Considered to be the only available attack today to crack the WPA password. In this work, we design and implement the distributed WPA cracking system that can be easily scale and exploit the GPU computation power to greatly accelerate the WPA password cracking process. The system exploits the Amazon EC2 GPU cluster. We believe that due to the. NVidia Titan X is the Best single graphics card with cracking speed up to 2,096,000 hashes/sec. Using GPU for Cracking WPA2 Passwords. Being in the scope of the series we will stick to WPA2 cracking with GPU in this chapter. For learning difference between CPU and GPU cracking you can visit the following post I’d previously written on FromDev.

What is password cracking?

Password cracking process involves recovering a password from storage locations or from data, transmitted by a computer system on network. Password cracking term refers to group of techniques used to get password from a data system.

Purpose and reason of password cracking includes gaining an unauthorized access to a computer system or it can be recovery of forgotten password. There might be another reason of using password cracking technique that is for testing password strength so hacker could not hack into system.

Password cracking is normally performed thought repetitive process in which computer applies different combinations of password till the exact match.

Brute Force Password Cracking:

Term brute force password cracking may also be referred as brute force attack. Brute force password cracking is respective process of guessing password, in this process software or tool creates a large number of password combinations. Basically it’s a trail-and-error technique used by software to obtain password information from system.

A brute force attack are normally used by hackers when there is no chance of taking advantage of encrypted system weakness or by security analysis experts to test an organization’s network security .This method of password cracking is very fast for short length passwords but for long length passwords dictionary attack technique is normally used.

Time taken by brute force password cracking software to crack password is normally depend upon speed of system and internet connection.

GPU Password Cracking:

GPU is graphics processing unit, sometimes also called visual processing unit. Before talking about GPU password cracking we must have some understanding about hashes. When user enter password the password information stored in form of computer hashes using the one-way hashing algorithm.

In this password cracking technique using GPU software take a password guess and look through hashing algorithm and compare it or match it with the existing hashes till the exact match.

GPU can perform mathematical functions in parallel as GPU have hundreds of core that gives massive advantage in cracking password. GPU is much faster than CPU so that’s the reason of using GPU instead of CPU.

CUDA Password Cracking:

CUDA Compute Unified Device Architecture is a model for programming and a platform that perform computations in parallel, created by NVIDIA for graphic processing.

CUDA Password cracking includes cracking passwords using Graphics card which have GPU chip, GPU can perform mathematical functions in parallel so the speed of cracking password is faster than CPU.GPU have many 32bit chips on it that perform this operation very quickly.

We can easily access CUDA through libraries, directives and with the help of different programming languages that includes C, C++ and FORTRAN.

Password Cracking Tools

Given below is the list of Top10 Password cracking tools.

1. Cain and Abel : Top password cracking tool for Windows

Cain & Abel is one of the top cracking tool for password cracking and password recovery for Windows OS.

Cain & Abel can use techniques of Dictionary Attack, Brute-Force and Cryptanalysis attacks to crack encrypted passwords. So it only uses the weakness of system to crack password. GUI Interface of software is very simple and easy to use. But have availability limitation, tool only available for window based systems .Cain & Abel tool have many good features some of the features of tool are discussed below:

Features of Cain & Abel:

• Used for WEP (Wired Equivalent Privacy) cracking
• Have ability to record conversation over IP
• Cab be used as Network Password Sniffer
• Ability to resolve addresses IP to MAC.
• Can crack verity of hashes including LM and NT hashes, IOS and PIX hashes, RADIUS hashes, RDP passwords, and lots more than that.

Site for Download:

2. John the Ripper : Multi-platform, Powerful, Flexible password cracking tool

John the Ripper is a free multi or cross platform password cracking software. Its called multi platform as it combines different password cracking features into one package.

It’s primarily used to crack weak UNIX passwords but also available for Linux, Mac, and Windows. We can run this software against different password encryptions including many password hashes normally found in different UNIX versions. These hashes are DES, LM hash of Windows NT/2000/XP/2003, MD5, and AFS.

