Speaker 1: Welcome to the deep dive, where we plunge into dense
Speaker 1: information and pull out those surprising, impactful nuggets of knowledge,
Speaker 1: all crafted just for you. Today, we're navigating a world
Speaker 1: that's more interconnected than ever. Our digital lives, every transaction,
Speaker 1: every connection, every piece of personal information flows through this
Speaker 1: vast network, making the art of safe collecting it not
Speaker 1: just important but absolutely critical.
Speaker 2: And at the heart of that safeguarding, ironically often lies
Speaker 2: its weakest point, what we call authentication hacking or password cracking.
Speaker 2: It's a fascinating blend of art and science, like finding
Speaker 2: the digital skeleton key. Whether you're an attacker trying to
Speaker 2: get in or an ethical security tester trying to keep
Speaker 2: them out, understanding this process is fundamental.
Speaker 1: Right, and our mission today is to pull back the
Speaker 1: curtain on this complex world. We're going to unveil the
Speaker 1: layers of security that shield our digital identities, exploring the
Speaker 1: very arsenal of tools wielded by malicious actors, but crucially
Speaker 1: also by the pen testers and red teams who assess
Speaker 1: and strengthen digital fortifications. Our goal for you is to
Speaker 1: walk away with knowledge that empowers you to bolster your
Speaker 1: own defenses or to better understand vulnerabilities in your environment.
Speaker 2: And we're drawing our insights from an excellent source, Daniel
Speaker 2: WD Delee's book Password Cracking with Kylie Lennox twenty twenty three.
Speaker 2: Daniel brings a wealth of practical knowledge with over twenty
Speaker 2: years in it and more than a decade focused entirely
Speaker 2: on security research.
Speaker 3: It's a truly valuable perspective.
Speaker 1: So why does all this even matter to you personally
Speaker 1: or professionally? What's truly astounding? Is it? Despite billions spent
Speaker 1: on sophisticated cybersecurity, the weakest link often isn't cutting edge tech.
Speaker 1: It's something we've known for decades. The human element, our brains,
Speaker 1: it turns out, are often the real Achilles heel in
Speaker 1: digital defense.
Speaker 2: That's a profound point. The most common attack methods haven't
Speaker 2: really changed because people continue to make predictable password choices.
Speaker 2: For instance, root force attacks are automated tools that systematically
Speaker 2: guess combinations. This is how one, two, three, four, five,
Speaker 2: six or password get cracked in seconds. It's a low effort,
Speaker 2: high reward.
Speaker 1: So they're just throwing everything at the wall, like literally
Speaker 1: trying everything. What's a step beyond that?
Speaker 2: Well, yeah, essentially automated guessing, but a step up are
Speaker 2: dictionary attacks, which try commonly used words or phrases from
Speaker 2: pre compiled lists. If your password is Summer twenty twenty
Speaker 2: four or even something like Dragon Slayer ninety nine, chances
Speaker 2: are it's on one of those lists.
Speaker 1: Okay, And then there's something called credential stuffing that sounds
Speaker 1: particularly insidious. How does that work?
Speaker 3: It is?
Speaker 2: Credential stuffing takes leaked user name password pairs from one service,
Speaker 2: maybe a forum that had a data breach or an
Speaker 2: old gaming site you forgot about, and then attackers try
Speaker 2: to reuse those exact same combinations to access your accounts
Speaker 2: on other services, think like your banking or email.
Speaker 3: It totally exploits.
Speaker 2: The human tendency to reuse passwords across platforms.
Speaker 1: Wow. Yeah, that's a huge wake up call for unique
Speaker 1: passwords everywhere. Right. And of course there's phishing. We hear
Speaker 1: about it constantly, but how does it fit into the
Speaker 1: password cracking puzzle? Is it really cracking?
Speaker 2: Well, phishing is more of a social engineering attack. It's
Speaker 2: about deception right right, tricking individuals into revealing their passwords
Speaker 2: via fake emails or deceptive websites. While it's not directly
Speaker 2: a cracking method itself, it's a primary way attackers obtain credentials,
Speaker 2: often bypassing the need for any complex cracking at all.
Speaker 2: Users without you know, good security training, are far more
Speaker 2: susceptible to these elaborate scams.
Speaker 1: And when weak passwords are breached, what are the real
Speaker 1: world consequences beyond just a simple log in failure? What
Speaker 1: kind of damage are we actually talking about here?
Speaker 2: Oh, the risks are quite severe for individuals and organizations.
Speaker 2: Breaches often lead to significant financial loss and severe reputational damage.
Speaker 2: For you personally, it could mean identity taft, where cyber
Speaker 2: criminals impersonate you, leading to major financial and frankly emotional distress.
Speaker 1: And it doesn't stop there, does it. Once one account
Speaker 1: is compromised, what else can an attacker potentially do?
Speaker 3: Exactly?
Speaker 2: They can use your compromise account to send Mali emails,
Speaker 2: make unauthorized transactions, maybe even spread malware, effectively turning your
Speaker 2: digital presence into a weapon. For organizations, this means unauthorized
Speaker 2: access to critical systems, confidential data, proprietary information. The domino
Speaker 2: effect can be absolutely devastating.
Speaker 1: So the answer to this, at least in part is
Speaker 1: simply strong passwords. But what actually makes a password strong
Speaker 1: in this context? Is it just length?
Speaker 2: Length helps, But it's more than that. Passwords with a
Speaker 2: mix of upper and lowercase letters, numbers, and special characters
Speaker 2: significantly increase the time and effort attackers need. Unique passwords
Speaker 2: for each account are your best defense against that credential
Speaker 2: stuffing we mentioned. Think of it as having a different
Speaker 2: key for every door in your life. And you know,
Speaker 2: password managers are excellent tools to help you manage all
Speaker 2: these complex, unique passwords across all your services.
Speaker 3: Highly recommend them.
Speaker 1: It sounds like complexity and uniqueness really pay off. And
Speaker 1: how does that layered defense connect with, say, defending against
Speaker 1: those fishing attacks. Does a strong password help there too?
