some of the Cyrillic languages as far
674650	679970	as password creation and the different masks that we'll see. Unfortunately, I haven't worked
679970	688610	too many, well, I haven't worked any engagements that really leaned heavily on anything other than
689000	694810	the typical English character set. So that's where my main focus is, especially when it comes
694810	701610	to password cracking. Hybrid attack is where you're going to be brute forcing. So again,
701610	708870	brute forcing is just guessing every possible combination inside the character space. So
708870	716870	A through Z, digits zero through nine, and then all of your special characters. So if I have
716870	724090	eight character passwords, I would start with eight A's and then seven A's and a B, and then
724090	730730	continue to work my way through as I've tried every single character set that we can against
730730	736870	those hashes until we get a match. So a hybrid attack is going to use that brute force attack,
736870	745370	and then you would take a mask and either append or prepend. So if you had, say, a
745370	754710	company name, or if you knew that they had something like a five character password,
754710	760450	and you wanted to try adding the year to the end of it. So you would do brute force
760450	766030	all character sets for five characters and then add the year on the end of it
766030	776990	as the hybrid attack. So the year would be your either append or prepend.
777250	783010	So a word list is much different than a password dump. So a word list, and this is a very
783010	787870	important distinction, a word list is the candidate of words that you're going to either run by
787870	794210	themselves or be modified with rules. So these are going to be dictionary words. This is not
794210	800690	supposed to be a password dump. So the difference being a password dump is going to be passwords
800690	807070	that have already been cracked, whereas a word list is going to be basic words like summer or
807070	815230	spring. And then you can use those words and then modify them via rules in Hashcat to create
815870	823230	different candidates for cracking. If you take a password dump that has like summer 2020 and apply
823230	828690	rules to it in Hashcat, sometimes those rules will either append or prepend
829470	837110	different character sets. So you might get summer 2020 2020 using summer 2020 in a password dump
837830	842370	as a word list. So that would be the distinction there.
845150	849270	So this is one of my favorite quotes, if your only tool is a hammer then every problem looks
849270	856810	like a nail. Obviously Mark Twain. And so that's what we'll touch on here in a minute.
860010	867690	This is the kit that we use. I'll go into what each of these tools does in the next few slides.
871970	878090	So Hashcat, it's now the de facto standard as far as password cracking is concerned. It supports
878090	885070	just about every hash imaginable. I believe they fixed it, but there was one time that I did have a
885070	891290	weird zip file that I did have to use John the Ripper on. But I've never really encountered
892270	898950	anything on an engagement that Hashcat can't really do. John the Ripper was the de facto
898950	905950	standard five to ten years ago. Again, it uses the CPU cracking. Hashcat is
907450	917650	using GPUs. It's very, very well maintained, constantly updated, and lots of improvements.
917650	924830	Super easy to set up and to integrate with other tools. Also, there's so much information
924830	929210	and documentation out there about using Hashcat. So if you ever have issues, you can always
929210	938890	look it up and usually find the answer. Hashtopolis, this is what we've been using
938890	945770	to kind of integrate our distributed cracking operations. So this is a wrapper for Hashcat.
945770	950810	What it does is it manages agents, jobs, word lists, and Hashcat binaries. So basically,
950810	956690	you log into a web portal via Hashtopolis, and it goes and connects to all the different
956690	963370	Hashcat instances that you've connected to it. You feed it a list of hashes, and you tell it
963370	970630	to crack. And then it goes and farms all of this out to those different Hashcat instances
971490	977450	and does all of the work for you, basically. The other great thing is if there's a new
977450	981830	Hashcat binary that comes out, you can push an update to all of your distributed
983090	990690	instances via Hashtopolis. So for instance, if you have a bunch of AWS instances spun up,
990690	998090	and you wanted to quickly spin up new ones or push a new binary, you can do that very,
998090	1004090	very easily within Hashtopolis. We don't use this a lot. This is really more
1004090	1010570	for those big enterprise engagements, only because the cost of running a lot of distributed
1010570	1018790	AWS instances does become prohibitive, especially if we're just looking for cracking a Kerberos
1018790	1025770	hash or things that we can typically do on our internal cracking machines.