Features of John the Ripper

• Supportive with Brute force password cracking and dictionary attacks
• Multi platform
• Available free for use
• Pro version is also available with additional features

Site for Download:

3. Aircrack : Fast and effective WEP/WPA cracking tool

Aircrack is a combination different tools used for Wifi, WEP and WPA passwords cracking. With the help of these tools you can crack WEP/WPA passwords easily and effectively

Brute force, FMS attack, and dictionary attacks techniques can be used to crack WEP/WPA passwords. Basically it collects and analyzes encrypted packets then using its different tool crack password out of the packets. Although aircrack is available for Windows but there are different issues with this software if we use this in Windows environment, so it’s best when we use it in Linux environment.

Features of Aircrack

• Supportive with both Brute force and dictionary attacks cracking techniques
• Available for Windows and Linux
• Available in live CD

Site for Download:

4. THC Hydra : Multiple services supportive, Network authentication cracker

THC Hydra is a supper fast network password cracking tool. It uses network to crack remote systems passwords.

It can be used to crack passwords of different protocols including HTTPS, HTTP, FTP, SMTP, Cisco, CVS, SQL, SMTP etc. It will give you option that you may supply a dictionary file that contains list of possible passwords. It’s best when we use it in Linux environment.

Features of THC Hydra

• Fast cracking speed
• Available for Windows, Linux ,Solaris and OS X
• New modules can be added easily to enhance features
• Supportive with Brute force and dictionary attacks

Site for Download:

https://www.thc.org/thc-hydra/

5. RainbowCrack : New Innovation in Password Hash Cracker

RainbowCrack software uses rainbow tables to crack hashes, in other words we can say it uses process of a large-scale time-memory trade for effective and fast password cracking.

Large-scale-time-memory-trade-off is a process of computing all hashes and plain text using a selected hash algorithm. After calculations, obtained results are stored in the tables called rainbow table. Process of creating rainbow tables is very time consuming but when its done software works very fast.

Password cracking using rainbow table is faster than the normal brute force attack method. It’s available for Linux and Windows operating system.

Features of Rainbow Crack

• Support verity of Rainbow tables
• Runs on Windows (XP/Vista/7/8) and Linux operating systems (x86 and x86_64)
• Simple in use

Site for Download:

6. OphCrack : Tool for Windows password cracking

OphCrack used to crack Windows user passwords with the help of rainbow tables that are available in a bootable CD.

Ophcrack is completely free to download, Windows based password cracker that uses rainbow tables to crack Windows user passwords. It normally cracks LM and NTLM hashes. Software has simple GUI and can runs on different platforms.

Features of OphCrack

• Available for Windows but also available for Linux, Mac, Unix, and OS X
• Uses for LM hashes of Windows and NTLM hashes of Windows vista.
• Rainbow tables available free and easily for Windows
• To simplify the process of cracking Live CD is available

Site for Download:

Cracking Wpa Wpa2 Psk

http://ophcrack.sourceforge.net/

7. Brutus : A brute force attack cracker for remote systems

Brutus is the fastest, most flexible, and most popular software used to crack remote system passwords. It guess password through applying different permutations or by using a dictionary.

It can be used for different network protocols including HTTP, FTP, IMAP, NNTP and other types such as SMB, Telnet etc. It also gives you facility of creating your own authentication type. It also includes extra options of load and resume, so process can be paused when required and you can resume process when you want.

It is only available for windows operation systems. Tool has a limitation that it has not been updated since 2000.

Features of Brutus

• Available for Windows
• Can be used with different network protocols
• Tool have many good extra features
• Support SOCK proxy for all types of authentications
• Capability of error handling and recovery
• Authentication engine is multi stage

Site for Download:

8. L0phtCrack : Smart tool for Windows password recovery

Just like OphCrack tool L0phtCrack is also a Windows passwords recovery tool uses hashes to crack passwords, with extra features of Brute force and dictionary attacks.