Speaker 3: Yeah? It does.
Speaker 2: Even if you accidentally click a malicious link in a
Speaker 2: phishing email, or robust unique password makes it much harder
Speaker 2: for attackers to actually gain entry.
Speaker 3: If they somehow get it, it buys you time to react.
Speaker 2: So yes, education, awareness and proactive password management are truly
Speaker 2: crucial for you in this ongoing battle against cyber threats.
Speaker 1: With that frightening why firmly in mind, let's pivot to
Speaker 1: the how how do these digital locks actually work. Let's
Speaker 1: peel back the layers a bit to understand the foundation
Speaker 1: of password security and computers.
Speaker 2: Okay, so, when you set a password, operating systems typically
Speaker 2: don't store the plain texts that would be terrible. Instead,
Speaker 2: they store it in an encrypted form called a password hash.
Speaker 2: Think of a hash as a unique, one way fingerprint
Speaker 2: of your password. You can create the fingerprint from the password,
Speaker 2: but you can't easily get the password back just from
Speaker 2: the fingerprint. That's the key during most security tests. Even
Speaker 2: if you recover user passwords, they'll be in this hash
Speaker 2: form need to be unencrypted or cracked.
Speaker 1: Though it's wild to think that some services still store
Speaker 1: or transmit passwords in plain text, making them incredibly vulnerable.
Speaker 1: But mostly we're talking hashes now. In the Windows world,
Speaker 1: there are a couple of key authentication protocols at play
Speaker 1: right like NTLM and Carberos precisely.
Speaker 2: First, there's NTLM or NTI and land Manager. It's kind
Speaker 2: of a legacy protocol. It uses a challenge response mechanism.
Speaker 2: While it's been around since the early days of Windows,
Speaker 2: it's known to be vulnerable to attacks like past the hash,
Speaker 2: where attackers can use the hash directly without ever needing
Speaker 2: the plain text password scary stuff. It's gradually being replaced
Speaker 2: by more robust methods, thankfully.
Speaker 1: And the more secure option is Carbero's. What's the fundamental
Speaker 1: difference there? How does that work?
Speaker 2: Carberis is a ticket based system. It's designed to be
Speaker 2: more secure, using encrypted tickets to grant access, kind of
Speaker 2: like temporary passes at an event.
Speaker 3: But what's fascinating is.
Speaker 2: That even though Carberra's is inherently more secure, many companies
Speaker 2: still use NTLM, sometimes alongside Carberos. And regardless, both Carbero's
Speaker 2: tickets and NTL and password hashes are frequently targeted by attackers.
Speaker 2: While their authentication protocols differ, the attack process in essence
Speaker 2: is quite similar. Attackers obtain this encrypted password information the
Speaker 2: hash or ticket, and then try to crack it offline.
Speaker 1: That makes perfect sense, obtain the encrypted thing, then crack it.
Speaker 1: And with that understanding of hashes and protocols, we can
Speaker 1: now zero win on a particularly clever attack that directly
Speaker 1: exploits Curbero's, something called kurber roasting. What exactly is happening
Speaker 1: in this attack right?
Speaker 2: Curk roasting it specifically targets the curbero's authentication protocol. Usually
Speaker 2: within active directory environments, that's the Windows Network management System.
Speaker 2: The true cutting of kerber roasting isn't just in cracking
Speaker 2: a password. It's how attackers leverage legitimate system functionalities, the
Speaker 2: very way active directory is designed to work. To turn
Speaker 2: a feature into a pretty formidable vulnerability, an attacker captures
Speaker 2: encrypted service tickets, often specifically targeting service accounts, and then
Speaker 2: and attempts to crack them offline to reveal the plain
Speaker 2: text passwords.
Speaker 1: Okay, so service tickets are key here. How do they
Speaker 1: fit into the carberra's structure. You mentioned tickets before.
Speaker 2: Let's quickly break down the relevant corberra's components. First, there's
Speaker 2: the ticket granting ticket or TGT. You get this when
Speaker 2: you first log into a window system. It's like your
Speaker 2: main entry pass. Then, using that TGT, you can request
Speaker 2: service tickets for specific network resources like file servers or
Speaker 2: web services. These tickets are temporary passes for specific things and.
Speaker 1: The real goldmine for attackers. You mentioned are these service accounts?
Speaker 1: What makes them such high value targets compared to say,
Speaker 1: a regular user account.
Speaker 2: Good question. These accounts are often associated with background services,
Speaker 2: not actual human users. They sometimes have highly privileged access,
Speaker 2: maybe even domain admin rights, which is like having keys
Speaker 2: to the whole kingdom. Crucially, their passwords often aren't changed
Speaker 2: very often, maybe because nobody thinks about them, and sometimes
Speaker 2: they're even set to the minimum allowed domain password length,
Speaker 2: making them we When a service ticket is issued for
Speaker 2: one of these accounts, it's encrypted using that service account's
Speaker 2: secret key, which is derived from its password. That's why
Speaker 2: capturing and cracking these tickets is so appealing to attackers.
Speaker 1: Okay, so they target these potentially powerful, potentially neglected accounts.
Speaker 1: How do attackers actually pull this off in practice? What's
Speaker 1: the typical flow?
Speaker 2: Well, they usually start by identifying and enumerting those service
Speaker 2: accounts in their associated service principal names or SPNs. These
Speaker 2: SPNs are unique identifiers that Kuberro's uses to find a
Speaker 2: specific service on the network. Think of them like a
Speaker 2: mailing address for a service. Then, using a TGT they've
Speaker 2: already pained somehow, they request and capture the service tickets
Speaker 2: for these SPNs.
Speaker 1: Once they've captured the ticket, what's the next step is
Speaker 1: the hard part.
Speaker 2: Over not quite the real work for the attacker begins.
Speaker 2: Then cracking the captured ticket offline. This usually involves brute
Speaker 2: force or dictionary attacks using tools like hashcat or John
Speaker 2: the Ripper.