1026570	1035330	Hash ID. So this used to be a lot more useful. It's not the most useful anymore.
1035710	1040890	If you're having trouble identifying what kind of a hash you've caught, so you find a list of
1040890	1050770	hashes on a client gig, and you're not quite sure what you've got, you can use this. The nice thing
1050770	1057310	about this is it is offline compared to some of the online systems that you can drop hashes into.
1057310	1067850	So if you're trying to keep sensitive data off the internet, you can do it. If Hash ID isn't
1067850	1075650	working for you, and you've got a new kind of hash that you're not sure on, if there's open source
1075650	1080710	code on GitHub, you might be able to see what kind of a hashing algorithm it's using. So if
1080710	1089350	you get it off of a new web application, you can always try and create your own hash
1090270	1098150	and see if you can also self-register. So if you somehow get into a database backend
1098150	1103350	and you're able to self-register on the web application,
1103350	1110750	so you could create a password of password one, and then go try and crack that password that you
1110750	1117010	know the password, and try and figure out what kind of a hash it is from there by throwing
1117010	1125950	different kind of hashes at it. PwSpy is a tool that was built internally for Optive, but it is
1125950	1132750	open source. Some of the cool things that it will do is it will go out and find the most common
1132750	1139710	masks for you. So if you're cracking, you know, again, 20,000 passwords, and you've cracked,
1139710	1147470	say, 40% of them on your first pass through, you can have PwSpy analyze those hashes for you,
1147470	1154090	and it will go ahead and tell you which masks that you can then plug into Hashcat
1154690	1160190	for potential more success. So say they're having, you know, the client has
1161210	1170050	a 12 character minimum, so you find everybody is running, you know, uppercase letter, you know,
1170050	1177170	10 lowercase letters, and then a digit, or things like that. It will also identify weak passwords,
1177170	1182850	so you can kind of tweak that with some of the settings in there by saying, you know,
1182850	1188210	only words, or only words in a digit, or things like that. It will break out the different
1188210	1193870	password links that you have. It will also pull out different base words. So if, you know, if
1193870	1201530	you're doing a thing, an engagement, and you find that people are using seasons or the client name
1201530	1208330	over and over again to create passwords, you can absolutely use this and show that as evidence to
1208330	1213550	your client to say, you know, maybe you should put a blacklist policy in for different password
1215230	1220830	terms, and things like that. The other thing that it will do is it will
1222810	1229130	analyze and find reused hashes. So if you find multiple people are using the same password,
1229130	1234610	this will identify that, so you could then point that out to the client. You know, it's not usually
1234690	1241570	a big deal if it's summer 2020. It's a big deal, but it's not, you know, a deal with people sharing
1241570	1246950	passwords. But if it's more of a complex password that you find multiple times, that could indicate
1246950	1253130	that people are either sharing their passwords, or somebody's reusing passwords for, say,
1253130	1259530	their local account, and then their administrator account, or, you know, even DA creds, or somewhere
1259530	1270610	in a SQL server. Feel free to go download PwSpy. It's open source, and I've had a lot of people
1270610	1279190	reach out and suggest edits or find bugs. So please, if there's anything, please feel free
1279190	1286830	to either put in a pull request or whatever on GitHub, or reach out to me via Twitter or
1290090	1298130	through GitHub. So some of the techniques that we use. So this is how we kind of hone our skills.
1300170	1304910	So how do you begin? What's the best way to crack a hash? Well, so this is a loaded question to me.
1304990	1310810	I get this a lot from our internal team. It kind of drives me a little bit crazy because
1310810	1317670	it's kind of like asking what's the best way to use nmap. There's no one right answer.
1317670	1326690	So basically, it's kind of an experience, and just depending on the goals of your engagement,
1326690	1332870	what are you looking to do? So are you after one hash? Are you after multiple hashes?
