Welcome to part six of this module.
This video is going to be an overview of the basic operations of hash cat hash.
Cat is a password recovery tool that comes prepackaged with Kelly Linux so when you lose your plaintext
password but somehow still have the encrypted hash you can recover your credentials.
Right.
More commonly hash cat is used to crack encrypted passwords which are typically pulled in bulk off databases.
There is also a version which can be run in a Windows environment hash cat will attempt to convert encrypted
hashes into plain text passwords and in some cases user names using a variety of methods.
While there are many such tools out there that do this hash cat is arguably one of the best hash cat
is located under applications.
Password attacks hash cat hash cat can also be loaded from the terminal window by typing hash cat.
I'm going to include Tak H for help.
If you've been following along with these videos in order you may have heard me say more than once that
a particular tool might be a class unto itself.
Were I to cover every possible option and use case example.
This is very true with hash cat.
Just glancing at the help file can give you some idea of the sheer range of options and approaches you
can take to cracking encrypted hashes.
And this puts me in a difficult position as a teacher.
The objective of this class is to teach penetration testing and ethical hacking.
It is outside of the scope of this presentation to cover the complicated science that is involved with
this tool.
It is not humanly possible to encapsulate in one video every different type of hashing algorithm and
salting technique or show every different use case example an approach that one could take to cracking
with this tool.
So the goal here is not to give you enough knowledge of hash cat that you can quit your day job and
go work for the National Security Agency or signals intelligence.
The goal is to give you enough of an understanding to use hash cat in your own penetration tests to
crack passwords.
Fortunately it is very possible to use this tool with just a surface understanding and achieve excellent
results.
And it's my hope that by the end of this tutorial you will grasp the fundamentals well enough that anything
not covered will be easy for you to research and implement on your own.
All right so we'll be using the command line version of hash cat that comes with Carly as well as the
hash identifier to check out what kind of hashes will be up against cracking.
We will also be using some word lists for this process.
If you weren't sure what those are or how to find them or create them please see the two prior videos
in this module uncool and crunch as these subjects are discussed at length so to start out with.
I'm currently on the desktop directory and it contains the hashes that we'll be trying to crack and
award lists that I've assembled to show you how I created these hashes.
We're going to pull up a simple Web page.
There are many different web pages that would serve and will generate a hash for demonstration so this
web page generates empty five hashes.
You can see from the list that I've already generated several which have gone into the hashes file so
just to give an example I type password for twenty four thirty eight click the button.
It'll take a moment and there we go.
It generated an empty five hash for us.
Now I've taken these hashes and I've placed them into two files on the desktop
so having made some basic passwords we can go ahead and try to crack the hashes associated with them.
Now remember that if you do this on your own if you're following along with this process it's important
that when you copy paste the hash you don't leave any spaces in the text file.
I'll open this one to show you what I'm talking about.
Each hash will need to be its own individual line.
You can't combine them or separate them out with colons or anything like that hash cat will not recognize
that so this is one hash another hash and so forth you get the idea
and I'm actually going to open up the individual hash and I'm going to copy it
because now it's time to show off hash identifier and this has come up in prior modules so I'm not going
to do a lengthy explanation of what this is.
We will paste in the hash
scroll up and we can see that it is almost certainly an empty five.
Of course we know it's an empty five.
But if we didn't know this would give us the most likely possible hash types that this hash could be
a knowing which hashing algorithm or encryption algorithm we're up against will save us a tremendous
amount of time as we go about cracking at this can seem useless at first glance.
But if you try to crack a hash without knowing the correct type hash cat can sometimes handle this but
it'll try to go through all of them and that will exponentially add on to the amount of time your process
will take.
So now that we've done that we know that it's empty fire.
We're going to control C to get out of that.
Now we need to bring up hash cat and we need the password list in order to make this work.
We'll also be using the rules lists that hash cat has incited.
Let's go ahead and type in the command hash cat Tak tak help to give us a list of all the basic switches
and flags.
This is just to give you an idea of the options available.
A couple of switches that will be focused on will be the tack em switch which denotes the hash type
as well as TAC a which sets the attack mode.
Note that the hash types are listed here zero for empty five and the switches right up here
Tak M and Tak a.
So for example Tak m 0 would be the hash type mode empty five and the attack type tack a and then a
number signifies the method we are going to be worrying about some of the more advanced options listed
below such as for example salting our password hashes.
This is really advanced material and outside the scope of this tutorial but I do encourage you to study
it on your own.
If you have an interest the next option that we're going to be using is Tak R which is rules file.
We'll see how to find rules files in a moment.
Here are the attack modes.
The first is straight which means it doesn't change anything in the word list.
It goes word for word case for case from what your password file actually says.
In other words if someone had a password of Corti with a capital letter and you don't have it in your
list with a capital Q Even if you have the word Corti in your word list you won't be successful.
A combination attack on the other hand is going to change it up a bit meaning it will go ahead and use
capital letters put numbers together with words reverse them mash them all together and see what is
the best fit the hash types that we saw listed above give the switches for each particular type of hash
we know already from the hash identifier that our target is empty five so we'll be using zero if another
result came back.
