Hacking Complex Passwords with Rules & Munging

Key Takeaways

in a previous video we took a look at how we could crack password hashes inside of C Linux with tools like John the Ripper or hashcat and we took the assumption that the victim the Target that we're trying to crack the password hashes for would use a simple easy like English dictionary word something that you might see like apple or microphone or Western it could be anything just a simple word and we were using things like rock you. text to be able to crack those through a list of dictionary words but most people are at least a little bit smarter than that they might add in some numbers within their password or some special characters like an exclamation point asterisk whatever so in this video we're going to take that example a little bit further assuming that the user is using a relatively strong and complex password with all those numbers and special characters in the mix and how can we as a budding penetration tester or red teamer still crack their password hash now often times if you're performing a penetration test for a company or a business or an organization you might be able to use their public website as a place to get I don't know information that might make or build up part of a password or the user or the individual that you're trying to crack the password hash for has certain interests or they really like some aspect of culture media art which is why I have the marvel.com website up let's say our fictitious user in this scenario really really likes Marvel or Avengers or Guardians of the Galaxy no relation to the movie releasing that I'm going to go see in a few hours it's just what I decided to use for the video and forgive me going to do a little bit of movie Magic here let's say that at least for the sake of the video for demonstrations and for learning sake you already have the hash of the password you already have that user's hash maybe you obtained it in some database dump I don't know breach info that's available public online you just have already obtained this and now our objective is to try and crack this password hash and determine the original PL text value now we know that our user does really like Marvel and because that has an online website you might be able to use a tool called cool or cwl and if I actually take a look at the man page for this it is a custom word list generator based off of a URL or any location online where you might be able to pull down words on a web page specific to the topic or subject that you're looking at in our case Marvel but it could very well just be for the organization or the Business website for the company that you're performing a penetration test for using cool is super duper easy all you have to do is give it the URL of the website or address that you want to end up retrieving all of these words from now note uh I don't exactly want to point this at marvel.com just so I don't have to send this packet to the real marvel.com website what I'm going to do is I'm going to save this page I'm going to rightclick anywhere on the page and hit save page as and then I can go bring this into my Marvel directory and I'll call it like I don't know index.html because what I'll end up doing then is with this local copy I could go ahead and use Python 3 HTTP do server and then spin this up locally on Port 8000 so that way navigating to Local Host Port 8000 I still have all the text maybe not some of the images or media or whatever but that's okay now I can use cool to pull this down on HTTP and it's local and I'm not sketched out about I don't know whatever so while the python server is running I can go ahead and create a new terminal down below and I will use cool to access Local Host on Port 8000 I'll bring this full screen so we can see all the words pulled down here there they all are now a whole lot of these aren't extremely useful or helpful right maybe you don't need a password that is made up of the word leg or small stuff like the word not or then really common English words so just for the sake of speed I'm going to go ahead and send this all to a file that I'll go ahead and open up in a Sublime Text text editor and I want to copy and paste all this because to keep it super duper easy I'm going to go ahead and ask chat GPT if it would be willing to please remove common words from this list okay hit enter and now chat GPT should be doing its thing yeah already cutting up those nice and easy for me now it might not have gotten everything like there's still the word AO or opt or all but at least this is a significantly shorter list than what we started with and we can go validate that by jumping right back into our virtual machine where I had 900 or so words now let me create a new page where I'll paste all this in replace every comma with a new line I'm using crl h on the keyboard to do that and then Control Alt Enter to replace all of them I'll select all withr a and then I can just hit shift tab to remove all the white space at the beginning and now I have only 352 words as opposed to whatever Giant M passive thing that we started with uh I am going to want to convert all of this to lowercase for the sake of our press the I believe button demonstration but now let me save this as uh words we can overwrite the one that we started with and we'll just use these now you might be thinking hey this looks a lot like rock you. text sort of kind of right the least good listing of dictionary words and you're totally right maybe there is going to be a password that is simply the word Champions or lifestyle or Marvel or whatever but in this case we know it's not going to be the case we could fire it up you know we could just say uh run John the Ripper on our hash with our word list being the words but nothing is going to come of it because it's just not right there aren't any passwords that match that hash in that this is when you start to expand your Brute Force search using the dictionary words as you're kind of hammering the password with them but we want to be able to expand or tweak or change each of the entries in our word list to have some more mutations towards it like the I don't know uppercase lowercase letters LE speak in some cases replacing an a with