1333270	1339950	You know, the algorithm that you're going after is very, very important. So, you know,
1339950	1346190	until mhash, you're going to be able to throw a lot more power at than WPA2, only because
1346190	1352230	it's a much faster algorithm. So you're going to be able to throw more rules and more word sets.
1352430	1358330	One thing we've done in the past with client engagements is if we're on a wireless gig,
1358330	1363410	and, you know, say we only have a day or two on site, and we know that they're using a pre-shared
1363410	1370030	key, what we'll do is we will have the client provide us that key and create that hash in
1370030	1376550	either an NTLM or an MD5, and then run it against our rule sets and our word list to then
1376550	1381750	demonstrate the impact to that client that says, hey, you know, we didn't have enough time to
1381750	1387530	crack the WPA2 while we were on site. However, we would have cracked it. So, you know, if you
1387530	1392030	have somebody sitting in your parking lot and they capture, they could potentially come back
1392030	1399910	and get into your network that way. And this is, you know, how we did it. So that's one way to
1399910	1413130	kind of work with your clients. So where do you get hashes? You know, always looking for hash dumps.
1413130	1418990	If you can get onto a Linux box and you have root access and you can dump Etsy shadow,
1418990	1425390	comp files are always great. Back-end databases that you can get into.
1425390	1432770	Mimikatz if you encounter like an older Windows system that's not fully patched. Web applications
1433250	1440770	a lot of times will expose hashes, you know, either via misconfigurations or just having
1440770	1447370	their database exposed. We run a lot of Responder or Magnum Metal 6 on internal gigs. I'll do a
1447370	1454190	demo of that in a little bit. DC sync and NTDS, you know, these are some of the common ways to
1454190	1463150	find hashes. There's thousands of ways to find hashes. You know, if you're on a wireless gig
1463150	1469010	and you capture a pre-shared key handshake, you can open up Wireshark and get the PSK
1469010	1474450	hash out of there. There are just many, many different ways to get hashes. These are some
1474450	1480690	good ways to start if you're kind of looking to get into it. I would highly recommend kind of
1480690	1488550	building a local lab, setting up Responder on your local lab or setting up a database,
1488550	1494910	making some hashes, and then just going ahead and trying to crack them. You can also just
1494910	1503830	create a bunch of, you know, NTLM hashes or MD5 hashes via some scripts. So, make a bunch
1503830	1509810	of passwords that you know and test it out in Hashcat. So, that's a good way to get started.
1512010	1518330	So, developing a methodology. So, this is really where our password audit kind of came out of.
1518790	1524850	So, we wanted to create a repeatable process for other people on our team to be able to follow
1524850	1532850	and make it as easy as possible for a new consultant to just kind of get spun up and start
1532850	1539930	working. These are going to be much more analysis based than, you know, hands on the keyboard.
1539930	1546450	This is going to be a lot of, you know, letting the cracker run, using your various rules and
1546450	1552450	masks and all of the stuff that we've discussed previously. Looking at the results and kind of
1552450	1556910	figuring out where you want to go from there. Looking at what their hashes are doing, looking
1556910	1563470	at what the passwords they're using are. Are they a secure company? Are you seeing, you know,
1563630	1568890	a lot of crazy hashes that, you know, you're not able to crack? Or are you seeing a lot of,
1568890	1575550	like, really simple passwords? The other thing we're going to look for is, you know, common words,
1575550	1582810	easy wins. Again, I keep coming back to summer 2020, password one, company name. Company name
1582810	1590830	and the date that it was founded is a really popular one. Street names. If you're in an area,
1590830	1597730	if you're doing a client and there's, you know, a local sports team, you know, I'm from Ohio,
1597730	1604450	so in my area, you know, you can find a lot of Ohio State or Buckeye-related passwords. You know,
1604450	1610630	you could extrapolate that across the country. You know, New England, you could do Patriots or
1610630	1619450	whatever. A lot of... we'll find a lot of times clients will do... will claim that they do their
1619450	1624390	own password audits, but they're not really doing it effectively. You know, they might
1624950	1631770	run Hashcat with like a base word list or like a Rocky or something like that and say that they
1631770	1638290	covered it. You really, for these enterprise engagements, you need heavy-hitting cracking
1638290	1644630	rigs, either built in-house or setting up the cloud. And I would say even just one Amazon
1645950	1651730	P316 is not going to really, you know, pass muster for this. You're going to want to throw
1652590	1660450	a good amount of resources at these, especially if you're talking, you know, 20,000 or more,
1661330	1664210	you know, passwords that you're trying to recover.
