phillips321.co.uk

The tool we’re going to use here is hashcat. I’ll be testing this using a ATI 6950 2GB GPU running on Kubuntu 64bit using catalyst drivers 12.2. Your mileage might vary depending on what card you’re using.
Hashcat (now known as oclhashcat-plus) comes with a few different binaries depending on what architecture you’ll be running it on.

• nVidia 32bit – use
• nVidia 64bit – use
• ATI 32bit – use
• ATI 64bit – use

We need to check the graphics drivers and librarys are all set up correctly so quickly trying running one of the example files.

Looks like things are working fine 🙂
As we have a pwdump output style we need to cut this down to only show the NTLM hash.
username:userid:lmhash:ntlmhash:::

And now to use oclHashcat to crack the NTLM

That’s great and all but what if we wanted to crack using a bruteforce attempt? Well we need to tell Hashcat how we want to bruteforce. Instead of using a dictionary file we must create a mask such as the following examples:

• ?l?l?l?l?l?l?l?l – 8char lowercase password
• -1 ?l?u? ?1?1?1?1?1?1?1?1 – 8char upper or lowercase password
• -1 ?l?u?d?s ?1?1?1?1?1?1?1?1 – 8char upper,lower,digits,special password

In order to create your own masks you;; need to understand the following:

• ?l is all lower case letters from a to z
• ?u is all upper case letters from a to z
• ?d is all digits from 0-9
• ?s is all special characters on a standard keyboard
• ?h is all ISO-8859 characters or “HEX” characters
• ?D is all 8-bit characters from the German alphabet
• ?F is all 8-bit characters from the French alphabet
• ?R is all 8-bit characters from the Russian alphabet
• -1 abcdABCD -2 1234 is a custom range used like so ?2?2?2?2?1?1?1?1

Here’s a demo of cracking the password hash with a bruteforce setting a 9 character password using only lowercase letters (I’ve used the flag 2 in this example as ONE looks like a lowercase L)

Bingo… PASSWORD FOUND 🙂

Just to make you guys realise the speed difference when using a GPU as a cracking platform i have performed a comparison against the cracking the same an 8 character hash using a CPU (AMD x6 1055T @3.8GHz) – 104minutes on the CPU.
user1:7:7b0662e4590e238a417eaf50cfac29c3:0c341d2d5793a3afafc76f8bc3bd56a1:::

Compared to 38 seconds on the GPU 🙂