Hashcat: A password cracking tool
History of Hashcat
Hashcat is a widely used advanced password recovery tool. It was developed by Jens ‘atom’ Steube and Gabriele ‘matrix’ Gristina. The software was first officially released v0.30 on 24th December 2009. Two Variants of hashcat existed, Hashcat -CPU -based password recovery tool and oclHashcat/cudaHashcat – GPU-accelerated tool (OpenCL or CUDA) which was later merged into a single tool called Hashcat and v3.00 was released.
In 2015, Hashcat was released as an open-source software and has since gained publicity. It supports various modes of attack such as Dictionary attack mode, Rule-based attack mode, Combinator attack mode, Hybrid attack mode, Brute-force attack and various options mode for over 300 highly optimized hashing algorithms. It currently supports CPUs and GPUs, other hardware accelerators on Windows, Linux and macOS and has facilities to help enable distributed password cracking.
Hashcat is licensed under MIT license.
How is Hashcat used?
Hashing is the process of converting a string of characters into a shorter and fixed length value using a hash function. Most passwords are stored in hashes using different algorithms such as SHA256.Hashes are irreversible, so for example, when you try to login in into your account and you enter your password, the password is hashed and then compared to the stored password hash, if it matches, then you would gain access to your account. That is why adversaries always look for ways to crack or guess passwords to gain unauthorized access.
Hashcat basically, guesses passwords, hashes them and compares the hashes with the stored password hashes and if any matches, access is granted. Hashcat uses various attack modes such as Straight/ Dictionary attack mode, Combinator attack mode, mask attack mode and rule-based attack mode while attempting to crack passwords. Hashcat, also leverages on the power of your computer’s Graphics Processing Unit (GPU) to speed up password cracking. Hashcat also uses a wordlist of commonly used passwords, username, subdomain etc. when trying to crack passwords. Wordlists of commonly used passwords can be found online example of a common word list is called rockyou.txt
Hashcat can crack various kinds of hashed passwords ranging from MD5, SHA256 to NTLM and Kerbros. The strength of the passwords determines the time and resources needed to crack hashes so stronger passwords and adding salts to password hashes is advised as it makes it harder to crack.
What type of passwords is it good at cracking?
A slight thing that hashcat fails at doing is while hashcat does support a wide range of hashes which in most use cases is enough there are some hashes that hashcat does not support. In cases where the type of password you are trying to break uses a non-supported hash hashcat will be of no help. You can find the full list of supported hashes at https://hashcat.net/hashcat/. Another limitation for hashcat is that it will not be able to decrypt passwords that are used to encrypt documents and files. This is a limitation as hashcat will not be able to know if the decrypted password is correct as it will not be able to tell if the decrypted file is correct or still just gibberish.
What is hashcat slow at or fail at accomplishing?
02
Demo: Follow along and try cracking passwords!
To follow along and do the demo at the same time run this command in your home directory on the VMs. This will copy all the file needed for the demo into a folder in your directory call hashcatDemo:
cp -r /home/hayden.mcnally/hashcatDemo .
Please note if you miss the results of a hashcat execution just rerun the command with the –-show flag and only the results will be printed.
Attack mode 0
Part 1:
Attack mode 0 is call straight, this is where hashcat goes through a wordlist and tries to see if the password is in the wordlist. I’ve created a wordlist called animals.txt where I collect the top 100ish animal’s names. In my password file I have hashed four animal names using md5, ‘dog’, ‘cat’, ‘moose’ and ‘shark’, if you’d like to add some of your own animals to the password list to see if they’ll get cracked you can run the command:
printf '%s' "my string" | md5sum | tr -d " -" >> password.txt
Where substitute ‘my string’ for your animal and substitute password.txt with the current password file for this exercise which is password0A.txt
Now lets see what results we get when we run hashcat. We run hash are with this command:
hashcat -a 0 -m 0 password0A.txt animals.txt
The -a flag is specifying the attack mode, -m flag is what hash type in this case MD5 which has the number 0, the next inputs are the password file which is the file with the hashes next is the wordlist file.
From the results we can see that it cracked 3 of the 4 passwords. ‘dog’ ‘cat’ and ‘shark’. This happened as those three passwords were in my wordlist though moose wasn’t meaning it didn’t get cracked. This shows how having a good wordlist is crucial to cracking passwords.