1668230	1676130	So what do we do? Again, we go for quick wins. So we run... internally we have some proprietary
1676130	1682630	word lists that we use. It's kind of been tweaked over the years. It has
1684270	1689670	a lot of data from all the different breaches where we've extrapolated common base words,
1689670	1695950	things like that. And we'll run those without rules. And then we will slowly start adding
1695950	1701570	things that increase the time of cracking, but also increase your possibility of cracking more
1701570	1712070	passwords. So we will continue to run newer and newer attacks against the same list of hashes.
1712270	1718070	And, you know, as you'll see in a second, it's kind of the law of diminishing returns. But
1718070	1727150	as we move through the process, we tend to be pretty successful. We do in-house, we have the
1727150	1733930	capability to do a 1-8 character brute force. That takes about 24 hours on our internals crackers.
1734170	1740730	So we can brute force the entire NTLM keyspace within a day. So that's usually about the first
1740730	1747510	day of a password engagement. And then we will run our words, our word lists, and then our rules
1747510	1756970	against things after. You know, we will then use either PWSpy to create different masks,
1756970	1763110	or just use common masks, things like that. And, you know, just kind of moving on and
1763110	1768130	doing more and more advanced attacks as we get closer to the end of the engagement.
1769310	1774870	So this is sort of what, this is actually real data, and this is what our password recovery
1774870	1782290	over time looked like on a recent password assessment. So as you can see, you know, within
1782850	1788530	the first few hours, we cracked the majority of the passwords we were going to crack. And
1788530	1798870	as we moved through, you can see the longer password recovery attempts did yield less results.
1798870	1807730	But out of, I believe this was over, this was about 18,000 passwords, or hashes that we were
1807730	1815990	trying to crack, and we cracked almost 14,000 of them, which is pretty good. You know, that's,
1816710	1822570	that was enough to show an impact to the client. And this is, you know, over about two weeks of
1822570	1826710	letting the crackers run and then doing a lot of that analysis on the back end and tweaking the
1826710	1835290	rules to match what we were seeing. So how to help your future self. This is really important.
1835290	1842150	So you want to have your POP files. We'll typically separate out POP files based on
1843450	1849790	clients, but we also keep a master POP file. That's a historical record of your cracked hashes.
1849790	1853650	It's useful to see if you've already cracked that hash on another engagement. So if you're
1853650	1859090	seeing summer 2020, you're not going to burn cycles trying to crack it again. We'll just try
1859090	1865270	that hash. This obviously doesn't work against salted hashes, but it will work against, you know,
1865270	1874250	NTLM or any of the, you know, MD5 or things like that. Do be really careful about bloat. It can
1874250	1881110	slow down the hash, the process, because it's going to check it against the existing POP file.
1881110	1888310	So for instance, we did have a pretty overzealous analyst on the team who decided to add the
1888310	1899490	entirety of the LinkedIn dump into our POP file. And at the time of the dump, LinkedIn did not have
1899490	1903690	any password restrictions. So you had a lot of four-character passwords or just plain text
1903690	1911090	passwords, which is pretty useless against, you know, enterprise networks that are running either,
1911090	1915230	or 12-character with complexity. So you do want to be careful of that,
1915230	1919910	because you're going to be running each hash against that POP file. And again,
1919910	1927670	you're going to be burning CPU cycles on that. Common masks. So we keep a list of in-house tools
1928430	1935630	that includes the masks that we can copy in to our hashcat commands, as well as creating new masks
1935630	1943730	as we see fit on the engagements. But, you know, the common ones, you know, uppercase letters
1944490	1950370	at the beginning, and then trailing lowercase letters with digits at the end.
