Brute Force Attacks

Tools

Hashcat

Hashcat Rules:

  • $ : append a character

  • ^ : prepend a character

  • c : capitalize the first letter

Apply rules to a wordlist:

hashcat -r demo.rule --stdout demo.txt

Lookup a hash type code:

hashcat --help | grep -i "KeePass"
13400 | KeePass 1 (AES/Twofish) and KeePass 2 (AES)         | Password Manager

Hash-Identifier

hash-identifier
> <HASH>

Online Services

SSH

RDP

Brute forcing RDP may end up locking accounts if the security settings are configured to lock out an account on too many wrong attempts

Hydra RDP is not reliably accurate

Impacket has a much more accurate logon check:

Create a script that checks usernames and passwords given a specific domain and IP

HTTP

HTTP POST form

HTTP basic authentication

Local Services

KeePass

Transfer the .kdbx database file to your local machine

Remove the name of the file from the resulting hash

Hashcat code for keePass is 13400

SSH Private Key

can be found at /home/user/.ssh/id_rsa

in order to use a private key, needs to have the following permissions applied:

connect to ssh using a private key:

retrieve hash from id_rsa:

(don't forget to remove file name from resulting hash)

In this example, the $6$ signified SHA-512

NTLM Cracking

We cannot simple copy, rename, or move the SAM database from C:\Windows\system32\config\sam and we will need to use the Mimikatz tool to bypass this restriction.

Mimikatz also includes the sekurlsa module which extracts password hashes from the Local Security Subsystem (LSASS) process memory. LSASS is a process in Windows that handles user authentication, password changes, and access token creation.

PreviousNote Taking & Reporting For OSCPNextCustom Wordlist Creation

Last updated