an at sign or an E with the number three exclamation points you know the drill now a super well-known way to do this is to use rules other arguments that you could pass to John the Ripper or hashcat where you can supply different rules or criteria that could mangle and munge and mess with the passwords that you supply in your word list and they referenced this when they were doing some research this is not so secure that ended up taking the rock you. text dictionary using a whole lot of other well-known rule sets that could manipulate the passwords in the list here and a couple of them had some really great effects so they ultimately created this one rule to rule them all file that you can go ahead and download it's on GitHub it's a available and I'll try to add a link in the description and it's basically the one rule to rule them all you can just use this and trusted it it will do everything that it can to find the best password representation here in the repository if you take a look at view code there is the one rule to rule the M file opening this up we could probably take a look at the view raw representation it is a big file though this same way Rock you. Tex is pretty massive so it takes a little bit for it to load here but take a look this is all the special syntax The Secret Sauce the magic that manipulates these passwords and everything in the word list in some unique way truthfully you can kind of Hit the I believe button here we're going to see it in action once we fire it up I'll hit view raw and then I can just simply save this file with contrl s yet again I'm going to go and put this in my op directory as one rule to roll them all hit save now back on our terminal we still have our words file right all of the words the dictionary words and the dictionary list that we've created from pulling these down from marvel.com now not all of these might be applicable but maybe some are uh specific to movies or Media or any characters and culture of course throughout the Marvel universe so we want to take this list and use our one rule to rule them all rule set for our password cracking utility like John the Ripper or hashcat you can just as easily Supply these arguments to hashcat but the same way that we took a look at our hash that we wanted to beat up we supplied our word list as our words in the current directory right and then we can supply our rules uh we'll Supply our opt one rule to rule them all file that we've just downloaded now I'll let enter on this and you can see that John the Ripper is going to get cruising we can tell look this looks like a bcrypt hash but we might have to let John the Ripper do its thing and try to cruise through this uh I don't know if it's going to crack the password here you can hit enter or any key if you want to get a little bit of an up update on what it might be cruising through and you know looking back maybe it would have been smarter to tell Chad GPT to trim this list down to only Marvel related characters or words and terms but oh no it looks like it did complete and it did not crack the password okay so we still have some work to do I want to reiterate this idea of munging passwords and mangling them and doing something different like those Le speak techniques or anything simple that maybe the rules file might do but it might not uh we could try to display it crank it out and see what it does does but you know what maybe there are some other utilities that we could add to our Arsenal here one of these is a dirty little python script that will munge dictionary words into possible passwords say if you give it dictionary. text with a level that you could Supply it'll output a munge to representation of it let me show you this if I view the code here using this munged utility you might be able to take all of those words present in your dictionary file dictionary list and then manipulate them and tweak them so that there are other letters or characters representing different ways like lead speak or adding exclamation points or having numbers added at the end these look like more secure quote unquote complicated passwords or at least a little bit more complexity that will make it a stronger password hey before we go any further your password should not look like this you should not be using a password that is at least remotely even some way based off of an English dictionary word whatever lead speak numbers exclamation points in the way you should be using a password manager that can randomly generate all of your passwords and you're never using the same password for multiple sites that's why I'm super excited to have a little bit more love to today's sponsor of this video passbolt I don't know any of my passwords I don't know what they are they're all crazy long and complex they even have emojis in them and that's because I use a password manager and I'm a huge advocate for using a password manager to generate completely unique and secure passwords for each service or account you use and personally I use passbolt it's become my daily driver and main password manager passbolt is a free and open-source password manager that allows both individuals and team members to store and share passwords securely I absolutely love how easy passbolt is to use and how you can make it solely your own you control your data you can host your own passport management instance completely for free and run it on your own Linux servers or Raspberry Pi or deploy it straight to the cloud with hosting providers like AWS or digital Ocean or just let passport handle it all for you you can easily create and store passwords and autofill wherever you need to with the passbolt browser extension and their mobile app that even has Biometrics for quick and easy authentication on top of that passbolt is completely open source you can look through the code on GitHub extend it with the rest API integrate with it on the command line and even contribute and hack on the code best of all they are a th% passionate about hearing from the community they want the feedback to make your password manager the best it can be now including two Factor authentication on free accounts and even transitioning more of the subscription TI your features into their Community Edition