All language subtitles for 19. Password Attacks

password attacks passwords are the most

basic form of user account and service

authentication by extension the goal of

a password attack is to discover and use

valid credentials in order to gain

access to a user account or service in

general terms there are a few approaches

to password attacks we can either make

attempts at guessing a password through

a dictionary attack using various word

lists or we can brute-force every

possible character in a password in

general a dictionary attack prioritizes

speed offering less password coverage

while brute-force prioritizes password

coverage at the expense of speed both

techniques can be used effectively

during an engagement depending on our

priorities and time requirements in some

cases once we gain usually privileged

access to a target and were able to

extract password hashes we can leverage

password cracking attacks that seek to

gain access to the clear text password

or pass the hash attacks which allow us

to authenticate to a windows-based

target using only a username and the

hash in this module we'll discuss each

of these concepts and techniques in more

detail and demonstrate how they can be

leveraged in various attack scenarios

word lists word lists sometimes referred

to as dictionary files are simply text

files containing words for use as input

to programs designed to test passwords

precision is generally more important

than coverage when considering a

dictionary attack meaning it's more

important to create a lean word list of

relevant passwords than it is to create

an enormous generic word list because of

this many word lists are based on a

common theme such as popular culture

references specific industries or

geographic regions Kali Linux includes a

number of these dictionary files in the

user share word lists directory and many

more are hosted online when conducting a

password attack it may be tempting to

simply use these pre-built lists however

we can be much more effective in our

approach if we take the time to

carefully build our own custom lists in

this section we'll examine tools and

approaches to create effective word

lists

standard word lists we can increase the

effectiveness of our word lists by

adding words and phrases specific to our

target organization for example consider

mega Corp 1 a company that deals with

nanotechnology the company website lists

various products that the company sells

including the nano bot in a hypothetical

assessment we were able to identify a

low-level password of nano bot 93

assuming this might be a common password

format for this company we would like to

create a custom word list that

identifies other passwords with a

similar pattern perhaps using other

product names

we could browse the website and manually

add commonly used terms and product

names to our custom word list or we

could use a tool like cool to do the

heavy lifting for us

according to the help output cool can be

configured by specifying several options

but will focus on a few key arguments

for example this command will scrape the

make a Corp one website locate words

with a minimum of 6 characters and write

the word list to a custom file

our grep output shows that cool located

the name of several products including

the nano bot we should consider the

possibility that other product names may

be used in passwords as well

however these words by themselves would

serve as extremely weak passwords and

would not meet typical password

enforcement rules these types of rules

generally require the use of upper and

lowercase characters the use of numbers

and perhaps special characters based on

the nanobot 93 password we've discovered

we could surmise that the password

enforcement for mega Corp 1 requires at

least the use of two numbers in the

password and may further dictate however

unlikely that the numbers must be used

at the end of the password for the sake

of this simple demonstration we'll

assume that mega Corp 1 policy dictates

that a password end in a two digit

number to create passwords that meet

this requirement

we could write a bash script but instead

we'll use a much more powerful tool

called John the Ripper John the Ripper

is a fast password cracker with several

features including the ability to

generate custom word lists and apply

rule permutations moving forward with

our assumption about the password policy

we'll add a rule to the John the Ripper

configuration file that will mutate our

word list appending two digits to each

password

to do this we must locate the word list

segment where word list mutation rules

are defined and append a new rule

in this example we'll append the

two-digit sequence of numbers from

double zero to 99 after each word in our

word list

we'll begin this rule with the dollar

sign character which tells John to

append a character to the original word

from our word list next we specify the

type of character we want to append in

our case we want any number between 0

and 9 finally to append double digits

we'll simply repeat the 0 to 9 sequence

now that the rule has been added to the

configuration file we can mutate our

word list which currently contains 312

entries

to do this will invoke John and specify

the dictionary file activate the rules

in the configuration file output the

results to standard output and redirect

that output to a file called mutated dot

text

the resulting file contains over 46,000

password entries due to the multiple

