DEMO: Password Cracking with hashcat

One of the most popular tools for password cracking is hashcat. Let's take a look at hashcat and how we would use it. This lesson is for educational and ethical hacking purposes only. This is only meant to protect systems, not to compromise systems.

The syntax

Here's the syntax for hashcat. We start out with the command hashcat. We specify the mode that we're going to use. We give it a hash. And then we have a word list. There's of course a lot more options, but this is just what we're going to start with.

Creating a password to crack

I'm on a Kali Linux box and I have a terminal window open. What we're going to do is first of all create a password to crack. Since passwords are stored as hashes, we need to create that hash. So what we're going to do is create a hash out of a password. I'm going to do this: echo -n monkey1, and MD5. So we're going to do this as an MD5 hash, and monkey1 is the password, so we'll use that. And there is now the hash for that password.

The next thing I need is a word list. So I created a word list. Let's go ahead and take a look at that. I'm going to do nano wordlist.txt. And you can see I've just got a few passwords in here, some variations of the word password. monkey1 is in here because of course that's what we're going to be hacking here, or trying to figure out.

Cracking the password

So what we're going to do is I'm going to get out of here, and the next thing is we need to form our hashcat command line in order to start cracking this password. The command for this is hashcat, and -m for the mode, and we are going to do mode zero. Then we're going to paste this hash into here, so I'm going to paste that selection, and then we're going to use that word list, so wordlist.txt, and then we're going to hit enter.

So what it's doing is going through the process of hashing this, and then it finds it. It says that this is the hash right here, and it is monkey1. So we've now cracked this password. We've taken this hash and figured out what the password is on it. You can see how many total that it went through, and it recovered one password, and because you can actually feed this multiple passwords, it just gives us some stats on what it can look through to find and crack this password.

Word lists

One of the things that we're feeding it is a word list. So what do these word lists do? If we take a look at this word list, I'm going to do cat wordlist.txt, we'll hit enter. And it's just got some passwords in here that it's going to check against. So essentially what's happening is it is hashing these passwords and then checking that hash across the hash that I've given it, and once it finds a match, then it says, oh well that's the password right there.

But this is a really short list. Obviously there's going to be a lot of other variations of passwords out there that we want to check it against. What we can do is go and find a password list and use that password list. I found a password list and let's take a look at it. The password list that we are going to use is rockyou. This is a popular one out there to use, it's rockyou.txt. So I'm going to just take a look in this, and we can see that this is actually going to go on for a long time. This is a really long list of potential passwords and a lot of the common ones that are seen out there.

Just to show you how big this is, I'm going to stop this from going, and we're going to do a word count of this rockyou.txt file. So let's go ahead and do the word count of that. And as you can see, there is 14,344,391 passwords that are in there. So it's quite a large database of passwords. This is a lot faster than a typical brute force attack, because even though it still checks a lot of passwords, over 14 million passwords, it still is fairly small compared to a brute force attack where it's got to go through every single combination of passwords.

So a word list is just a series of words that it's going to check against. And there are many different word lists that are out there. What some people have done is they've chosen a couple word lists that they really like and merged them together to create one master word list for them.

Hash modes

Another thing that we're feeding is this hash mode. So the -0 is the hash mode. Essentially we have a lot of different hashing algorithms, and with these different hashing algorithms we need to specify what algorithm is being used.

Back on our Kali box, we're going to open up hashcat using this menu item. Of course we can get to the manual in other ways, but this is one fast way that we can see all of the different commands and how to form our syntax for this command. One of the things that it goes over is the hash modes. That's what you're seeing right now, is all the hash modes, and as you can see there's a lot of different hash modes that are out there, and we specify a number. So we specified the hash mode of zero, which is MD5, but there are other ones as well, such as 100 specifies SHA-1, or we could do a 1400 to specify SHA-2 256. So really what we need to do is, whatever was used to hash the password to begin with, we have to choose the same hashing algorithm in order to try to crack this password.

We're not only going to have to specify what the hashing algorithm that we're using is, but we're going to also have to specify what form the salt is going to come in. As I mentioned before, the salt might come at the beginning of the password, or at the end of the password, or somewhere in between in the password, or utilized in some other way. So we're going to have to specify how that format looks. So it's not just the algorithm, it's also how it's going to be formatted and calculated, and the mode specifies this as well.

So for instance we can see here a series of MD5 hashes here. What we have is we can choose 10, and if you notice 10 is MD5 password and salt, versus 20 is the salt and password, and 3800 is salt password salt. So depending on how we're feeding it this information and how it needs to be calculated, we're going to have to choose a different mode in order to specify how it's going to be processed.

If you can see here on the right side, there are some different categories here as well. So we're looking at the salted, not just the straight hashes here. And then network protocols. We've also got the operating systems, so even the different operating systems could have different ways in which they hash things. So here we have the ASA MD5 hash, or the Cisco IOS and how it's hashed, and Citrix and macOS and SQL and NTLM which would be Windows. We also have some other Windows ones in here. So we can see that there's a wide range of vendor specific ones in here as well. We also see some database servers in here like Microsoft SQL databases and how they're hashed. So really just a lot of different ways in which we could carry out these hashing techniques, and so there's a lot of different ways that we need to carry out the cracking of those passwords, of those hashes.

Attack modes

So we've got the command, we've got the attack mode, we use some sort of word list, we put in the hash. By the way, we could also put in a file of hashes as well. We also have an attack mode, so we can specify what the attack mode is going to be in order to carry out our attack. I'm going to get more into those in other lessons, but just to point it out that there's a rough translation between those attack modes and what types of attacks we can do, whether we're doing a brute force or a dictionary attack, or how we're constructing the type of attack that we're doing.