Speaker 3: Which we'll talk more about.
Speaker 2: They hammer away at the encrypted ticket until they hopefully
Speaker 2: reveal the plaintext password. Sometimes they even employ pass the
Speaker 2: ticket attacks, where they use the captured ticket directly for
Speaker 2: unauthorized access without needing to crack the password at all.
Speaker 2: They just present the valid ticket and get in.
Speaker 1: Wow, it's pretty incredible how specialized the tools are for
Speaker 1: this specific attack. What are some of the go to
Speaker 1: tools for kerberosting that people mine encounter.
Speaker 2: You're right, it's a dedicated toolkit. Rubius, for instance, is
Speaker 2: a powerful C sharp based post exploitation tool specifically for
Speaker 2: interacting with and attacking creberos. It can request tgts and
Speaker 2: service tickets and even automatically perform a kerberos attack. It's
Speaker 2: a favorite for its versatility, definitely.
Speaker 1: And then there's the infamous mimicats. We hear that name
Speaker 1: a lot. What's its role here?
Speaker 2: Mimicats is notoriously well known for extracting all sorts of
Speaker 2: credentials from memory, including cerbero's tickets and NTLM hashes. It's
Speaker 2: also used to facilitate those pass the ticket attacks we
Speaker 2: just discussed. Beyond that, the Kerberos toolkit is a set
Speaker 2: of tools designed specifically to extract ESPNS request tickets and
Speaker 2: crack them using a component called tgs.
Speaker 1: Rep crack, and for the actual heavy lifting of cracking
Speaker 1: the ticket itself. I'm guessing we're talking about the big
Speaker 1: names like hashcat and John.
Speaker 2: The Ripper precisely, they are the workhorses for the offline
Speaker 2: decryption part. And finally, there's Bloodhound. Bloodhound is an active
Speaker 2: directory analysis tool that helps security professionals and unfortunately attackers,
Speaker 2: identify those kerbero ostable accounts. It maps out relationships and
Speaker 2: potential attack paths within the network, aiding in the planning
Speaker 2: phase before an attack even begins.
Speaker 1: So what does this all mean for you listening? These
Speaker 1: tools are indeed used by malicious attackers to compromise security,
Speaker 1: that's the scary part. But it's crucial to understand that
Speaker 1: security professionals also use these very same tools for ethical
Speaker 1: hacking or penetration testing. They employ them to identify and
Speaker 1: address vulnerabilities before the bad actors can exploit them. It's
Speaker 1: a constant arms race.
Speaker 2: Really, that's a great way to put it, and at
Speaker 2: the foundation of almost all all password cracking, whether it's
Speaker 2: NTLM hashes or Corbero's tickets, is one critical component the
Speaker 2: word list. These are the well the foundation to password tracking.
Speaker 2: They're essentially text files filled with potential passwords that cracking
Speaker 2: programs use to compare against the target hashes or tickets.
Speaker 1: So it's not just random guessing. Then you're essentially comparing
Speaker 1: your target against a known or generated list. How do
Speaker 1: these cracking programs actually use these lists? Do they just
Speaker 1: try each word?
Speaker 2: They work by either taking words directly from the list,
Speaker 2: hashing them using the right algorithm, and comparing them to
Speaker 2: the target hash. That's a simple way, or more advanced
Speaker 2: programs will manipulate these words using rules. Think of it
Speaker 2: like automatically adding prefixes, suffixes, numbers, dates, or even converting
Speaker 2: words to leats speak, you know, replacing an e with
Speaker 2: a three and oh a zero to create tons of
Speaker 2: new combinations to try.
Speaker 1: It Really all comes back to human behavior, doesn't it.
Speaker 1: Our habits, our predictability are the vulnerability these lists exploit.
Speaker 2: They absolute people are creatures of habit and patterns. When
Speaker 2: it comes to passwords, we often use names, important dates,
Speaker 2: maybe pet names, numbers. A very common pattern scene is
Speaker 2: passwords starting with a capital letter and ending with the symbol,
Speaker 2: or maybe incorporating a year like the current one.
Speaker 3: It's often quite predictable.
Speaker 1: Where do these massive word lists even come from. Do
Speaker 1: people just sit and type them out?
Speaker 3: Huh?
Speaker 2: No?
Speaker 1: Not.
Speaker 2: Usually they come from various sources. Publicly leaked password dumps
Speaker 2: from past data breaches are a huge source combinations of
Speaker 2: different leaks. You can also find foreign language word lists
Speaker 2: or even full dictionary and encyclopedia dumps. And ethical pen
Speaker 2: testers will also create custom word lists using company specific
Speaker 2: data like employee names, local sports teams, phone numbers, email addresses.
Speaker 2: Knowing people often incorporate these personal or local details into
Speaker 2: the passwords. It's about thinking like the user you're testing.
Speaker 1: I know Callie. Linux, the security focused operating system we mentioned,
Speaker 1: actually includes several word lists right out of the box.
Speaker 1: Which ones are commonly used or known?
Speaker 2: Yeah, Collee comes packed with useful stuff. One of the
Speaker 2: most popular is the Rocky word list, which is just
Speaker 2: a massive collection of millions of actual passwords recovered from
Speaker 2: a specific database dump years ago. It's a snapshot of
Speaker 2: real compromise passwords. There's also a word list included with
Speaker 2: John the Repper itself, and things like wfuzz wordlists, which
Speaker 2: are more useful for web stuff like finding hidden directories
Speaker 2: or files.
Speaker 1: Beyond these pre made lists, I hear there are powerful
Speaker 1: tools that let you generate custom word lists on the fly.
Speaker 1: Tell me about CWL for example.
Speaker 2: Right. CWL Custom Wordless Generator is pretty neat. It crawls
Speaker 2: target websites to build custom theme based word lists. It
Speaker 2: pulls words related to a company or its industry. So
Speaker 2: if you're targeting say Acmecorp, it might scrape their website
Speaker 2: for terms like widget innovation, maybe product names, executive names.