1952570	1956270	So now we're going to move into a demo. I'm going to show you sort of
1956270	1961390	what a typical engagement might look like, you know, on a client network.
1964200	1974520	Okay, so for this demo, I have a responder lab built using VirtualBox on my Windows machine.
1974880	1983100	So what I've done is I have set up a domain controller, a firewall appliance, a Kali machine,
1983100	1991300	and a Windows 10 machine. So you can see all of the machines are up and running.
1993460	1999960	What you see here is IPFire is running to route everything together.
2000380	2008340	Windows Server 2012 is currently running to act as the domain controller in the DNS.
2008360	2013560	Obviously Kali, which is going to be our attacking machine, and then the WinEval
2013560	2031110	is going to be your Windows 10 simulating a client computer. Okay, so closing that out.
2031950	2037090	We just want to verify once again that we are on the same network so we can see
2038510	2045990	both of these hosts are actually networked together on the same subnet. So we'll go ahead
2045990	2056350	and start up Responder here. So when you start up Responder, you have to feed it the interface
2056350	2066450	that you're using. So what Responder is doing is poisoning the LL, MNR, and NBTNS requests that
2066450	2072990	Windows machines will set out. This happens if Windows can't resolve a hostname using DNS.
2072990	2079890	It will send broadcast traffic out asking for that information. So Responder kind of
2079890	2088530	into the middle between a domain controller and the Windows machine and will
2090790	2098670	respond with the information that they're requesting. But it will then ask that Windows
2098670	2106590	machine to send its authentication to it, which the Windows machine will provide, and then Responder
2106590	2111810	will capture those hashes. You can usually accomplish this by trying to access something
2111810	2118390	that doesn't exist, such as file share does not exist or something like that
2118390	2126390	inside your network libraries. And that should be sufficient to generate the LL, MNR broadcast
2126390	2135330	traffic. And we'll see an example of that here. So I open up the folders and I go to server does not
2135330	2142050	exist. And you can see the poison answers are being sent and we're capturing NTLMv2 hashes.
2142050	2149770	Now this is important. As we start capturing the NTLMv2 hashes, you'll see there are multiple
2149770	2156010	hashes being captured. These are actually the same hash just due to the nature of NTLMv2.
2156010	2164090	They are salted so you will receive multiple hashes. When you are going to crack these
2164570	2173150	hashes, what you'll want to do is take one hash per username. That way you're not
2173150	2180030	spending excess time trying to crack the same hash for a user that you've already cracked or
2180030	2185330	for a user that you're not going to be able to crack. So once we've got that hash, we can just
2185330	2196290	copy it over into a text file, which I do here. So you can see I drop it into hash.txt and you
2196290	2208010	could do this for as many of the usernames and passwords that you capture. Hopefully you get
2208010	2213370	something juicy. Sometimes you'll be able to get DA creds or things like that.
2214130	2220310	Okay, so now that we've got hash.txt created, we're going to go ahead and start up
2220310	2229750	HashCat. So NTLMv2 hashes are mode 5600. So to accomplish that in HashCat, you feed it the
2229750	2239550	TACM flag and then 5600. Then you feed it the file name. And then in this particular example,
2239550	2245910	we're using a little bit of a contrived example just for brevity. So we're going to use
2245910	2254530	fasttrack.txt because I happen to know that this particular password for this user,
2255230	2261670	again, because I've created the lab, will be in that. Now, if this is a live gig,
2261670	2271290	that's where you're going to feed some of the more advanced masks or rules or definitely stronger
2271290	2277590	word lists, things like that. But you can always start with the quick and easy ones, and maybe
2277590	2284670	you'll get lucky. And if you do, that's awesome. You haven't spent a lot of time. However, if you
2284670	2292670	do need to use those heavier lists, please feel free to. And definitely use the masks and such
2292670	2306450	that you've got working. So we start a HashCat here, again, using the mode 5600.
