Chapter 6

Hashcat

Tool Authors: Jens Steube & the Hashcat Development Team

Tool Website: https://hashcat.net/hashcat/

Tool Wiki: https://hashcat.net/wiki/

Hashcat is an all-purpose password cracker that can run off of your graphics card processor (GPU) or your CPU. Hashcat is touted as the world’s fastest and most advanced password cracker. The tool is a multi-threaded cracker, if your CPU can run multiple threads, it will use them. But the real speed comes into play when using the horsepower of a GPU, the processor on your video card. Your GPU is made for computational capability, all of this power is used to break passwords. You can even harness the power of multiple video card GPUs to create a monster cracking station.

Password cracking is a hobby of mine. I have personally used Hashcat to crack Hundreds of Millions of passwords over the last 10+ years. I stopped counting the different language passwords that I cracked with Hashcat after I hit the forties. I have recovered...

Hashcat Attack Types

The “-a” option allows you to designate the attack mode type. Hashcat has multiple attack modes and you need to specify which one you want to use. The only time it is not necessary to use it is if you are doing a Single wordlist or straight mode attack. 

The available attack types include:

0 = Straight

1 = Combination

3 = Brute-force

6 = Hybrid Wordlist + Mask

7 = Hybrid Mask + Wordlist

Straight: Single wordlist attack. Each word in the wordlist will be used against each password hash. You can also use Rules in this mode.

Combination: Combines words from separate wordlists to create new words on the fly.

Brute-force: Enter your own combination of characters, numbers & symbols or use Mask attacks to automated guesses. For example: ?u?l?s?d?a (upper, lower, symbol, decimal, all) would attempt to crack passwords like, “Aa!0a” to “Zz|9z” and everything in-between. You can also use “?b” for binary (00-ff...

Single Wordlist

-a0, Straight Attack or the Single Wordlist Attack - This is the simplest attack in Hashcat. Hashcat will use a single wordlist against the password hash file. Each word from the wordlist will be directly hashed and compared with the password. If there is a match, the password is “cracked”. If not, hashcat tries the next word in the wordlist and continues until every word in the wordlist is checked against the password hashes. 

Example:

➢      hashcat -m 0 [Uncracked].txt wordlist.txt -o [Cracked.txt]

You can also use “Rules” in single attack mode.

Single Wordlist with Rules

Rules automatically modify words in the wordlist, to greatly increase your guess word base. Think of them as a programming script to modify the words in wordlists. They can add or remove characters, modify cases, double the words, or numerous other useful things. The rules files are found in the “rule” subdirectory. If you look at each rule file you can see the “programming language” used to modify each word.

The “Best64” rule is one of the most popular and is quick to run:

➢      hashcat -m 0 [Uncracked].txt wordlist.txt -o [Cracked.txt] -r rules/best64.rule

You can toggle the case of every character in the wordlist with the “toggles” rules:

➢      hashcat -m 0 [Uncracked.txt] wordlist1 -o [Cracked.txt] -r rules/toggles.rule -O

This creates words like:

cat, Cat, cAt, caT, dog, Dog, dOg, doG

You can also use two rule files at a time if they are small enough. Though...

Combining Two Wordlists

-a1 Combination Attacks - You can easily combine two wordlists using the -a1 command. This command will take every word from one list and combine it with every word from the second list. This is useful when users string together multiple words or strings in their passwords.

➢      hashcat  -m 0 [Uncracked.txt] -o [Cracked.txt] -a1 wordlist1 wordlist2 -O

Creates words like:

catdog

dogcat

Hashcat also gives you the capability to add a single character at the end or middle of a combined wordlist. You can do this with the “-j” or “-k” switches. This allows you to do things like combine wordlists while putting a space (or any single character) in between each word. You can do this using the “-j” switch:

➢      hashcat  -m 0 [Uncracked.txt] -o [Cracked.txt] -j$" " -a1 wordlist1 wordlist2 -O

This creates words like:

cat dog

dog cat

Combine wordlists with a “...

Masks, Brute Force and Hybrid Attacks

Masks are used in Hashcat to perform brute force cracking. This is specified in Hashcat with the “-a3” switch. Some people frown on brute force cracking because of the wasted time in cracking. It has to try every combination of a pattern and can take an extended amount of time - hours, days, months, even years! (Side note, I don’t ever let it run for more than a day, just look through the ones it did crack for new patterns and try a better mask!) But it is absolutely necessary, especially when cracking hashes of unknown length and complexity. When you have exhausted all your wordlists, rules and combinator attacks, brute force is a great way to get a “fresh look” at the hashes and possibly see a pattern that you could use. Once you do find a pattern, you can step back and modify your mask to be more exclusive or switch to a specialized wordlist that contains those patterns.

Using Masks greatly reduces brute force...

Masks

Before we go further, it is important to understand what masks are in password cracking. Regular brute force attacks are outdated, masks bring a level of intelligence to our brute force attempts. In essence, a mask is just a symbolic list of characters you want to use in any type of brute force attack. 