Speaker 3: Stuff like that. It makes the list more relevant.
Speaker 1: That's clever tailoring the attack. And then there's Crunch, which
Speaker 1: sounds like it can build lists completely from the ground up.
Speaker 2: Crunch is fantastic for that. It lets you create custom
Speaker 2: password lists totally from scratch. You get precise control over
Speaker 2: the length of complexity of the character sets used. It
Speaker 2: can build simple sequential permutations like going from a tog's
Speaker 2: or much more complex alphanumeric or even Unicode combinations by
Speaker 2: using its charset dot LST files. It's for when you
Speaker 2: have a very specific pattern or guests in mind that's
Speaker 2: not in a standard list.
Speaker 1: And here's a surprising fact that kind of blew my
Speaker 1: mind when I read it. Hashcat itself, the cracking engine
Speaker 1: we'll talk more about soon, can actually create word lists.
Speaker 1: How does that work?
Speaker 2: Yes, again, it's a bit counterintuitive, but you use its
Speaker 2: normal attack commands with a special switch start out. This
Speaker 2: essentially tells hashcat to output the passwords it's generating based
Speaker 2: on rules or masks directly to the screen or a
Speaker 2: file as a word list, instead of comparing them to
Speaker 2: a hash. It's a really versatile feature for generating candidates.
Speaker 1: And if you really want to get granular with combining lists,
Speaker 1: there are hashcat utilities like Common and Combinator three. What
Speaker 1: do those do? Specifically?
Speaker 2: These tools are all about combining existing word lists. For instance,
Speaker 2: combinator might take red from one list and bike from
Speaker 2: another to create red Bike. Combinator three is even more complex.
Speaker 2: Just be warned, and this is a serious warning. They
Speaker 2: can generate massive output files, absolutely huge. They will quickly
Speaker 2: fill up even a large hard drive if you're not careful.
Speaker 2: We're talking potentially gigabytes, even terabytes of potential passwords.
Speaker 1: Okay, noted, don't accidentally fill your hard drive trying to
Speaker 1: make a word list. And then there's a niche but
Speaker 1: surprisingly effective technique called keymp walking implemented by a tool
Speaker 1: called kW processor. Can you explain that when it sounds unusual?
Speaker 2: Yeah, it is a bit unusual, but based on real behavior.
Speaker 2: It creates passwords by literally walking across a keyboard layout.
Speaker 2: Imagine starting at the zec, then moving up and write
Speaker 2: to a Q one, maybe creating a password like zac one.
Speaker 2: It's based on the idea that people might unconsciously create
Speaker 2: simple patterns on their keyboard when making passwords. Aw processor
Speaker 2: generates word lists based on these physical patterns, even for
Speaker 2: foreign language keyboard layouts.
Speaker 1: What stands out to me here listening to all this
Speaker 1: is the sheer variety and specificity of how word lists
Speaker 1: can be generated. It really underscores how deeply attackers and
Speaker 1: defenders have studied human habits and patterns in password creation.
Speaker 1: It's a constant cat and mouse game rooted in like
Speaker 1: human psychology.
Speaker 2: That's spot on, it really is. So once you have
Speaker 2: your potential weapon, your word list, the next crucial step
Speaker 2: in password cracking is identifying the hash type you're up against.
Speaker 2: You absolutely need to know the hash type so you
Speaker 2: can tell your cracking program what decryption algorithm to use.
Speaker 2: It's like knowing what kind of lock you're trying to pick.
Speaker 2: You need the right tool, the right technique.
Speaker 1: So there are different types of hashes, not just one.
Speaker 2: Hash, absolutely loads of them. There's the old ELM hash,
Speaker 2: which is thankfully outdated and very insecure, easily cracked, not
Speaker 2: widely used anymore. Then the NTLM hash, which combines the
Speaker 2: LM hash and nt hash, commonly found in Windows SAM
Speaker 2: databases or domain controller databases.
Speaker 3: That's a big one.
Speaker 2: You also have NTLMB one and NTLMB two, which are
Speaker 2: a challenge response hashes often captured in network really attacks.
Speaker 3: They're different.
Speaker 1: Again.
Speaker 2: Luckily, there are hash identification tools like hash identifier and
Speaker 2: hash id and calie Linux that help determine the hashtype
Speaker 2: from a sample, which is critical before you even begin
Speaker 2: trying to crack it.
Speaker 1: And for cracking maybe simpler passwords, especially those older LM
Speaker 1: or NTLM hashes, you might not even need a powerful
Speaker 1: local tool. Right, I've heard of online crackers. Yeah, how
Speaker 1: do those work? And importantly are they safe to use?
Speaker 3: Yeah?
Speaker 2: There are online crackers like crackstation. They use massive pre
Speaker 2: computed lookup tables often called rainbow tables, to return passwords
Speaker 2: in mere seconds for common hashes. If a hash for
Speaker 2: password or one, two, three, four, five six is uploaded,
Speaker 2: it's cracked almost instantly because those hashes have been seen
Speaker 2: and cracked millions of times before. But and this is
Speaker 2: a strong word of caution, be extremely Some online crackers
Speaker 2: might run crypto miners like bitcoin miners in your browser
Speaker 2: as payment for their service, often without telling you. Plus,
Speaker 2: you're uploading potentially sensitive hash data to an unknown third party.
Speaker 2: For any serious secure cracking, especially in a professional context,
Speaker 2: you'll definitely want to turn to offline tools you control.
Speaker 1: Okay, good advice, avoid the sketchy online ones. So when
Speaker 1: we do need a local, powerful tool, where does someone
Speaker 1: even begin? Is there a classic first stop cracker For
Speaker 1: maybe easier targets.