mutations performed on the passwords

one of the passwords is nanobot 93 which

matches the password we discovered

earlier in our hypothetical assessment

given the assumptions about mega Corp

one password policy this word list could

produce results in a dictionary attack

although this demonstration is

oversimplified it serves as a good

example for how password profiling can

be beneficial to the overall success of

our password attacks

brute-force word lists in contrast to a

dictionary attack a brute force password

attack calculates and tests every

possible character combination that

could make up a password until the

correct one is found while this may

sound like a simple approach that

guarantees results it is extremely

time-consuming depending on the length

and complexity of the password and the

computational power of the testing

system it can take a very long time

even years to brute-force a strong

password

we could even combine these two concepts

and create brute-force word lists

dictionary files that contain every

possible password that matches a

specific pattern for example consider a

scenario that reveals a very specific

password enforcement policy

looking at the passwords we notice a

distinct pattern in the password

structure

each password begins with a capital

letter followed by two lowercase letters

than two special characters and finally

three digits

armed with this knowledge it would be

incredibly helpful to create a word list

that contains every possible password

that matches this pattern crunch

included with Kali Linux is a powerful

word list generator that can handle this

task to use it we must first describe

the pattern we need crunch to replicate

and for this we'll use placeholders that

represent specific types of characters

to generate a word list that matches our

requirements we'll specify a minimum and

maximum word length of eight characters

and describe our rule pattern with - t

the command works as expected but as

noted the output would consume a massive

160 gigabytes of disk space

remember that brute force techniques

prioritize password coverage at the

expense of speed and in this case disk

space we can also define a character set

with crunch for example we can create a

brute force word list accounting for

passwords between four and six

characters in length containing only the

characters zero through nine and a

through F and we'll write the output to

a file

notice that the file output size is

significantly smaller than the previous

example primarily due to the shorter

password length as well as the limited

character set

however the word list file itself is

impressive containing over 17 million

passwords

in addition we can generate passwords

based on predefined character sets

for example we can specify the path to

the character set file with - F and

choose the mixed alpha set which

includes all lower and uppercase letters

although this particular command

generates an enormous 131 gigabyte word

list file

it offers rather impressive password

coverage spend time with jtr and crunch

and think of how each one can be used

most effectively

as we'll discover in the next section we

need to avoid the temptation to rely on

massive and generic word lists as they

can have adverse effects on our clients

production environment

common Network service attack methods

now that we understand how to create

effective word lists for various

situations we can discuss how they can

be used for password attacks against

common network services bear in mind

that password attacks against network

services are noisy and in some cases

dangerous multiple failed login attempts

will usually generate logs and warnings

on the target system and may even lock

out accounts after a predefined number

of failed login attempts keep this in

mind before blindly running a network

based brute-force attack once we've

weighed the risks and considered the

well-being of the target network we can

take several steps to improve the

efficiency of our password tests

depending on the protocol and password

cracking tool we can increase the number

of login threads to boost the speed of

an attack however in some cases

increasing the number of threads may not

be possible due to protocol restrictions

and our optimisation attempt could

instead slow down the process on top of

this it's worth noting that the

authentication negotiation process for

protocols such as RDP are more

time-consuming than say HTTP the hidden

art behind network service password

attacks is choosing appropriate targets

user lists and password files carefully

and intelligently before initiating the

attack to successfully attack a password

on a network service we must not only

match the target user name and password

but also honor the protocol used in the

authentication process

fortunately popular tools such as THC

Hydra Medusa crowbar and spray can

handle these authentication requests for

us

in this section we'll examine each of

these tools and way they're effective

protocol and service handling

capabilities these tools mostly have

similar capabilities and speeds the

correct tool to use often depends on the

preferred syntax and output format

this can only be determined by

experimenting with each tool in a test

environment and learning the strengths

weaknesses and idiosyncrasies of each

HTTP htx s attack with Medusa

according to its authors Medusa is

intended to be a speedy massively

parallel modular login brute force err

