All right.
Picking up where we left off.
We're going to utilize a tool called hash cat hash cat is built into your Kelly Linux machine.
Though we're going to talk pros and cons of that here in just a second.
Hash cat is a tool utilized to crack hashes.
And we're going to run it first on our Linux machine in our VM and then we're going to try running it
elsewhere and just take a look at speed differences.
So what I want you to do is actually cap capture this whole hash.
We're gonna copy it and we'll just do something like get it and tell em hash dot text.
It's fine.
And we'll paste that bad boy into here and just hit save.
Now we're going to need to set up our hash cap so our hash cat is going to look something like this.
So it's going to say hash cat and then we're going to have to do a module of fifty six hundred and just
type this in with me.
I'm going to go ahead and show you what it means in just a second.
Then we need our file that we're going to attempt to crack which is going to be A.L. M hash out texts
and we're gonna need a word list so we don't have the word list yet.
I'm going to show you where you can find that.
So first things first.
What the heck is this.
And fifty six hundred.
So if we go to a new tab and we just say hash cat dash dash help.
Well it tells us a bunch different ways that we can attack hashes here.
There's all different kinds of settings when it comes to hash cat.
But what we're after is a module right.
And look at all these different hashes we can crack.
Now some of these might sound familiar like empty five SHA 1 etc. But you know this is a long list of
modules and here are all the different numbers that we have to go through and we have to look through
these to find what we're after.
So here's the net and tell em be two which is fifty six hundred.
Now we could do a little bit of Linux Fu here and just you know narrow this down so we can say carve
up hash cat dash help.
And then what if we just say graph and we know the hashes and tell em like that guess what.
We just pull down for Intel Ms and we can just pull the fifty six hundred right out of here in case
you ever forget.
I have it memorized so they do it so often you probably will as well.
Also you can put this into your notebook and this will be a good place to have it and to say hey how
do I crack until and b to hashes.
Here you go.
Or have a hash cap cheat sheet.
There you go as well.
Make your notes your own.
But of course as I've said this whole course please have notes.
So we've got our module we've got our hash.
Now we need to crack that hash.
So we need to worry less to do it.
Let's go up to files and may show you a little little area in our in our computer here so go ahead and
go to other locations and we're going to do a computer and then we're going to go ahead and we're going
to go to user and then share right here and start typing in word wordless and that will bring you right
to wordless here
now there is this rock you that DST that Jesus.
Go ahead and open that and once you open that just go ahead and say extract and we can put this into
where it was.
That's fine.
Or we could put this let's put this with us in our home folder.
That'll work because we might use it again.
So let's go ahead and just extract this and it might take a second here.
Now we're not going to open this up but rock you is one hundred and forty megabytes and I can't tell
you how many passwords are in here.
Millions.
There's millions and millions of passwords in the you got text file.
This is just the default word list that comes with this.
There are lots of wordless out there that you can choose from.
For example we could go out to we got to Firefox just go to Google and there are several different sites.
We can say Google dot com and we could say hash cat word lists.
We can look for them and there's different ones.
Pass varied work passphrase wordless here there's another one called SEC lists.
So we say password sex lists like that and there's this great github here for SEC lists and income through
here and they have all different kinds.
So we can go through them usernames discovery passwords right here and they've got the top 100 top ten
thousand all the way through 10 million passwords right.
So the word this that I use is like 70 trillion or something insane and it takes about 15 minutes to
go through.
That's how fast a processor can work but you just kind of have to find your own look through them out
there and it's probable that your company will have their own word list as well.
But when you're doing stuff like hack the box so you're just doing capture the flags.
Usually something like rock you is plenty sufficient.
You don't need to go above and beyond that.
Once you start getting into cracking user passwords then you should start looking for a better word
list.
But for now we're gonna go ahead and just say rock you that tech since we've put it into our home folder
and now we have to also add in this dash dash force.
Now for me this is probably not going to work it's been a little bit since I've actually check this
I have a pretty new processor I'm running either a late I 7 to an eye 9 and what this is doing here
is it's going to try to run it but even still we're in a VM and the dash force is saying hey I know
I'm in a VM.