Speaker 2: Absolutely, for the low hanging fruit as we call it,
Speaker 2: or maybe shorter passwords, you'd often turn first to John
Speaker 2: the Ripper or just JTR. It's a fast, open source,
Speaker 2: primarily CPU based password cracker. It's incredibly versatile, supports hundreds
Speaker 2: of hash types, performs dictionary and hybrid attacks, and it
Speaker 2: runs on multiple platforms Linux, Windows, Mac. You simply pointed
Speaker 2: out a file containing your hashes on password hash list
Speaker 2: and it goes to work. It even cleverly stores the
Speaker 2: cracked passwords it finds in its pot file, so you
Speaker 2: don't lose them and don't have to recrack them.
Speaker 1: Undroop is good for a quick win. Maybe it hits
Speaker 1: the easy stuff first, But when you need serious speed
Speaker 1: for those really tough, long, complex hashes, what's the go to?
Speaker 1: What's the big gun.
Speaker 2: When you need serious computational muscle, you turn to hashcat.
Speaker 2: This is generally considered the king. It's an all purpose
Speaker 2: GPU based cracker. It uses your graphics card, though it
Speaker 2: can use your CPU if needed. It's widely touted as
Speaker 2: the world's fastest and most advanced password cracker. We're talking
Speaker 2: potentially with high end hardware billions, even trillions of hashes
Speaker 2: per second. The sheer parallel processing power of modern graphics
Speaker 2: cards is just perfectly suited for this kind of repetitive
Speaker 2: guessing work.
Speaker 1: Billions, trillions, that's just an insane amount of computational power
Speaker 1: being thrown at the problem. It really puts weak passwords
Speaker 1: into perspective. So when you're using hashcat, what kind of
Speaker 1: information you need to feed it to get it started? Right?
Speaker 2: Hashcat needs a few key pieces of information to run effectively.
Speaker 2: You need to tell it the hash type using a
Speaker 2: specific mode number. You need the file containing the uncre
Speaker 2: hashes you want to attack. You need the dictionary or
Speaker 2: wordless to use. Unless you're doing a pure brute force attack.
Speaker 2: You need to specify where to put the output file
Speaker 2: with any cracked passwords. And importantly, you need to specify
Speaker 2: the attack mode using the A switch, which tells hashcat
Speaker 2: how you want it to attack.
Speaker 1: And hashcat has multiple attack modes, right, it's not just
Speaker 1: one way of doing things. How do you tell it
Speaker 1: how to attack a password? What are the main modes?
Speaker 3: Exactly?
Speaker 2: It's like having a specialized tool set within the main
Speaker 2: tool The simplest is straight mode thatatch a zero. This
Speaker 2: just tries words from a single word list, but it
Speaker 2: can use those rules we talked about to modify them
Speaker 2: like capitalization, adding numbers, etc. Then combination mode NASHA one
Speaker 2: gets fascinating. It takes words from two separate word.
Speaker 3: Lists and combines them.
Speaker 2: So if one list has colors and the other has animals,
Speaker 2: it might try red dog, blue cat, and so on.
Speaker 2: You can even tell it to add single characters between
Speaker 2: the words from the two lists.
Speaker 1: Okay, that's clever. What about when you're just throwing raw
Speaker 1: power at it like a true brute force, trying every
Speaker 1: single possibility.
Speaker 2: That's the brute force mode Nashua three. This uses masks.
Speaker 2: Masks are symbolic representations of character sets like L for
Speaker 2: lower case letters, D for digits, numbers, S for symbols,
Speaker 2: and A for any printable ASKI character. You define a
Speaker 2: pattern like ul ldds for maybe a capital letter for
Speaker 2: lowercase two digits and a symbol. Brute forcing everything can
Speaker 2: take an incredibly long time, potentially years or even centuries,
Speaker 2: depending on the link and complexity, but it's sometimes necessary
Speaker 2: when you have no other clues.
Speaker 1: Yeah, that sounds computationally expensive. That's or hybrid attacks must
Speaker 1: come in handy, right. A combination of a word list
Speaker 1: and brute.
Speaker 2: Force yea precisely hybrid attacks like Nagada six and Nneka
Speaker 2: seven combine a word list with a mask. For example,
Speaker 2: take a word from the list and appenda mask words DDD.
Speaker 2: This is much faster than pure brute force because you're
Speaker 2: starting from a likely based word. And then there are
Speaker 2: those rules specified with the inninger R switch, which are
Speaker 2: incredibly powerful. Hashkat can automatically modify words from your list
Speaker 2: on the fly, doing things like lead speak transformations, password
Speaker 2: to P four, sword case toggles, adding prefix of suffixes.
Speaker 2: Popular rule sets like best sixty four and one rule
Speaker 2: to Rule Them all contain hundreds, even thousands of these
Speaker 2: common password modification patterns, saving you from having to guess
Speaker 2: them manually. You can even automate mask attacks by providing
Speaker 2: a file containing multiple different masks for hashcat to try sequentially.
Speaker 1: And then there's something called the Prince processor or PP
Speaker 1: that sounds kind of fancy. What does that do?
Speaker 2: Yeah? PP is pretty clever. It stands for a Prince
Speaker 2: password logic engine. It's an advanced wordless combinator that builds
Speaker 2: new candidate words by combining multiple words found within a
Speaker 2: single word list based on length constraints. It can then
Speaker 2: pipe these newly generated candidate words directly into hashcat for
Speaker 2: immediate cracking without needing to store a huge intermediate file.
Speaker 2: It's a very efficient way to leverage combinations of known
Speaker 2: words or fragments.
Speaker 1: Here's where it gets really interesting. For me, Hashcat's versatility
Speaker 1: means it can crack passwords that aren't just simple dick
Speaker 1: stionary words or basic patterns. Passwords like the book mentions
Speaker 1: spung bobs in lay five y or Henry two thousand
Speaker 1: and nine yuro Oh, these aren't obvious dictionary entries. It
Speaker 1: really shows how sophisticated these tools are and how they
Speaker 1: can adapt to very human, sometimes quirky password.
