INIT_6

About 5 months ago I got the idea to create a botnet style password cracking program. This blog post is about what I was trying to do and how I failed. Along with version 2 outline showing whats next.

It took a little over 2 months to get people at DC214 (DEFCON Group in Dallas, TX) moving on the project. Mostly because this is the first project I have tried to lead. So that left us with about 3 months to complete the project. Another limitation I had I didn't know how to distribute the coding to other people. So I programmed everything my self. Working a normal job 7am to 5pm only had a couple hours a day. with about 3 weeks wasted on how to preform asynchronous subprocess communication with out blocking named pipes.

We ended up naming it: ID-PCB ( IRC distributed password cracking bot )

I have added the license GPLv3 and made the repo public. You can access the files here: https://github.com/DC214/pwcrack

What resources we had:

16x GPU's all but 2 were 7950's or 7970's

I know several people didn't even connect because we were having problems. I am thinking we had another 5 or 7 GPU's.

Roughly 140 CPU cores. plus 3 boxes with 12 CPUs each that didn't make it online.

How it was spouse to work:

The user would download the client software for pwcrack.init6.me. Run the setup.py. This would create a sysinfo file with all the hardware information. Also, the client ID represented the power of the computer. So the better the GPU and the more you had your client ID would be higher.

Then you would run the client software. It would read in the sysinfo file. Connect to the IRC server. Register with the server with all its info. It would than wait for commands to execute. Before executing any commands it would make sure the binary file was on the whitelist of apps. It would also do a md5sum on the binary and compare it with the read-only file on pwcrack.init6.me to make sure no "DEFCON hackers" messed with our stuff.

I had a regServer that kept track of all the clients and their status.
I had what I called crack programs that would query regServer database and grab clients to use and distribute the commands to each client.

Once the client executed the command it would hit the status key and send a update through IRC. Once it finished if passwords were found it would upload them to the FTP site and tell the crack program it was ready in which it would send the next command.

The problems:

I had only wrote and tested the brute force crack program. I wrote the Rule based crack program on the road while driving towards vegas.

Once I started a bruteforce command I had no way of stopping it nicely.

Didn't get to this point but all the clients would have stopped at the wrong time. I put a time bomb in it as on Saturday night it would have stopped whatever it was doing and upload what it had. However, it was checking local time not PDT.

IRC, IRC, IRC. It sounded great to start with because that's what I knew. I had programmed other IRC bots in the past. The IRC server had buffer problems both sending and receiving. During testing it didn't lag because I only had a couple clients on at once. However, once everyone jumped on and started talking the lag became really high.

Not enough testing.

No nvidia cards to test so some nvidia users couldn't connect correctly.


The conclusion:

It failed and that is okay. I learned a lot. This is the first python program I have wrote that was this complex.

I know why and how I failed so I have quickly moved on and designed a new approach.

A rough draft of the direction I would like to move this project in: [gdoc]

Link to information about Hashcat rule based attack.

Besides the out of box rules and some of the amazing rules atom and his team comes up with. I will be updating this post from time to time adding new rules I come up with or others give me the idea to come up with.

malik51: and i where talking. I was trying to get ?d?s to be preappended and appended to a pass. As running two rules one appending and one preappending is slow and doesn't work.  After much frustration I had one good idea what I will share below. His solution.

./mp64.bin -1 ?d?s '$?1 $?1 Y2 }}' -o malik51roll2.rule
./mp64.bin -1 ?d?s '$?1 $?1 $?1 Y3 }}}' -o malik51roll3.rule

This will add the same to both sides. !@pass!@ or 123pass123. Works great, and its fast.

However, I wanted more.  I wanted passwords like 1@pass$% or 123pass#$%  What I thought was the solution to the above actual works for this. It will first reverse the pass. ssap then append the digit or special character ssap@1 then reverse the word again. 1@pass  Then finally append the next set to get you 1@pass$%

./mp64.bin -1 ?d?s 'r $?1 $?1 r $?1 $?1' -o init6reverse.rule

However, this only works for two spots. you cant do 123pass#$% just to big.

In the spirit of the malik51roll2.rule I made the ldsUroll.rule
./mp64.bin -1 ?l?d?s?u '$?1 $?1 Y2 }}' -o ldsUroll.rule
It appends and presppends lowercase, digits, special, and uppercase.


EDIT: 8/12/2012 4:13AM

The following haven't found that many, but they found some.


bible verse numbers:

./mp64.bin -1 123456 -2 12 '$: $?d $?d' -o biblenum1.rule
./mp64.bin -1 123456 -2 12 '$: $1 $?d $?d' -o biblenum2.rule
./mp64.bin -1 123456 -2 12 '$  $: $?d $?d' -o biblenum1a.rule
./mp64.bin -1 123456 -2 12 '$  $: $1 $?d $?d' -o biblenum2a.rule
./mp64.bin -1 123456 -2 12 '$?d $: $?d $?d' -o biblenum3.rule
./mp64.bin -1 123456 -2 12 '$?d $: $1 $?d $?d' -o biblenum4.rule
./mp64.bin -1 123456 -2 12 '$?1 $?d $: $?d $?d $?d' -o biblenum5.rule
./mp64.bin -1 123456 -2 12 '$?1 $?d $: $1 $?d $?d $?d' -o biblenum6.rule
./mp64.bin -1 123456 -2 12 '$1 $5 $0 $: $?2 $?d $?d $?d' -o biblenum7.rule

biblenum* >> bible.rule



append : 1-3 everything

./mp64.bin -1 ?d?s?l?u '$: $?1' -o append1.rule
./mp64.bin -1 ?d?s?l?u '$: $?1 $?1' -o append2.rule
./mp64.bin -1 ?d?s?l?u '$: $?1 $?1 $?1' -o append3.rule

append* >> append.rule



Append clock both 12 and 24 hour

./mp64.bin -1 12 -2 1234 -3 12345 '$?1 $?2 $: $?3 $?d' -o clock.rule

#haven't tried this, most likly to large.
./mp64.bin -1 12 -2 1234 -3 12345 '$?1 $?2 $: $?3 $?d $: $?d $?d' -o clockSeconds.rule