Note beating your head against the wall to stealcrack

NOTE Beating your head against the wall to steal/crack passwords in Windows may be
pointless in the long run. Skip Duckwall and Chris Campbell’s presentation at Black Hat in 2012
on “passing the hash” ( -
Slides.pdf ) points out some serious failures in security regarding password hashes and system
privileges in Microsoft Windows.
Password cracking offline can be done in one of three main ways: dictionary attack, hybrid
attack, and brute-force attack. A dictionary attack is the easiest and by far the fastest attack
available. This attack uses a list of passwords in a text file, which is then hashed by the same
algorithm/process the original password was put through. The hashes are compared, and if a
match is found, the password is cracked. Technically speaking, dictionary attacks are supposed
to work only on words you’d find in a dictionary. They can work just as well on “complex”
passwords too; however, the word list you use must have the exact match in it. You can’t get
close; it must be exact. You can create your own dictionary file or simply download any of the
thousands available on the Internet.
A hybrid attack is a step above the dictionary attack. In the hybrid attack, the cracking tool is
smart enough to take words from a list and substitute numbers and symbols for alpha characters
—perhaps a zero for an O , an @ for an a . Hybrid attacks may also append numbers and symbols
to the end of dictionary file passwords. Bet you’ve never simply added a “1234” to the end of a
password before, huh? By doing so, you stand a better chance of cracking passwords in a
complex environment.
EXAM TIP ECC absolutely loves rainbow tables. A rainbow table is a huge compilation of
hashes of every password imaginable. This way, the attacker simply needs to compare a stolen
hash to a table and—ta-dah!—cracked. The amount of time it takes a cracker to work is
dramatically decreased by not having to generate all these hashes over and over again. In the real

world, GPU systems can brute-force passwords in a manner of minutes or hours, so rainbow
tables aren’t really all that valuable. If you wish to make one, though, you can use tools such as
rtgen and Winrtgen.
The last type is called a brute-force attack, and it’s exactly what it sounds like. In a brute-
force attack, every conceivable combination of letters, numbers, and special characters is
compared against the hash to determine a match. Obviously, this is very time consuming,
chewing up a lot of computation cycles and making this the longest of the three methods.
However, it is your best option on complex passwords, and there is no arguing its effectiveness.
Given enough time, every password can be cracked using brute force. Granted, we could be
talking about years here—maybe even hundreds of years—but it’s always 100 percent effective
over time.