Speaker 2: Habits absolutely and this leads us naturally into what I
Speaker 2: sometimes think of as the art of war when it
Speaker 2: comes to password cracking, actively looking for patterns. Humans, as
Speaker 2: we've said, are creatures of habit, so patterns almost always
Speaker 2: exist in any large set of cracked passwords from a
Speaker 2: single source, like a company breach. Once you find a pattern,
Speaker 2: maybe everyone uses the company name plus a year or
Speaker 2: ends with SIN or uses keyboard walks, you can create
Speaker 2: custom wordless or rules specifically tailored to exploit those habits.
Speaker 2: This makes your subsequent cracking attempts incredibly efficient.
Speaker 3: For the remaining.
Speaker 1: Hashes, can you give us a real world example of
Speaker 1: finding and exploiting such a pattern?
Speaker 2: Sure? The source material mentions a neat example where pen
Speaker 2: testers noticed people were using HTML or XML character codes
Speaker 2: in their passwords, like using a NAM instead of just
Speaker 2: a simple amper sand it. Once they spotted this trend
Speaker 2: and a few cracked passwords, they realized others might be
Speaker 2: doing it too, so they use tools like Combinator three
Speaker 2: specifically to insert these kinds of HTMLXML codes into their
Speaker 2: existing word lists and ran them again. It's about spotting
Speaker 2: an unusual trend and weaponizing it. But again a big
Speaker 2: warning here. Those combinator tools, especially Combinator three, which does
Speaker 2: complex insertions, can create absolutely huge output files gigabytes terabytes.
Speaker 2: They will fill a hard drive incredibly fast if you're
Speaker 2: not careful, always check your disk space.
Speaker 1: That's a very good practical warning. Okay, So, once you've
Speaker 1: successfully cracked a batch of pathwords using hashcat or John,
Speaker 1: is there way to leverage those cracked passwords to find
Speaker 1: even more from the same list of targets.
Speaker 3: Yes, and it's one of the best advanced techniques. Really.
Speaker 2: You take the plaintext passwords from your successful cracks, you
Speaker 2: parse them out of hashcats or John's output file, the
Speaker 2: pop file. Then you use those already cracked passwords as
Speaker 2: a brand new, highly targeted word list. You run common
Speaker 2: attacks or apply rules or generate masks based on the
Speaker 2: structure of those successful passwords. This exploits the very patterns
Speaker 2: you've just discovered in real user passwords from that specific
Speaker 2: target set. It's incredibly effective.
Speaker 1: That's brilliant. It's like using the enemy's own successful tactics
Speaker 1: against them, like training an AI on real world success data.
Speaker 1: Is there a specific tool to help with that kind
Speaker 1: of analysis and rule generation?
Speaker 3: There is.
Speaker 2: There's a toolkit called PAYK, the Password Analysis and Cracking Kit.
Speaker 2: It's designed specifically for that. It helps you analyze statistics
Speaker 2: from your cracked passwords, common lengths, character sets, base words, patterns,
Speaker 2: and then helps you generate new masks and rules based
Speaker 2: on that analysis to specifically target the remaining uncracked hashes
Speaker 2: more effectively. It refines your attack strategy based on what
Speaker 2: you've already learned.
Speaker 1: Password cracking at its core, then it really does seem
Speaker 1: like a combination of I don't know, chess and lock picking.
Speaker 1: It's about deep analysis, strategy, tool selection, and a fundamental
Speaker 1: understanding of human behavior and.
Speaker 2: Predictability rate analogy. Absolutely. Now, moving briefly away from the
Speaker 2: Windows world, let's touch on cracking Linux passwords. The key
Speaker 2: difference here compared to say, standard Windows and TLM hashes,
Speaker 2: is something called salting. Can you explain what salting does
Speaker 2: and why it's important right?
Speaker 1: Salting. In Linux and many modern systems, passwords are salted.
Speaker 1: This means a unique random string the salt, is generated
Speaker 1: for each user and added to their password before it's hashed.
Speaker 1: This unique salt ensures that even if two users happen
Speaker 1: to choose the exact same password, their stored hashes will
Speaker 1: be completely different because the salts are different. This makes
Speaker 1: cracking much harder because you can't just precalculate hashes for
Speaker 1: common passwords like in Rainbow tables and compare them directly.
Speaker 1: Each hash has to be attacked individually considering its unique salt.
Speaker 1: It vastly increases the difficulty for attackers trying to crack
Speaker 1: multiple passwords at once.
Speaker 2: That's a critical security feature. Absolutely makes bulk cracking much
Speaker 2: less efficient.
Speaker 3: Now.
Speaker 2: To obtain Linux hashes, assuming you've already got root access
Speaker 2: on the system somehow, you can typically just view the
Speaker 2: etcter shadow file. That's where they're started, and when it
Speaker 2: comes to cracking them, John the ripper is actually quite capable.
Speaker 2: It can usually automatically detect the specific hashing algorithms used,
Speaker 2: even the newer, more secure ones like yes script that
Speaker 2: some Linux distributions use now.
Speaker 1: And once passwords are cracked, whether they're Windows or Linux,
Speaker 1: they can often be used to automatically attack other systems
Speaker 1: across the network through something called credential reuse. How does
Speaker 1: that part of an attack typically unfold?
Speaker 2: This is where the initial compromise really snowballs. Tools like hydra,
Speaker 2: Medusa and encrack come into play here. These tools take
Speaker 2: lists of recovered usernames and passwords and automatically try them
Speaker 2: against various network services running on other target systems, things
Speaker 2: like SSH, secure shell, FTP file transfer, maybe web application logins,
Speaker 2: database logins. It's all about leveraging that initial breach, that
Speaker 2: one cracked password to gain widespread access across the network automatically.
Speaker 1: So this really hammers home the critical importance of not
Speaker 1: reusing passwords having long, complex ones, and even more importantly,
Speaker 1: using multi factor authentication wherever possible, because once those passwords
Speaker 1: are cracked, even just one, they can potentially be used
Speaker 1: to launch these widespread automated attacks across an entire network.
Speaker 1: That's terrifying.