For example my sequel we'd then go ahead and use 200.
This is why knowing the type of hash is a major time saver so to get started we need the actual rules
files.
These are going to be stored in seedy user share cache cats rules
Oh I'm sorry.
My typing just gets worse and worse.
Okay.
Here we go.
Once we issue our allies command we can see that there are several files in this rules directory all
with the DOT rule file extension.
There's quite a bit in here so such as the Unix ninja leet speak which is suited for people who like
to spell letters using numbers three equals E and that sort of thing.
There is a combinator rule which is what we're going to be using in this example.
The beautiful thing about the combinator rule is that it allows us to use case sensitive not case sensitive
and to randomize things a bit depending on which ruleset you use.
It's going to take either more or less time to crack the hash.
I recommend looking up each one of these rule sets online and reading about what what they do and seeing
their pros and cons for example best 64 would be for cracking usernames and passwords salted with a
base 64.
So if you found those you could potentially crack them a little faster.
Remember also that you can always cut them out such as for example cat best 64 DOT rule
if you're interested and you have the coding skills it is possible to create your own custom rule sets
the hash cat Web site has excellent documentation to get you started.
You may also be able to find and download other rule sets created by enthusiastic users for specific
use case scenarios at any rate.
Keep in mind as well that when cracking password hashes there are a few factors that are going to influence
how fast the process is going to take hash.
Cat works off your graphics processor unit not your CPSU so the better your graphics card the faster
you're going to be able to crack passwords.
It also depends upon the complexity of the password and the strength of your password list.
I mentioned in the prior modules that bigger is not always better.
Having a massive list may actually take far longer than a smaller one more tailored to your target.
And finally it depends on which encryption algorithm you're going against.
All of these factors combined to dictate the time that it is going to take to crack a password successfully.
And you may not get all of them extremely strong passwords are going to be so resistant to this sort
of approach.
Just in terms of how long it would take you that they aren't worth the investment.
This isn't a fault or limitation of hash cat.
It's just the simple reality.
Even if you have a 100 petabytes word list it's not going to be worth decades of your time to crack
a 40 or more character long password that is all random characters even nation states with unlimited
resources and supercomputers are often simply unable to do this at any rate.
The command is going to look like this.
So we type hash cat Tak M for what type of algorithm we're using.
We know that it's empty five.
So we put zero from the list above.
Then tack a for the attack mode which is going to be straight.
Scroll up if needed but its number is zero.
So we enter zero and we put in the directory for where our password hashes actually reside.
Which in my case is on the desktop after that is the directory of our password list and since I'm using
a custom it will be on the root desktop directory.
You can use any list that you wish after the path for the word list will give it the TAC R directive
which allows us to select our rules set.
So we give it the directory.
You remember that we're going to be using the combinator rule for this first test so everything should
be good.
We press enter.
I should have added that if you run into an open S.L. problem you may need to use the tac tac force
command at the end of the string.
I also want to mention because I mentioned it in the prior modules.
If you ever want to combine your password lists into one it's worth using a tool like de duper to take
out any duplicate passwords and numbers.
This would remove any redundant entries such as the word password being included multiple times and
it will streamline the process for hash cat a lot more.
Another thing to keep in mind is that whenever you use word lists you should be using lists that are
in a language appropriate to your target.
If you're trying to crack a set of passwords obtained from a German database for example you'll probably
want to use a word list containing German words rather than English so as to increase your chances.
This holds true.
Anytime you're attacking something region specific.
Finally if for some reason you're lacking word lists and I don't know why you would be since you're
using Cally which comes with excellent default lists and tools to create them at your fingertips.
You can always download word lists online for more information about this and how to create them please
see the prior videos in this module such as cool and crunch.
All right so as you can see hash cat successfully cracked five of the six passwords.
I did a bit of time manipulation through the magic of video editing and tweaking my password file to
make sure that this process would be quick for recording.
But keep in mind it will take considerable time to crack complex hashes.
As you can see hash cat cracked five of the six passwords which is pretty good for the first try.
You might be wondering what went wrong with the 6 and it could be a lot of things.
Perhaps the word list used was not strong enough in which case we might try again with a stronger word
list.
This will of course take longer Aysha hash Cat will have more words to throw at the hash but it's more
likely to yield a result.
It could also be that the combinator rules set that we used didn't work.
In any case hash cat will write all of our results into what is called the hash cat dot pot file which
will show off after the next example when we have all of our passwords.
All right.
So next up let's take a look at using brute force mode.
This mode requires masks rather than a dictionary or word list as a brief overview.
A mask is basically you telling the brute force mode what kind of characters you want to use and how
long you believe the password is.
For example if we wanted to brute force a password that we had reason to believe was a seven digit ZIP
code we'd use question mark D seven times in a row.
Question mark lowercase L would specify lowercase letters question mark lowercase you for uppercase
question Mark S for special characters and question mark a for all character sets.
For example we could use question mark D seven times with each one representing a single digit
you can also make custom character sets although explaining this would be well outside of the scope
of this tutorial
so this time we're going to select attack mode 3 and we're going to give it the second hash file which
in my case is on the desktop.