we'll use Medusa to attempt to gain

access to an HT access protected web

directory

first we'll set up our target an Apache

web server installed on our Windows

client which will start through the

xampp control panel

you

with our services started will return to

Cali and explore Medusa

you

we'll attempt to gain access to an HT

access protected folder named admin on

our Windows web server

we'll use the rock you wordlist for this

example which we must first decompress

with guns if

next we'll launch Medusa and initiate

the attack against the HD access

protected URL on our target host will

attack the admin user with passwords

from our rock you word list file and

we'll use an HTTP authentication scheme

in this case Medusa discovered a working

password of freedom

let's try out these credentials in our

browser

you

excellent our medusa attacks

successfully retrieved the password for

this directory

Madusa has many additional options and

settings and can interact with a variety

of network protocols these can be

displayed with the dash d option

for more information about medusa refer

to your lab guide

remote desktop protocol attack with

crowbar

crowbar is a network authentication

cracking tool primarily designed to

leverage SSH keys

rather than passwords it's also one of

the few tools that can reliably and

efficiently perform password attacks

against the RDP service on modern

versions of Windows let's try this tool

against our Windows client machine first

we need to install crowbar from the Kali

repository

next we'll create a small word list that

contains the password for our Windows

client

to invoke crowbar we specify the

protocol

the target server a username

a word list

number of threads

great crowbar discovered working

credentials for the admin user

note that we only specified a single

thread since the remote desktop protocol

does not reliably handle multiple

threads

SSH attack with THC Hydra

THC Hydra is another powerful network

service attack tool under active

development and it's worth mastering we

can use it to attack a variety of

protocol authentication schemes

including SSH and HTTP the standard

options include - L to specify the

target username - capital P to specify a

word list and the protocol and IP in the

URI format to specify the target

protocol and IP address respectively

in this first example will attack the

SSH service on our Kali VM let's start

OpenSSH before proceeding

now we'll use Hydra to attack the ssh

protocol on our local machine focus on

the kali user and again use the small

word list we created earlier

in this output we can see that Hydra

discovered a valid login against the

local SSH server

THC hydra supports a number of standard

protocols and services

refer to the Hydra man page to view all

of its available options

HTTP POST attack with THC Hydra

as an additional example we'll perform

an HTTP POST attack against our windows

apache server using hydra when an HTTP

POST request is used for user login it

is most often through the use of a web

form which means we should use the HTTP

form post service module we can supply

the service name followed by - capital

you to obtain additional information

about the required arguments

from this output we determined that we

need to provide a number of arguments

that will require us to perform some

application discovery

first we need the IP address and the URL

of the web page containing the webform

on our windows client will provide the

IP address as the first argument to

Hydra

next we must understand the webform we

want to brute force by inspecting the

HTML code of the target web page

we can view the HTML by right-clicking

the page and selecting view page source

from the context menu

the form indicates that the post request

is handled by front page PHP which is

the URL we will feed the Hydra the Hydra

syntax requires the form parameters

which in this case are user and pass

since we're going to attack the admin

user login with a word list

the combined argument to Hydra becomes

the following with pass acting as a

placeholder for our word list file

entries we must also provide the

condition string to indicate when a

login attempt is unsuccessful

we can find this by attempting a manual

login against the page

in our example the webpage returns the

text invalid login

putting these pieces together we can

complete the HTTP forum post syntax the

complete command can now be executed

will supply the admin username and

RockYou word list request verbose output

with - VV and used - f to stop the

attack when the first successful result

is found in addition will supply the

service module name and its required

arguments

you

although this required some

investigation of the application the

result is worth it as we discovered a

valid password let's verify that this is

indeed the correct password

you

excellent Hydra successfully found the

correct admin password for us

the other service modules included with

Hydra are also well worth the effort to

master

leveraging password hashes

next we turn our attention to attacks

focused on the use of password hashes a

cryptographic hash function is one way

and implements an algorithm that given

an arbitrary block of data returns a

fixed size bit string called a hash

value or message digest

one of the most important uses of

cryptographic hash functions is during

the password verification process

retrieving password hashes most systems

that use a password authentication