2307430	2317070	And then we feed it the hash.txt that we created. And then we go ahead and feed it the
2317630	2324210	particular word list, which in this case, again, is stored as user share word list. And then we're
2324210	2333430	just using the fasttrack.txt. Once HashCat starts, again, this particular Kali instance isn't hooked
2333430	2341190	up to my GPU box. So you'll get some warnings for OpenCL and things like that. But you'll see
2341190	2349410	the warnings come through. And then just because I know that this works really quickly,
2349410	2356750	you'll see that this cracks. And you can see password1 is our cracked password.
2356910	2366750	Now, if we were cracking multiple passwords, or take longer, you would see those in your
2366750	2375210	POP file. You can also create a new POP file by doing dash dash POP file dash path equals,
2375210	2382850	and then name your POP file whatever you want. And that will create a POP file specifically for
2382850	2390490	that particular session with HashCat. That's useful if you're running an engagement for a
2390490	2394830	particular client, and you wanted to separate out the hashes that you've cracked from them
2395390	2400990	versus the other engagements that you've worked.
2404200	2413040	So you can see here, as the hash is cracked, it will append the password to the end of the
2413040	2419440	hash file, which will be the exact same way it's presented in the POP file as well.
2422900	2432720	So now that we've got our password, we can then go ahead and use those credentials to go
2432720	2441580	and log in via Windows doing any particular thing that we might want to do.
2444110	2450030	Okay, so with a little bit of time that we have left, I'd like to do a quick demo of PWSpy,
2450030	2458630	as it's kind of a new tool that I've developed. And it was originally released during 6.14 con
2458630	2466450	2019. However, it's gone through some pretty major changes. And I'm happy to announce that
2467130	2473930	the newest version is now live on GitHub for you guys to go ahead and go grab a few so shoes.
2474450	2483510	So again, this was an internal tool developed mostly to help us deal with the massive amount
2483510	2492870	of information coming from the enterprise password audits. So the intention was that
2492870	2499150	you would take a POP file that you've created specifically for your particular client,
2499850	2507370	or engagement, and then you would feed that as well as the initial hash list
2507370	2513390	that you fed into Hashcat. And it would do the analysis for you.
2514470	2519410	That's pretty much been accomplished. There's still a few more bugs and things that I'd like
2519410	2528070	to tweak. However, let's get into it. For this particular demo, I went ahead and grabbed some
2528070	2534190	passwords that we've seen in some of the public dumps that are out there. And I went ahead and
2534190	2541070	created some NTLM hashes using those passwords and cracked them using the Optive Cracker to generate
2541070	2549050	the POP file for this demo. So that's what you're going to see here. So I'll go ahead and open
2549050	2559210	demo.pot. As you can see, these are just some common passwords, and they've already been cracked.
2559210	2568170	So it's time to do the post session analysis on that. So we're going to go ahead and feed this
2568170	2582990	file into pwspy. Now, pwspy, if you open up the help options, you'll see that you can feed it both
2583230	2588870	a POP file and a hash list. The hash list is actually optional. You don't have to add that.
2588870	2598370	As well as inside the Python script, you can turn on and off individual modules simply by commenting
2598370	2605170	them out in the calls. Those are down at the bottom of the script, and I'll show you that
2605170	2616350	towards the end of this demo. So in this particular case, because we're using publicly
2616990	2622690	available passwords, and we haven't cracked a bunch from a particular company, so there's not
2622690	2631850	going to be any reuse, there's really no sense in doing the hash list as well. So we're not going to
2632510	2637410	feed that in. As well as some of the modules may not work because there's just not enough data,
2637410	2644730	such as the mask builder, and definitely the password reuse won't work because you need to
2644730	2655190	feed that the hash list. So we'll go ahead and run pwspy, and we'll take a look at the output.
2660060	2667540	So you can see here, the output is a pretty standard script output, complete with the
2668480	2674340	required ASCII text for any cool hacker tool, of course.