This is not going to run off my graphics card.
This is actually gonna run off my CPE you.
It's gonna be a lot slower and we're going to try to force this to run off the CPE you I'm going to
hit enter you may work.
Mine will not work.
OK.
This is what mine looks like.
So because I'm in a VM it's still not going to work for me.
You might get a little bit better luck and it might work for you.
So here is the alternative.
You should always run your password cracking regardless of what tool it is.
But let's say hash guys always run it on whatever system you're running your base operating system.
For example I'm running on Windows.
So guess what we can do.
We've got to Google.
We could say hash cat download and we'll be brought right to hash cat died here come to here and right
here is the hash cap binaries.
So we just download the binaries right here and I'll just go ahead and open this as is a seven zip file.
And this is hash cat five point one.
I'll bring this over.
You can see we just extract this and then we have our 64 EMC right here and we can run the same kind
of deal.
So go ahead and extract this and I'm going to show you how to run this.
What you're going to want to do is you're going to want to have your word lists.
So if you need to go ahead and go into your files you should be able to copy and move over so copy your
rocky text onto your desktop or wherever you're going to be putting this.
I put this right into a folder on my desktop and I'll show you my actual cracking one.
So mine looks like this where I've got it for point two point one I'm a little outdated but I just have
my hash cat in here and then I put my different hashes in here that I try to crack.
And I have Rocky's sitting right here as well so you can put it right in the same folder or make it
easier.
And then we'll go ahead and just attempt to crack these passwords right.
So I'm going to make a new text file here.
Amazon call it hashes hashes dot text or hashes forward text is what this will be something to go ahead
and just copy this hashes over here.
Put it in a file and I'll show you what it's going to look like.
So should be exactly the same.
So I have a text file hashes for the text and go ahead and see um I have to minimize this for us.
OK.
Hashes that text looks just like this.
I'll go ahead and save this or hashes for the attacks and then I'm going to need to bring up a command
prompt for you run as administrator and I'll bring this over and I'm just gonna go right into the folder
I have it stored so see users he desktop hash that and from here the syntax is really the same thing
I'm going to change it just a little bit of the file format for the executable.
So it's just hash cat 64 that you see the M A fifty six hundred is still the same.
And then we're going to say hashes for that text and then Rocky the text and then is going to do a dash
o the stands for optimize.
So I just want to optimize the output here and it's going to make this go a little bit faster but just
best practice to use dash o here okay.
And let's go ahead and just hit enter on this and this will take just a second to spin up and then you're
gonna notice as soon as it spins up.
See I came to finish my sentence that's how fast it is.
As soon as it spins up it finds the password passionate cracks it so you could see password one here
and this is exactly what we set the password to.
So again this is a weak password very easy to figure out.
And when you run into organizations like this you're gonna see this all over the place.
And I still estimate like 70 percent of the clients that I'm I'm going up against are are using Elohim
and R and B T and S and they're using weak passwords.
So these are just really easy wins when it comes to you know movement in the network and getting that
initial foothold.
This is why Elam and our poisoning is such a big one such a common popular one to be used.
So again this comes down to password policy and having a good password policy.
We're going to crack these these small passwords we're gonna crack passwords that have common characters
and we'll talk about this in defenses but we really just want to let the client know you know like this
is a good indicator to let them know.
We we capture these hashes and we crack them or capture these hashes and we did it and that's a good
indicator of their policy and other things to check too.
If you're Rocky or whatever word list that you're using doesn't work then you could still go and use
other things like their name for example the company name with a one or one exclamation or one two three.
You just got to get creative with it and think outside the box and things again like fall 20 19 or whatever
year it is winter or whatever whatever season it is as well.
Putting those in there and just trying to use the easy way out.
You got to think like a user who's wanting to use the easy way out and you're going to be very successful
with this.
So that is it for this lesson from here we're going to go on and talk about the mitigation strategies
and then we'll move on into some more attacks.
So I'll catch you over in the next video.