Speaker 2: It absolutely is. Multi factor is key. Now, let's shift
Speaker 2: gears slightly and talk about some other password recovery options,
Speaker 2: especially those that come into play when an attacker has
Speaker 2: physical access to a machine. The mantra in cybersecurity has
Speaker 2: long been if you have physical access, you have total access.
Speaker 3: Game over.
Speaker 2: Basically the source material even mentions anecdotes of simple social
Speaker 2: engineering someone with just a tie and a clipboard walking
Speaker 2: into a building and gaining entry, then potentially roaming unsupervised
Speaker 2: near workstations. It's often unsettlingly easy.
Speaker 1: That sounds terrifyingly simple. Just walk in and look like
Speaker 1: you belong. And that kind of physical access leads to
Speaker 1: techniques like the Utelman login bypass. What is that and
Speaker 1: why is it so effective even today?
Speaker 2: The Utelman bypass is a cloud for a reason, and
Speaker 2: yes it still works in many scenarios. It essentially tricks
Speaker 2: Windows into opening a command prompt right on the login
Speaker 2: screen with system privileges without needing a password. Imagine if
Speaker 2: clicking the little accessibility options button that's Utolman suddenly let
Speaker 2: anyone open a terminal and completely take over your computer.
Speaker 3: That's the core idea.
Speaker 2: It typically involves booting the machine with a different operating system.
Speaker 2: Like a Collie LiveCD or USB mounting the Windows drive
Speaker 2: and then replacing the realeutolman dot ex file with a
Speaker 2: copy of cmd dot ex. The command prompt when the
Speaker 2: user clicks the accessibility icon at log in boom system
Speaker 2: command prompt.
Speaker 1: Wow, that's sneaky. And if you combine that eutelma bypass
Speaker 1: with something like mimicats on a USB drive, you can
Speaker 1: actually recover passwords from a locked but running workstation. Right,
Speaker 1: what's the clever trick there?
Speaker 2: Yes, that's another powerful technique. You can potentially extract plaintexts, passwords,
Speaker 2: or hashes directly from the computer's memory RAM on a running,
Speaker 2: locked Windows system. It's fascinating how different keyboard buffers and
Speaker 2: processes work. The trick often involves getting a command shell
Speaker 2: using the utuelman bypass, then running mimicats from a USB
Speaker 2: stick or if you have remote access already via something
Speaker 2: like metasploit, the trick is to migrate your command and
Speaker 2: control shell the metrobriter shell into the specific wind login process.
Speaker 2: That's the process handling the login screen itself, and it
Speaker 2: often holds sensitive user credentials in memory temporarily. By attaching
Speaker 2: to it, you can sometimes dump those credentials, so.
Speaker 1: You're essentially attaching your malicious code directly to the log
Speaker 1: in process itself to try and capture credentials. That's incredibly invasive.
Speaker 1: And what about just straightforward key logging with something like metasploit.
Speaker 2: That's another option with sufficient access. Metasploit, which is a
Speaker 2: popular exploitation framework used by both attackers and pintesters, has
Speaker 2: modules for key logging. You can use commands like keyscan
Speaker 2: start to begin recording keystrokes on a compromise remote system,
Speaker 2: and keyscandem to retrieve what was typed. The aha moment
Speaker 2: here again is realizing that to capture the crucial login
Speaker 2: screen passwords as they're entered, you typically need your keylogger
Speaker 2: running within or monitoring that specific wind log on process
Speaker 2: ID Otherwise you might just get keystrokes typed after the
Speaker 2: user logs in.
Speaker 1: And the book even mentions that Microsoft's own built in
Speaker 1: problem step recorder, usually a benign diagnostic tool for users
Speaker 1: to report issues, can potentially be repurposed by an attacker
Speaker 1: with system access as a kind of remote screen grab
Speaker 1: and user activity logging tool. Let's unpack this for you.
Speaker 1: The listener these more exotic methods involving physical access or
Speaker 1: deep system compromise really highlight the absolutely critical importance of
Speaker 1: physical security. Your digital defenses, your firewalls, your complex passwords.
Speaker 1: They're only as strong as the physical perimeter protecting the
Speaker 1: machines themselves. It's not just about software anymore.
Speaker 3: That's a crucial takeaway.
Speaker 2: Absolutely so, given all these varied password attacks, dictionary brute force,
Speaker 2: curb roasting, physical access methods, how do we actually defend
Speaker 2: against them? It really comes down to taking a proactive
Speaker 2: stance and implementing multiple layers of strong security practices. Its
Speaker 2: defense in depth. First, for those service accounts we talked about,
Speaker 2: regularly rotate their passwords, don't set them once and forget them.
Speaker 2: This reduces the exposure window if a ticket or hash
Speaker 2: is ever compromised.
Speaker 1: And of course you need to implement strong password policies
Speaker 1: for all accounts, not just users, but including those often
Speaker 1: forgotten service accounts. We're talking about minimum length, complexity requirements history,
Speaker 1: so you can't reuse old ones and regular enforced changes.
Speaker 2: Definitely, using Managed Service Accounts MSSAYS or the newer Group
Speaker 2: Managed Service Accounts GMSSAYS and Windows environments can help significantly Here,
Speaker 2: these accounts automatically manage their own passwords, rotating them frequently
Speaker 2: and securely without human intervention, which reduces human error and
Speaker 2: the risk of weak or reused passwords for services, and
Speaker 2: critically always limit service account privileges to the absolute minimum
Speaker 2: necessary for them to function. The principle of lease privilege
Speaker 2: is key. If an account only needs to read files,
Speaker 2: don't give it right access. This reduces the impact if
Speaker 2: it is compromised.
Speaker 1: Continuous monitoring for unusual activity is also vital, isn't it
Speaker 1: Looking for anomalies in Cabero's authentication patterns or sudden surge
Speaker 1: in ticket requests, especially for sensitive accounts, These can indicate
Speaker 1: an ongoing attack even before a password is successfully cracked exactly.