mechanism need to store these passwords

locally on the machine rather than

storing the passwords in clear-text

modern authentication mechanisms usually

store them as hashes to improve security

this means that during the

authentication process the password

presented by the user is hashed and

compared with the previously stored

message digests identifying the exact

type of hash without having further

information about the program or

mechanism that generated it can be very

challenging and sometimes even

impossible when attempting to identify a

message digest type there are three

important hash properties to consider

these include the length of the hash the

character set used in the hash and any

special characters used by the hash a

useful tool that can assist with hash

type identification is hash ID to use it

we simply run the tool and paste in the

hash value we wish to identify

here we analyzed two different hashes

while the first example returned

multiple possible matches the second

narrowed down the hash type to sha-512

crypt next let's retrieve and analyze a

few hashes on our Kali Linux system

many Linux systems have the user

password hashes stored in the Etsy

shadow file which requires root

permissions to read

the shadow file entry starts with the

username followed by the password hash

the hash is divided into subfields the

first of which references the sha-512

algorithm the next subfield is the salt

the salt is a random value that's used

along with the clear-text password to

calculate a password hash this prevents

hash lookup attacks since the password

hash will vary based on the salt value

now let's turn our focus to windows

targets and discuss the various hash

implementations and how we can leverage

them during an assessment on Windows

systems hashed user passwords are stored

in the Security Accounts Manager or Sam

to deter offline Sam database password

attacks Microsoft introduced the SIS key

feature which partially encrypts the Sam

file windows nt-based operating systems

up to and including Windows 2003 store

to different password hashes land

manager or LM which is based on DES and

NT land manager or ntlm which uses MD

for hashing

land manager is known to be very weak

since passwords longer than seven

characters are split into two strings

and each piece is hashed separately each

password string is also converted to

uppercase before being hashed and

moreover the LM hashing system does not

include salts making a hash lookup

attack feasible

from Windows Vista on the operating

system disables LM by default and uses

ntlm which among other things is

case-sensitive supports all Unicode

characters and does not split the hash

into smaller beaker parts however ntlm

hash is stored in the Sam database are

still not salted

it's worth mentioning that the Sam

database cannot be copied while the

operating system is running because the

Windows kernel keeps an exclusive

filesystem lock on it

however we can use Mimi Katz which is

covered in much greater depth in another

module to mount in-memory attacks

designed to dump the Sam hashes among

other things Mimi Katz modules

facilitate password hash extraction from

the L SAS process memory where they are

cached

you

since L SAS is a privileged process

running under the system user we need to

launch Mimi Katz from an administrative

command prompt

extract password hashes we must first

execute two commands the first is

privileged debug which enables the SE

debug privileged access write required

to tamper with another process if this

command fails me me Katz was most likely

not executed with administrative

privileges

it's important to understand that L SAS

is a system process which means it has

even higher privileges than me me cats

running with administrative privileges

to address this we can use the token

elevate command to elevate the security

token from high integrity to system

integrity

if Mimi cats is launched from a system

shell this step is not required

now we can use LSA dump

Sam to dump the contents of the Sam

database

nice Mimi Katz has elegantly and

effectively dumped the hashes as

requested

passing the hash in Windows as we'll

discover in the next section cracking

password hashes can be very

time-consuming and is often not feasible

without powerful hardware however

sometimes we can leverage Windows based

password hashes without resorting to a

laborious cracking process

the past the hash technique allows an

attacker to authenticate to a remote

target by using a valid combination of

username and hash rather than a clear

text password this is possible because

LM and ntlm password hashes are not

salted and remain static between

sessions moreover if we discover a

password hash on one target we can not

only use it to authenticate to that

target we can use it to authenticate to

another target as well as long as that

target has an account with the same

username and password let's introduce a

scenario to demonstrate this attack

during our assessment we discovered a

local administrative account that is

enabled on multiple systems we exploited

a vulnerability on one of these systems

and have gained system privileges

allowing us to dump local LM and ntlm

hashes we've copied the hash of a user

in the administrators group and can now

use it instead of a password to gain

access to a different machine which has

the same local account and password to

do this we'll use PTH Winx II from the

passing the hash toolkit which performs