You can use:

• ?l – lowercase
• ?u – uppercase
• ?s – symbol
• ?d – numbers
• ?h – 0-9, and letters “a-f”
• ?H – numbers 0-9, and letters “A-F”
• ?a – Any number, letter, or symbol
• ?b – Binary – Every hex character from 00 to ff

Basic Brute Force Attacks

Hashcat uses the “-a3” switch for brute force/mask attacks - You just enter the mask you want to use and it will try every possible character from your specification. Brute forcing is great, but can be very time consuming. An 8 character mask made up all of “?a”, forcing it to try every character, number and symbol for every position, can take an extremely long time to process. You can shorten the time by using the “?u”, “?l”, or “?s” for certain positions

For example, an “-a 3” attack using a mask of “?a?l?l?u?s” would produce guesses like:

RaiN!

7laB$

*upW)

Because of the reduced number of potential characters, you will use, it will crack these much faster than if it had to run through every possible combination of characters.

“?b” takes even longer than “?a”, as it will try every hex character from “00” to “ff&...

Hybrid Attacks – Wordlists and Brute Force Together

Using a wordlist together with a mask is a much more efficient use of time.

The format for a hybrid attack is:

-a6 wordlist [mask] or -a7 [mask] wordlist

1. Using a -a6 attack:

-a6 wordlist.txt ?a?l?l?u?s (only the end of the hashcat command line is shown)

Will produce words like:

catRaiN!

cat7laB$

dog*upW)

2. Using an -a7 attack:

-a7 ?a?l?l?u?s wordlist.txt

Would produce words like:

RaiN!cat

7laB$cat

*upW)dog

You can add in the “-I” or incremental flag on any of the brute force methods, this causes Hashcat to only process one character of the mask at a time. So it will go through the entire wordlist and add just the “?a” character to each word. The second pass it will add the “?a?l”, and so forth until all the characters in the mask are used.

First pass:

catB

cat7

dog*

Second pass:

catBr

cat7l

dog*u

Incremental attacks are very effective because they remove passwords that are cracked...

Cracking NTLM passwords

There is nothing like hands on learning, so let’s crack some hashes! We will take a list of hashes and copy them into a text file. And then we will crack them using Hashcat and a dictionary file. Again, I will be showing the commands run in Kali Linux, but the commands are identical in Windows.

➢      Open your favorite text editor and copy in the following NTLM Hashes:

a4f49c406510bdcab6824ee7c30fd852

2e4dbf83aa056289935daea328977b20

d144986c6122b1b1654ba39932465528

4a8441c8b2b55ee3ef6465c83f01aa7b

259745cb123a52aa2e693aaacca2db52

d5e2155516f1d7228302b90afd3cd539

5835048ce94ad0564e29a924a03510ef

b963c57010f218edc2cc3c229b5e4d0f

f773c5db7ddebefa4b0dae7ee8c50aea

5d05e3883afc84f1842f8b1c6d895fa4

6afd63afaebf74211010f02ba62a1b3e

43fccfa6bae3d14b26427c26d00410ef

27c0555ea55ecfcdba01c022681dda3f

9439b142f202437a55f7c52f6fcf82d3

➢      Save them in the Kali Home directory as a file called “...

Cracking harder passwords

Let’s look at some harder passwords with Hashcat.

➢      Take the following hashes and save them in the home directory as “Hardhash.txt”:

31d6cfe0d16ae931b73c59d7e0c089c0

2e4dbf83aa056289935daea328977b20

d6e0a7e89da72150d1152563f5b89dbe

317a96a1018609c20b4ccb69718ad6e7

2e520e18228ad8ea4060017234af43b2

➢      Now type, “hashcat -D 1 -m 1000 Hardhash.txt rockyou.txt -o Hardcracked.txt --force”

Everything on the line is the same as before, except we changed the hash name to the new “Hardhash.txt” file and changed the output filename to “hardcracked.txt”.

➢      And in a few seconds, we see the following screenshot:

Okay, it ran for about the same amount of time, but this time it was only able to recover 2 of the 5 hashes. If we run the cat command on the “hardcracked.txt” file, we see something odd:

...

Using a Larger Dictionary File

If first you don’t succeed, try a larger dictionary! A larger dictionary file provides more known passwords to compare target hashes against. This can crack a greater number of hashes, but because of the increased dictionary size can greatly increase the time it takes to run. Though I have found it is best to run a large dictionary file first and have Hashcat remove any hashes that are recovered. This will make the un-cracked file smaller for when you run the more intensive rules and masks attacks. The website Crackstation.net has a couple very large wordlists available. They have a 15GB monster and a smaller “Human Only” version that is about 700 MB. The larger wordlist has just about every everything that you can imagine in it, the smaller human only version only contains passwords recovered from actual password dumps.

For the next attempt, I went ahead and downloaded the human only wordlist as the larger one will not fit without expanding...