Speaker 2: Proactive monitoring is huge Technically, implementing Courberos armoring, also known
Speaker 2: as Fast Flexible Authentication Secured tunneling, which is available in
Speaker 2: Windows Server twenty twelve R two and newer, helps protect
Speaker 2: against past the ticket attacks by encrypting parts of the
Speaker 2: Curberos exchange usually sent in the clear. Also enable and
Speaker 2: configure sensible Crebero's ticket lifetime policies to limit how long
Speaker 2: tickets are valid. Further, reducing the window of opportunity if
Speaker 2: one is compromised or stolen.
Speaker 1: Another often overlooked but incredibly high value target is the
Speaker 1: krbtgt account in active directory. That's the master key for
Speaker 1: Carberos in the domain. You should monitor and protect it
Speaker 1: vigil with extremely strong, unique passwords changed periodically in offline
Speaker 1: and very limited access. Compromise of this one account can
Speaker 1: be absolutely catastrophic, allowing an attacker to forge any ticket.
Speaker 2: Very true, that's the golden ticket attack vector. And then
Speaker 2: there are newer Windows features like Credential Guard found in
Speaker 2: Windows ten eleven Enterprise and Server twenty sixteen and later.
Speaker 2: It uses virtualization based security to isolate and protect sensitive
Speaker 2: credentials like NTLM hashes and Crebero's tickets in a secure area,
Speaker 2: making them much harder for attackers even those with system
Speaker 2: privileges to extract using tools like mimicats. Also consider enabling
Speaker 2: extended protection for authentication or EPA where possible, which adds
Speaker 2: another layer against certain men in the middle relay attacks.
Speaker 1: And let's not forget the absolute basics. Regularly update and
Speaker 1: patch all your systems, operating systems, applications. Everything This closes
Speaker 1: known vulnerabilities before attackers can even exploit them. Seems obvious,
Speaker 1: but it's amazing how often it's missed. And crucially, educate
Speaker 1: your users and administrators. Raise awareness about the risks of
Speaker 1: weak passwords, phishing, social engineering, Encourage strong password practices and vigilance.
Speaker 1: A security aware user, a human firewall is often your
Speaker 1: very first line of defense.
Speaker 2: Couldn't agree more. Finally, consider network segmentation. If you can
Speaker 2: logically divide your network, it restricts lateral movement for an attacker.
Speaker 2: If one segment is compromised, they can't easily jump from
Speaker 2: a less important system to a critical one. The main
Speaker 2: point is all these defenses.
Speaker 3: Need to be combined. It's not just one thing.
Speaker 2: It requires user education, technical controls, and proactive monitoring. For
Speaker 2: truly enhanced security, it has to be a holistic approach.
Speaker 1: This raises an important question for you, the listeners. Maybe
Speaker 1: ponder how many of these defenses are actually in place
Speaker 1: in your work environment or even protecting your personal digital
Speaker 1: footprint at home. Worth thinking about, and.
Speaker 2: It's important for everyone listening to remember that security testers,
Speaker 2: the people we call ethical hackers or pen testers, use
Speaker 2: the very same tools and techniques we've discussed today as
Speaker 2: malicious hackers do. The key critical difference is authorization and intent.
Speaker 2: Ethical hackers are hired with permission to identify vulnerabilities and
Speaker 2: report them before they can be exploited by criminals. They're
Speaker 2: firmly on the good side, but the methods often look identical,
Speaker 2: and this brings us.
Speaker 1: To a really crucial point about legal and ethical boundaries.
Speaker 1: It is imperative that you never ever run security tools
Speaker 1: or attempt cracking techniques against systems or networks without express,
Speaker 1: written permission from the owner. Doing so, even just out
Speaker 1: of curiosity, can lead to very serious legal prosecution. Don't
Speaker 1: cross that line.
Speaker 3: Absolutely.
Speaker 2: The information we've discussed today is strictly for educational purposes only.
Speaker 2: It doesn't cover every possible scenario you might find in
Speaker 2: a live environment, and things are always changing. We're simply
Speaker 2: conveying ideas and techniques found in the source material and
Speaker 2: general security knowledge. We are absolutely not endorsing any illegal
Speaker 2: or unethical activities. This knowledge is meant to empower you
Speaker 2: to defend yourself and your systems, not to attack others.
Speaker 1: And that's our deep dive into the complex, sometimes scary,
Speaker 1: but utterly fascinating world of password cracking and cybersecurity. We've
Speaker 1: explored the tactics and tools involved, from understanding why weak
Speaker 1: passwords remain such a pervasive risk and how authentication protocols
Speaker 1: like NTLM and Gerbero's work, to diving into the cunning
Speaker 1: of kerb roasting, the foundational power of word lists, and
Speaker 1: the incredible capabilities of cracking engines like John the Ripper
Speaker 1: and of course hashcat.
Speaker 2: We also looked at the art of finding patterns and passwords,
Speaker 2: some advanced cracking techniques, and even those more exotic methods
Speaker 2: involving physical access, reminding us security isn't just digital, and importantly,
Speaker 2: we close with a rundown of crucial defensive measures, technical controls, policies,
Speaker 2: monitoring education to help you fortify your own digital security
Speaker 2: and the security at your organization.
Speaker 1: Our hope is that you'll take what you've learned today
Speaker 1: and really apply it, maybe strengthen your own security posture,
Speaker 1: perhaps by reviewing your personal password hygiene, finally implementing a
Speaker 1: password manager, or maybe initiating a discussion about these concepts
Speaker 1: within your workplace. Awareness is the first step.
Speaker 2: So here's a final thought for you, Tom all Over.
Speaker 2: In a world where our digital keys, our passwords, and
Speaker 2: accounts are constantly under siege. What unexpected physical vulnerability, maybe
Speaker 2: something we haven't even thought of yet, might be the
Speaker 2: next target for the clever adversary. And how does understanding
Speaker 2: this digital landscape better prepare us for securing the tangible
Speaker 2: world around us.
Speaker 1: Thanks for joining us on the deep dive. We'll be
Speaker 1: back soon with more critical insights.