authentication using the SMB protocol as

a demonstration will invoke PTH Winx II

on our Kali machine to authenticate to

our target using a previously dumped

password hash will gain a remote command

prompt on the target machine by

specifying the username and hash

separated by a percent sign along with

the SMB share in unc format and the name

of the command to execute which in this

case is CMD

our command was successful using the

captured hash as credentials we now have

a shell on the target

behind-the-scenes the format of the ntlm

hash we provided was changed into net

ntlm format during the authentication

process

we can capture these hashes using

man-in-the-middle or poisoning attacks

and either crack them or relay them

password cracking encrypt analysis

password cracking

is the process of recovering a clear

text pass phrase given its stored hash

the process of password cracking is

fairly straightforward at a high level

once we've discovered the hashing

mechanism we're dealing with in the

target authentication process we can

iterate over each word in a word list

and generate the respective message

digest

if the computed hash matches the one

obtained from the system we have

obtained the matching plaintext password

this is usually all accomplished with

the help of a specialized password

cracking program if a salt is involved

in the authentication process and we do

not know what that salt value is

cracking could become extremely complex

if not impossible as we must repeatedly

hash each potential clear text password

with various salts nevertheless and our

experience we have almost always been

able to capture the password hash along

with the salt whether from a database

that contains both of the unique values

per record or from a configuration or a

binary file that uses a single salt for

all hashed values when both of these

values are known password cracking

decreases in complexity once we've

gained access to password hashes from a

target system we can begin a password

cracking session running in the

background as we continue on with our

assessment if any of the passwords are

cracked we could attempt to use those

passwords on other systems to increase

our control over the target network this

like other penetration testing processes

is iterative and we will feed data back

into earlier steps as we expand our

control to demonstrate password cracking

will again turn to John the Ripper as it

supports dozens of password formats and

is incredibly powerful and flexible

running John in pure brute force mode

attempting every possible character

combination and a password is as simple

as passing the filename containing our

password hashes on the command line

along with the hashing format

since we know the type of hash we're

cracking we use the format option to

crack the hashes that we dumped using

Mimi Katz

John recognizes the hash type correctly

and sets out to crack it a brute-force

attack such as this however will take a

long time based on the speed of our

system

as an alternative we can use the word

list parameter and provide the path to a

word list instead which shortens the

process time but promises less password

coverage

if any passwords remain to be cracked we

can next try to apply JT ARS word

mangling rules with the rules parameter

next we'll see how John the Ripper deals

with Linux password hashes

in order to crack linux-based hashes

with John we will first need to use the

unshadowed utility to combine the

password and shadow files from the

compromised system let's quickly add a

new user to our system with a relatively

weak password so we can give John

something easy to crack

you

now we'll use grep to extract the victim

user details from Etsy password and Etsy

shadow into two files in our home

directory

note that root permissions are required

to read Etsy shadow

you

great let's continue

John the Ripper requires a special hash

format that is generated with unshadowed

to use unshadowed we simply pass the

password and shadow file names as

arguments

let's save this to a file so we can pass

it to John

we can now run John passing the word

list and the unshadowed text file as

arguments

newer versions of John the Ripper are

multi-threaded by default and this can

be enabled on older versions with the

fork option we can also distribute the

cracking load across multiple computers

with the node option

refer to your lab guide for more

information let's clean up our system

and get rid of that new user we created

while John the Ripper is a great tool

for cracking password hashes its speed

is limited to the power of the CPUs

dedicated to the task in recent years

GPUs have become incredibly powerful and

are of course found in every computer

with a display

GPU cracking tools like hash cat

leverage the power of both the CPU and

the GPU to achieve incredible password

cracking speeds if you'd like to learn

more about GPU password cracking refer

to your lab guide and the ample

documentation available on the hash cat

wiki

wrapping up

there are so many password attack tools

and word lists available that it can be

tempting to just jump in and fire away

in search of that often elusive break

during a penetration test however

success lies in not only deeply

understanding the usage and strengths of

each tool but in learning to step back

and apply these tools with wisdom

honoring the balance of speed and

precision as well as prioritizing the

safety of the clients production

environment