I love it you can get started with passbolt for free with my link below in the video description their Cloud instance is incredibly easy to spin up and they take extra precautions to keep everything secure even with a private key backup codes and a unique color and pin to protect you against fishing attacks it is password security done the right way with passbolt huge thanks to passbolt for sponsoring this video take note that this is an old utility over on GitHub from the secret agent it's actually in Python 2 which makes me cringe and I feel not okay using it uh but hey maybe this is another sweet exercise for the reader or The Watcher if anyone is interested it'd be really really cool to see your rendition of a tool like this maybe some code maybe some sweet utility that could replace a whole lot of letters characters symbols with their lead speak equivalent or try to tack on pen to pre-end uh things that could make it more complicated password right so let me change directory into opt I'll go ahead and get clone this munge repository now I can move into that directory and m.p is ready to rock it is going to run in this case with python 2 bear in mind it needs parentheses around the call to print which tells me hey you probably want to do that with python to now it will need to supply the arguments uh the L argument of that flag or parameter is the level by default it's five but we can crank that up to nine and let's Supply the input and the output that could come out onto the uh public uh standard output right so let me run this with python 2 we'll Supply the TAC L level for nine our input file which is our Marvel words and then we can output this into Marvel uh munged how about that okay looks like it did what it said it would do now let's take a look at what that file looks like ooh okay cool we have a ton of stuff all about these different durations drop shadow proportional I see spider in the mix here I don't know could we find our storm Breakers Galaxy Scarlet Marvel of course this is perfect this looks like at least a better list and if we were to use this in combination with our John the Ripper or hashcat rules then maybe we could get something pretty awesome here now with all of the ingredients put together here our munged password list our rules we can go ahead and try to run this with John the Ripper I'll use the hash that we've been working with I'll specify our word list can equal our current munged set in our current location and directory here and let's use our rules as opt one rule to rule them all. rule there we go let's see if we get any luck now obviously we have significantly expanded the length of our word list right and we were even using the rules to keep tweaking them as it goes through its iterations trying to crack the password hash so this might take a little bit of time and just be aware you are just going to be continuously making your list longer and longer every time you use tools like this again this will take a little bit of time so I can go ahead and press a space key or enter or whatever it takes to be able to see uh what is the status currently what are you looking at in the current iteration of our Loop I'll zoom out just a bit so we can see this thing when it pops if it does but take a look at all of the munged different passwords that it might be trying over on the right hand side I'll bring these up I'll keep hitting enter and uh look at these these look like more secure passwords not just a stupid easy Dumbo English word out of the dictionary right still taken a bit of time here oh okay looks like it got it check it out password was Galaxy 77 with at signs replaced for the A's in the cheesy stupid Le speak and that's it John the Ripper has successfully cracked the password hash for the user that we were targeting all about that interest in Marvel using cool to be able ble to grab the word list using rules to be able to mangle and Mudge the passwords and even taking it a step further by trying to mangle it ahead of time super quick one last magic trick to show you uh if you haven't heard of collab cat it's a very very cool thing it's how you can run hashcat on Google collab and that way it's online in the cloud and you're actually using some of the hardcore resources that are available online like if your computer is too slow like if it takes a little bit of time whether in your virtual machine or your machine itself right it might still need some CPU processing or GPU that it could take advantage of and that's why you could fire stuff up on collab cat and Google collab you could set the hardware accelerator to GPU you could have it install hashcat and use rules and add your own word list do whatever the heck you want you can fire it up with a super duper simple collab Cat Project this is a lot like just a jupyter notebook you could go ahead and have it run different commands things that are already staged for you or you can use your Google drive to upload all of these specific hashes that you want to crack collab cat does already automatically pull down the rocku list and other SE lists available from Daniel myler's repository which is awesome he's an incredible fellow and I just think it's very very cool hey you know what you could get hashcat Rockin with a much more resources than maybe your computer has and it's all stored backed up and accessible online and that's it that is how we can crack the password hash of a user that might be interested in something specific or has at least some narrowed scope and the password base that we could come from like using cool the wordless generator from a unique specific website and then mangling the passwords a little bit ahead of time with some Standalone tools and then ultimately using rules with our password hash cracker like John the Ripper or hashcat super duper cool and I hope a little bit worthwhile for what you might be up to in penetration testing red teaming Etc but look your password should not look like this please please please if you aren't using a password manager you absolutely should be give passw a try and please send some love to our sponsors thanks so much for watching hope you enjoy this video like comment subscribe YouTube algorithm stuff see you in the next video