2676100	2689230	So this shows you some of the various modules that have worked.
2689250	2696150	So as we scroll back, you can see that we have the
2700300	2706760	common base words, and the number of times that we've seen those, as well as
2707960	2714640	there would be a password reuse, and the masks would go there as well,
2714640	2717820	which would help you if you were going to do further attacks against
2717820	2726880	this client. The other thing that it will do is it will tell you weak passwords.
2727360	2734400	So passwords, in this case, I have it set to just passwords that are just plain text.
2734400	2742060	So you can see all these passwords were cracked and consist of only letters and no numbers or
2742060	2747540	special characters of any sort. You can always make this more restrictive or less restrictive
2748120	2754700	by editing the Python script. One of the goals for the future is to add options
2755360	2763560	to define what a weak password would be. And then the last thing that it will do
2763560	2769660	is check the lengths of all the passwords that you have cracked. And as you can see,
2770200	2776480	it splits those out and gives you the number of occurrences. So there were a lot of 9-character
2776480	2782860	passwords, some 10-character passwords. This really becomes helpful if you are
2783900	2790660	doing, again, an engagement, and let's say the client says that they've got a 12-character
2790660	2796320	password policy. And you can go ahead and check against that and make sure that you didn't
2796320	2804160	capture any passwords that might not fit that policy, as well as if you're going to build
2804160	2812640	your custom masks that might not be output by this tool, you would be able to use the
2812640	2821160	the password length to help you generate those masks as well.
2823490	2830630	So the last thing I wanted to touch on with PWSpy is just kind of taking a quick look
2830630	2835150	at the source code and showing where you would turn on and off those modules.
2835730	2849420	So if we cap the file here, you can see that all of the function calls are down here at the bottom,
2849420	2857340	which I'm highlighting here. And from there, what you can do is go ahead and comment out any of
2857340	2863760	those different modules, and it will not run those. So if you didn't particularly want to run
2863760	2869880	the mask builder, or check for weak passwords, or password length for whatever reason,
2869880	2874420	you could go ahead and comment that out. Again, this is an open source tool.
2874420	2885540	Please feel free to fork and edit it as you see fit. And I hope that this proves helpful to
2885540	2891280	somebody or anybody if you are doing especially large password assessments.
2897310	2902230	I'd like to thank you for taking the time to listen to today's talk. There's been a lot of
2902230	2907310	great talks here at the Red Team Village, and it looks like there's a few more after me. It's been
2907410	2915350	a great DEF CON, despite it being remote. At this time, I would like to just once again reiterate
2915350	2924350	that password cracking methodology is more of a comprehensive approach than a one-size-fits-all.
2924350	2930910	There are many different ways and approaches to cracking passwords, and what works for one person
2930910	2939350	may not work for everybody. So keep that in mind, as well as always remember that password cracking
2939350	2947370	is, again, not a one-size-fits-all. You're not going to be able to do this by just scripting
2947370	2954190	everything. You definitely need to do that deep dive analysis and really think about what you're
2954190	2961810	after and use that to guide the way that you go after your passwords in the future.
2962550	2971410	Hopefully you have taken something away from this talk, and I will be in the Red Team Village
2971410	2981010	Discord for any questions. I'm HX50 in there, as well as on Twitter. You can find me at HX underscore
2981010	2989410	50. And once again, I would highly encourage you to go ahead and try some of these techniques out
2989410	2999210	on your own. Go ahead and create hashes, set up a lab, and go ahead and crack your own stuff.
3000810	3008950	I will release the instructions on how to set up my lab, as well as possibly setting up
3009870	3017310	just OVA files that you can download, as well as you can go on GitHub and
3018150	3027630	feel free to grab pwspy if you so choose. You can find that at github.com slash lwangenheim
3029690	3036050	slash pwspy. And obviously, that's quite a mouthful to try and spell.
3036050	3042530	So if you do want to try and find it and Google doesn't help, feel free to reach out to me. I'm
3042530	3048150	more than happy to either just provide you the link, or I can just send you the files directly.