We're going to be using question mark a to specify all character sets.
Our goal is to crack a second file containing hashes that we believe to be strings of letters numbers
and characters.
We'll start out using just three.
Then we'll move up to 4.
There is a third password containing five characters but I may skip it if this old computer can't handle
it.
Keep in mind this process takes exponentially longer for the more characters you try to crack.
A 3 character password will fall remarkably fast but a 10 or more character password might take months
or even years to crack.
And that is assuming you've got exceedingly good hardware that certainly isn't going to happen in this
virtual box environment on this old work laptop
huh.
The open S.L. error I was talking about again a fault of this old computer.
We're going to use Tac tac force and we'll try this again.
So to do this we'll run hash cat and once again we're specifying Tech M for MDG 5.
Keep in mind if your hash with some other type you'd need to specify the appropriate number A.L. M for
example would be tack M 1000.
Then we specify tack a and select Attack Mode 3.
We specify the hash path and then question mark a three times.
Now you will see me use the TAC Task Force command again.
And the reason for that is well frankly opens S.L. and Kelly Linux don't play well together again.
This is an old laptop as I said and if I tried running a command without forcing it hash cat just spits
out that error and throws up its hands.
If you run into this problem you'll also need to use the TAC task force but realistically this is a
strong indication that you need better hardware for cracking complex passwords.
Also keep in mind that just because hash cat and Cali seem to hate each other with a passion The program
is still available for other operating systems that handle open S.L. A lot better.
You can even use windows if you really need to.
OK.
We can see that it cracked the first of the three passwords didn't take long at all.
Next we'll try the 4 character password that I know is in the file so to do this we're going to add
another question mark a.
So now we're attacking four characters using the all character set.
And again this may take some time.
So I will make a small edit to this recording.
Or maybe not let's actually just give it a minute.
I think this might finish quickly.
Status huh.
All right.
It's still checking but the password has fallen recorded right here.
So our secret password fell quite quickly.
It was all numbers.
The third will not be successful as it is a five character long password.
And we told hash cat to only check for four characters.
I could add a fifth question mark a.
And try to crack the final one but I think you get the idea of how this works.
Now I mentioned earlier that hash cat stores cracked passwords in a pot file unless you specify otherwise.
I should also mention that this pot file has a different file extension and is located in different
places depending on which version of hash cat you're running.
I just about pulled my hair out looking for hash cat dog pot but for this current version it is in fact
hash cat dot pot file so it is located in city till the forward slash period hash Katz the file was
created the first time you crack a hash and will be added to forever after it would cap the file
we can see the passwords hash cactus cracked I actually removed the file between demonstrations so the
first set of plaintext passwords that you saw me crack are not contained here.
The reason is that once hash cat cracks a particular file and ends the session it doesn't always want
to start again.
If passwords related to the file are already stored in the pot file if you wish to crack a file a second
time or if you find you're having difficulty in starting a pash cat against a target that has already
been mostly cracked.
I recommend you backup the hash cat dot pot file somewhere else and then delete it out of this directory.
That should fix the issue.
Keep in mind also that will using masks lesser passwords may still fall to hash cat even when trying
to crack greater ones.
What I mean by this is if you specify six characters for all character sets passwords less than six
characters long can still be attacked as long as you go ahead and increment your attack by using the
attack.
I switch in other words if you specify six characters but use tack I hash cat will start with all single
characters then all combinations of two then all combinations of three and so on until it reaches the
total number.
And this will take a lot longer but you'll cast a much wider net so to say so.
For example
if we added another two A's and then we said and then we add the tack I
this is what it would look like.
But again this will be very slow particularly on a virtual machine like this one.
So I'm not going to do it but you get the idea.
Now we can typically increment up to seven characters using commodity hardware and a fast hashing algorithm.
Obviously having hash cat running on an operating system that it is installed to on a dedicated partition
using 100 percent of the system resources really is a requirement.
Doing it in virtual box like this just for demonstration purposes is one thing but you're really not
going to get anywhere unless you have full system resources at your disposal.
But after about seven characters things start to get dicey even for the hardware machines.
Eight characters is possible but cracking them will usually take days or even weeks.
Nine characters is also possible but only if you have specialty hardware anything greater than nine
is usually the realm of three letter agencies operated by nation states.
But it certainly isn't impossible if you have the resources and patience.
Just keep in mind that the cracking process may be measured in years.
In any case this has been a basic introduction to the workings of hash cat.
Don't be discouraged if it doesn't work right away for you on Cowley.
A lot of people have a hard time with it.
Play around with the different attack modes and practice cracking a few simple hashes and empty five
and perhaps one other format.
Once you've done this for yourself you'll see that we'll hash cat has a thousand and one approaches
to the science of cracking.
It really is just as straightforward as all the other tools that seem to model themselves in their structure.
Imitating hash cat in any case and this always kind of goes without saying but has to be said anyway.
Never attempt to use this tool or any other tool presented in this class against any target that you
do not personally own or have written permission to penetration test.
Or you could be breaking the law.
I hope you enjoyed this tutorial and I hope that hash Cat works very well for you.
Thank you.