It normally gains access to these hashes from directories, network servers, or domain controllers. It is capable of doing hash extraction from 32 & 64 bit Windows systems, multiprocessor algorithms, scheduling, and can also perform decoding and monitoring networks. Yet it is still the easiest to use password auditing and recovery software available.

Features of L0phtCrack

• Available for Windows XP, NT, 2000, Server 2003,and Server 2008
• Can work in both 32- and 64-bit environments
• Extra feature of schedule routine auditing on daily, weekly, monthly bases
• After run it provide complete Audit Summary in report page

Site for Download:

9. Pwdump : Password recovery tool for Windows

Pwdump is actually different Windows programs that are used to provide LM and NTML hashes of system user accounts.

Pwdump password cracker is capable of extracting LM, NTLM and LanMan hashes from the target in Windows, in case if Syskey is disabled, software has the ability to extract in this condition.

Software is update with extra feature of password histories display if history is available. Extracted data will be available in form that is compatible with L0phtcrack.

Recently software is updated to new version called Fgdump as Pwdump not work fine when any antivirus program is running.

Features of Pwdump

• Available for Windows XP, 2000
• Powerful extra feature are available in new version of Pwdump
• Ability to run multithreaded
• It can perform cachedump (Crashed credentials dump) and pstgdump (Protected storage dump)

Site for Download:

10. Medusa : Speedy network password cracking tool

Medusa is remote systems password cracking tool just like THC Hydra but its stability, and fast login ability prefer him over THC Hydra.

It is speedy brute force, parallel and modular tool. Software can perform Brute force attack against multiple users, hosts, and passwords. It supports many protocols including AFP, HTTP, CVS, IMAP, FTP, SSH, SQL, POP3, Telnet and VNC etc.

Medusa is pthread-based tool, this feature prevent unnecessarily duplicate of information. All modules available as an independent .mod file, so no modification is required to extend the list that supports services for brute forcing attack.

Features of Medusa

• Available for Windows, SunOS, BSD, and Mac OS X
• Capable of performing Thread based parallel testing
• Good feature of Flexible user input
• Due to parallel processing speed of cracking is very fast

Site for Download:

In a pen tester’s life, sooner or later you are cracking a password. This activity depends on the type of password and available hardware.

Today I want show you a different approach to cracking a password. We will focus on how to crack a Wi-Fi WPA2 password.

First of all, it’s important to define this. WPA2 is the most secure protocol that currently exists, as long as it is well-configured with the latest encryption techniques. Nevertheless, I say that WPA2 is the most secure – not that it isn’t hackable. Thanks to the MiTM attack, it is possible to extract an encrypted password. Did you know that?

I will show you how to redefine an attack on a Wi-Fi password and apply a new approach where resources are potentially unlimited and cost effective.

How many attacks are you familiar with to crack a WPA2 password?

The first that comes to my mind is bruteforcing. But this system wastes resources and we have to live forever to get the results. Not very effective. Let’s start to verify what we need…

We need to get a wordlist. Usually in this stage, someone uses data reconnaissance from a company website or social network account and uses words commonly found to create a combination of likely words.

This approach works if you are very lucky. We don’t need to be lucky; hackers make their own luck. Let’s see what happens when we try to create a word list with Crunch.

Wpa Cracking Back Track

1PB! We don’t have this free space on our hard disk.

Who says that we need to store the word list? We can use it in real time…

How? For example, we can use Crunch in Pyrit with pipeline.

Crunch generates all combination of 8 characters, piping the results to Pyrit that will use them to pass through the attack to a .cap file.

Again, the result of this little trick is smart, but it is not efficient. The timing is still too long, and we can’t wait forever. In a real case, we might even wait some years.

Did someone think to CUDA Pyrit? Yes we can use it, but not on your client laptop or PC. If you are curious and you want try it and use it for your own Kali, follow this link: http://www.blackmoreops.com/2014/03/13/install-nvidia-driver-kernel-module-cuda-and-pyrit-kali-linux/.

CUDA is a powerful kit that boosts your Pyrit by using GPU instead of CPU.