Part 2:
Now how many people use only letters in their password, let alone a website allowing you to have only letters for your password. This is where the second part of straight mode comes in, rulesets. I won’t go into how to create a ruleset file though you can get some good ones online with a bit of searching which is what I did here to get SuperUnicorn.rule ruleset file. This ruleset will now have hashcat check common variations on the words in the wordlist like capitalizing the first letter and adding the year to the end of the password.
Again, feel free to add your own passwords to this password file with the same command as before the password file for this exercise is password0B.txt.
Now using this command to run hashcat with our ruleset file:
hashcat -a 0 -m 0 password0B.txt animals.txt -r SuperUnicorn.rule
Again, we can see that three of the four passwords are cracked. We’re able to crack ‘Dog1234’, ‘cat2024’, and ‘6Shark6’. The ruleset enables hashcat to crack these passwords that have added complexity to them like adding the year, uppercase letters and adding numbers. Though did you notice that hashcat took longer to crack theses passwords that is because it needs to hash each different rule variation to find the correct password, so adding more rules and words the wordlist increases the runtime of hashcat. We can notice again the fourth password wasn’t cracked as it was ‘1moose2023’ again since moose isn’t in the wordlist it wasn’t cracked.
Attack mode 1
The next attack mode is called combination, this is useful as in class we learned that people should use passphrases rather than just passwords. Combination takes two wordlist and tries combinations of each word in each wordlist to try and guess the password. Rules can’t be used in the mode without more advanced techniques which we won’t cover. Now for this exercise we’ll use password1.txt where all the passwords are one of the main 8 colours and an.
We can now run hashcat with this command:
hashcat -a 1 -m 0 password1.txt colours.txt animals.txt
With this command we crack 3 out of 5 passwords again. ‘bluesheep’, ‘blacksnake’, and ‘orangemammoth’. The two passwords not cracked where ‘mammothorange’ and ‘purplemoose’ these weren’t cracked as the order of the wordlist files matter hashcat only checked colour then animal not animal then colour. ‘purplemoose’ again wasn’t cracked as moose is not in the animal wordlist again showing the importance of good wordlist files.
Attack mode 3
Attack mode 3 is called mask, this is where you specify a mask for the password to be. Let say you’ve got passwords from a company and you know their password policy requires a uppercase letter and a number of at least 4 letters long. Employees might pick an 4 letter long word and then make the first letter a capital and add a number the end. Making a mask of that is, upper case is ?u lower case is ?l and a number is ?d. Giving us a mask of ?u?l?l?l?d, lets now run hashcat on password3.txt with passwords that follow this mask. Remember feel free to add your own passwords with the command specified at the beginning:
hashcat -a 3 -m 0 password3.txt ?u?l?l?l?d
Again, you might notice this will take much longer as the mask gets bigger as this is close to brute forcing the password with some educated guesses. From the result we can see again we three of the four, ‘Pass9’, ‘High7’ and ‘Jack5’ the password that wasn’t crack was the one that didn’t follow the mask it was ‘ALLS8’.
Attack mode 6 and 7
The last two attack modes are hybrid they combine attack mode 0 and mode 3, letting you do a wordlist dictionary attack and specify a mask append to the end (mode 6) or append to the beginning (mode 7) of each word list. The use case here is that you know a companies password policy requires number and a special character you can use your wordlist plus the mask of ?s?d or ?d?s depending on which you think the users put first. With this let’s try the next exercise where the password67.txt contains passwords of animals with special characters and numbers added to the end, feel free again to add your own.
hashcat -a 6 -m 0 password67.txt animals.txt ?d?s
From the results we can see 3 out of four passwords get cracked ‘bison5!’, ‘otter1?’ and ‘jellyfish4$’. The last password that didn’t get cracked was ‘peacock66@’ this is because it has two numbers then a special character. This shows that it’s useful to run hashcat multiple times with slightly different masks like two numbers then a special character or special character then a number. This is also where rulesets come in handy as you can specify rules to cover theses cases and only need to run hashcat once with the ruleset. This comes with the downside though of potentially not useful rules getting checked increasing the runtime unnecessary.
Conclusion
Now with the knowledge of all the attack modes for hashcat feel free to create your how hashed password text file and try and crack them. Found in the demo file are rockyou.txt this is a famous wordlist file which should help crack most simpler passwords. You can also find rules_full.rule file this is a ruleset file with over much more than a million rules and hence takes a bit for hashcat to run with. The ruleset used in the demo SuperUnicorn.rule already has just over a million rules so my advice would be to start with that one as it’ll run faster.
For more info, visit below links!
https://blog.cyberadvisors.com/technical-blog/blog/hashcat-quick-guide-techniques-and-tips