Play by your own rules!

Transcript

1. Play by your own rules! Tatiana Mikhailova
2. Why do we need rules? TO BREAK FREE OF COURSE! Problem 2
3. 3 Using dictionaries with and without rules
4. ./hashcat-cli64.bin -r rule --stdout word Hashcat rules 4
5. wc -l /hashcat/rules/* 5 Testing existing rules Rule set Number of rules best64.rule 64 d3ad0ne.rule 35406 dive.rule 123289 generated.rule 14734 leetspeak.rule 29 oscommerce.rule 256 rockyou-30000.rule 211 # 12000 random rules that produced good results }}}}}}}}*15'4 }}}}}}Y4'4d }}}}}'5'4p1 }}}}}'5 }}}}'4 }}}} }}}: }}} }}D1{ }} }x32 }x14
6. 6 Attack scenario
7. 7 Attack scenario 54b3f4bd6d 43cc7216b7f f064af97926 ….
8. 8 Attack scenario hashcat (rockyou+best64.rule) Password123 Gfhjkmm88 1q2w3e4r5t
9. 9 Attack scenario hashcat (rockyou+best64.rule) Password123 Gfhjkmm88 1q2w3e4r5t
10. Rockyou.txt ~14 000 000 10 Testing rules with the rockyou wordlist Rules Result Number of rules Cracked best64 23.50 64 0 d3ad0ne 50.46 35406 553 dive 54.09 123289 1926 HashManager 47.27 6746 105 PasswordsPro 45.18 3254 50 T0XlC 39.8 4089 63
11. https://github.com/praetorian-inc/Hob0Rules https://github.com/NSAKEY/nsa-rules 11 Existing short rule sets
12. https://github.com/praetorian-inc/Hob0Rules https://github.com/NSAKEY/nsa-rules 12 Existing short rule sets
13. 20k passwords 1. Take password 2. Disassemble i. Find out word ii. Find out mutations 3. goto 1 It’s ery funny and interesting!... The first pass ords 13 Password analysis
14. Password Pattern Bezopasnost’1984 c(translit(rus_word))|year 21011975flower date|word 123Tanya! ^3^2^1c(name)$! vjcrdf2017 layout(r_word)|year Figuring out patterns 14 Pattern Result с(word) Word word|date word12051987 date|word 12051987word word|digits word555, word123 word$(symbol) word!, word% word$c(letter)$(letter) wordAs
15. 15 Patterns and wordlists Wordlist Name, surname Russian word in English layout Russian word in translit English word Patterns c(word)$year c(word) c(word)$d$d c(word)$sequence c(word)$year c(word)$d$d$d c(word)$d$d c(word)$year c(word)$d$d$d word$d$d$d c(word)$d c(word)$year c(word) c(word)$d c(word)$sequence
16. Re ui e e ts • Logic • Applicability for any word length • Dictionary dependency • Uniqueness E.g. Years, dates, digit sequences 16 Making rule sets
17. 17 Patterns and wordlists p – recovered passwords h – hash file size r – rule size d – dictionary size i – hash file number = ℎ = =0 = ∗ ∗ 6
18. 18 Patterns and wordlists p – recovered passwords h – hash file size r – rule size d – dictionary size i – hash file number = ℎ = =0 = ∗ ∗ 6
19. 19 Patterns and wordlists p – recovered passwords h – hash file size r – rule size d – dictionary size i – hash file number = ℎ = =0 = ∗ ∗ 6
20. • 11000 rules • 100 wordlists • 100 hash lists 32 test lists 24h = 86400 sec 110 000 000/86400= 1273 days 20 Testing 11000*100*100=110 000 000
21. 21 Wow, finished!
22. Wordlist + Rule String apply_rule(String word, String rule) 22 Testing architecture Recovered passwords Hash files Rules Wordlists ? Result
23. Popular rules: ]] $1 ]]c co93 ]]] ‘7$1 cTBiB+ [[[[u 23 Wordlists vs password dictionaries Wordlist Rule Password Password dictionary Rule moscow c$2$0$1$7 Moscow2017 Moscow2016 ]$7 o97 moscow c$2$0$1$6$! Moscow2016! Moscow2016 $! kitty $1$2$3 kitty123 Kitty111 l]]$2$3
24. 24 Testing again 1. Make short rule sets a. best64 b. best32 2. Testing a. Compare results with well-known rules 3. Take the best ones 4. ... 5. Profit! !Don’t forget! Train on one data, test on another
25. 25 Results Rules Result best64.rule 8.75 hoboRules.rule 8.97 nsa.rule 7.88 best32.rule_1 9.13 best32.rule_2 9.82 best64.rule_1 10.91 best64.rule_2 11.22 best64_1 29.36 best64_2 29.32 best32_1 25.41 best32_2 25.85 best64 23.50 *rockyou
26. 26 Best rules : $2 $9 $0 $2$3 c $1 $3 c$! $1$1 $4 c$1 $1$2$3 $5 c$1$2 $1$2$3$4 $6 c$1$2$3 $1$2$3$4$5 $7 c$1$2$3$4 $1$2$3$4$5$6 $8 c$1$2$3$4$5 c$1$2$3$4$5$6 c$2 c$3 c$2$0$1$6 c$2$0$1$7 crT0r
27. https://github.com/ttmyst/tmyst_rules @imtatyanaa 27 Links