Pyrit has an awesome feature that allows you to attack a capture usign preloaded database. It’s important because it does it by millions per second and creates a table similar to a rainbow table.

In a word, it escalates; meaning we can potentially break any length WPA2 password.

Based on what we did previously, we are going to make this in 3 steps.

Creating a word list length 8 characters:

Upload the word list created to Pyrit DB and create own “rainbow table” (is not a true rainbow table):

Once a password has been imported, we can run a batch command to create a DB.

Simply digit: # pyrit batch

At this time, can we start the attack to the .cap file of the password.

The time of execution required is the same as before with the pipe approach. We don’t have the scalability to execute it in a right manner. It’s necessary to use something more powerful, but buying a new graphics card is not a right solution.

Amazon will help us….

AMAZON LINUX AMI

Amazon provides other kinds of web services, including AMI. The Amazon Linux AMI is a supported and maintained Linux image provided by Amazon Web Services for use on Amazon Elastic Compute Cloud (Amazon EC2). It provides a stable, secure, and high performance execution environment for the NVIDIA GRID GPU Driver AMI, which allows application developers to run NVIDIA GeForce-optimized games and applications from the cloud on Amazon EC2.

Amazon Web Services provides ongoing security and maintenance updates to all instances running Amazon Linux AMIs. But I don’t want to get lost in explanation about Amazon AMI. You can find more information here: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html.

AMI gives us a possibility to escalate to the power level that we need. It uses the GPU graphics card instead of CPU, increasing computational calculation.

When you buy the first AMI, it’s empty, without the tools that we require. To do a good job, we’ll require Python, CUDA Pyrit and Crunch.

In this case, we pay Amazon for the hours that we use, we can’t lose time! So first, before we buy AMI services, we need to prepare a ready package with own tools inside.

If we start a benchmark test on Linux AMI we can see soon the difference. Now we have what we want!

Now we can still hack into, potentially, any WPA2 passphrase length. Yes, potentially… we are still at too much time to crack with only one AMI, we need many AMI machines to connect all together and create a distributed service. If we use more AMI servers, we have the maximum escalation possible.

We don’t need too much power for now. I want explain how to crack a password with minimum effort possible.

If you look at online documentation, all theories say to use Crunch to create a huge word list and Pyrit for distributing loads to other AMIs. But there’s a little trick for this.

Step one

Prepare your right tools for the job. We don’t create a production machine but only a template for saving time and performing multi-creations.

Step two

Create a small portion of the word list. This is the main part of the trick 😉 . We don’t know the maximum value of our word list, so we can ask it to Pyrit. If we input a huge value, it will return a maximum value accepted, and this is our number!

Pyrit tells us that it’s too huge a value, and returns the correct parameter as 268435456.

Now we need to put our attention on the size of file created and stop it before we run out of space. To amplify it, start a new VM and continue where we left off.

We see the new file called yyyyy-bbbbb.txt. We’ll need to start from there, check the number of characters, in this case 5, and restart Crunch with the new command.

Step three

Upload all the files to the Pyrit database with the same command used before. You could generate the word file offline and afterward upload it on VM. This way you won’t take up space with useless files. You will upload to one VM and pass it to Pyrit and do manual distribution to other VMs.

Step four

Save the VM as a template. This step could you save time the next time. Go to your EC2 management console, choose the instance (all the instances pre-loaded with the word list), give it a name and choose “create image”.

Step five

Launch all the instances, insert the ESSID in Pyrit, and run the batch.

Conclusion

All the steps might take some time. VM creation, word creation, and uploading to Pyrit database are done just one time. The challenge here was to see how to improve the strategy to crack a Wi-Fi password.

The new clouds and processing power will give us the possibility to perform an attack faster than before and get the best results. Amazon is only a third party actor, and maybe some contract policy now could deny the scope of this paper.

Amazon is an excellent company, and I want to underline that this guide is not for bad things, but a demonstration on how the new technology could be used to perform an attack.

I want say thanks to Bruno Rodrigues, the author of this hack.

Resources