Need help with Brute Force cracking.

(lots of text but please read!)

1)
I've been having a hard time brute forcing my own password on winxp pro using L0phtcrack 5. I made a new user name/pw on my machine and typed J!K@j1k2 as my pw. It spent 3-4days working on a P4 3.4ghz 2gb ram, using "Strong Password Audit", and enabling "Dictionary Crack" default dictionary list, "Dictionary/Brute Hybrid Crack", "Precomputed", "Brute Force Crack".
I got terrible results. It came up with *******2 and I also did enable check for symbols, numbers, and letters. What can I do to improve my find?

2)
Is there a way to submit passwords via brute force in an application? software: game; user name: known; pass: not stored in hashes (server reliant); pw submit limit/lock: unknown.
I used to pw my accounts in key patterns just like how I do that with my v-mail pw - yes, Im a visual learner. Here's are the variables "J" "K" "L" "U" "I" "O" (not in order), length is 8-11 characters.
John the Ripper, as I know, can only brute force pw using hashes. The only thing i think i can do is find a way to submit thru the program's password box 262144-1771561 different combinations. Tell me if I'm wrong or if there's another method.

(i know, i shoulda made two topics instead.)

Quote:

---

Originally Posted by e><ius

What can I do to improve my find?

---

Get a faster machine....

Seriously...

Calculate the total keyspace, divide it by the number of tries per second and you have the total time it takes to deplete the keyspace. The mean time is half of the total time.

Or use the time/memory trade off and use rainbow tables.

If you try to brute force most things they will lock you out long before you get the password. You also run the risk of them tracing your IP.

Its not too hard to make one app control another app such as to submit user/pass. But you need the source for your password cracker. Or to write something that will take output from it and try it.

And yes, brute force will take a while on that sort of password, thats why security experts recommend you use that kind of password.

Astalavista.net has an online rainbow table cracker available Here. Only 10 LM and 10 MD5 hashes are available for the public each day, however, I believe that members ahve unlimited access. Not that I would pay to be a member.

Todays hashes:

Results MD5 (queries remaining today: 0)
Hash Plain-Text
9651A3614A30B569132600A1F753BF29 5253185
B2DA7959DB5D0616F261721DF9DD8AE1 petru
F66B67EE2D752A11BF81FB55946518A0 16mon
5A25E9C15A5ED6A23234354AC30D28BF garuruga
3AEF5FA442B3DFE1F6DD92DF21AE4D49 nwgdhdz
D8871301C9199D775CACAE51A5303922 kad4ever
63B855C7167D7F4E4193CE31E924D0F8 hassowu
CDA901ECFAC787880D7C2E97C4E47F93 helmanis
1D765AE564B53DF332C11C41449C6FC5 mash2691
E021114CDFB17C63380116E58C26941B noche627


Results LM (queries remaining today: 7)
Hash Plain-Text
C34CB7D13BA5AF1BCE0454AC64E83210 SYSADMIN$*1965
8F57987C44197E81C81667E9D738C5D9 01121996
DF55E9D4862EB232AAD3B435B51404EE KARLLA
0713B60814DEC4C80B7EB37E244FE6CD JUSTIN3797
AD91A1C396BA8A429DE8EC1F6767CE00 LIBERTY_707
DE1F77CB6390BDC3417EAF50CFAC29C3 SERVTEST
17C1A55196D3512417306D272A9441BB RESOURCE
F9F4D196D0DEDFE30D33AF7ECD4340B4 `S%DN5:6#LE{7M
F3372C5D8C780FE8CFBE51DBF75F44D5 .ONQ#43O3[N38{
C0551CED1730A54225237362F21606D9 S1LV3RSH!FT3R


As you may notice, they do not yet have an NT hash table available; not that it's really an issue, unless you either tell it otherwise, or intentionally (or unknowingly) invalidate the hash through either password length or invalid characters, Windows still defaults to LM hashes for backwards compatability.

Quote:

---

Originally Posted by SirDice

Get a faster machine....

Seriously...

Calculate the total keyspace, divide it by the number of tries per second and you have the total time it takes to deplete the keyspace. The mean time is half of the total time.

Or use the time/memory trade off and use rainbow tables.

---

the search ended and found squat. it doesnt seem like it wants to work any longer than it should have.

Quote:

---

Originally Posted by Aardpsymon

If you try to brute force most things they will lock you out long before you get the password. You also run the risk of them tracing your IP.

Its not too hard to make one app control another app such as to submit user/pass. But you need the source for your password cracker. Or to write something that will take output from it and try it.

And yes, brute force will take a while on that sort of password, thats why security experts recommend you use that kind of password.

---

i never got deep into programing (except web), so creating something of such an easy function would take me forever... unless PHP is able to grasp data. have you came across a cracker with an output built in?

Quote:

---

Originally Posted by Synful

Astalavista.net has an online rainbow table cracker available Here. Only 10 LM and 10 MD5 hashes are available for the public each day, however, I believe that members ahve unlimited access. Not that I would pay to be a member.

---

awesome source. that saves a lot of time. LM definately is what im looking at. funny cuz i used to used alt+0220 (Ü) as my pass for win, while LM supposedly doesnt support it. ... Astalavista.net says "LM: Supports the full keyspace "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=~`[]{}|\:;"'<>,.?/"." I wonder how come my password was accepted even if it shoulda been rejected.

Why should it have been rejected? LM supports languages other Than American English ;)

£ € are not in that list but are accepted IIRC.

oh! i guess im ignorant. can i get a penny?

Umm... LM hashes take almost no time to crack these days using rainbow tables. If you give it to www.plain-text.info, it will probably take a few minutes; at worst a few hours.

Hey e><ius, the only reason I mentioned it, is that I have a Swedish keyboard that I found somewhere, and it has accented letters on it.

You can certainly get a UK penny as that is just "p"............... I have no idea about the US cent symbol.

:)

EDIT: you might find this interesting:

http://geeksaresexy.blogspot.com/200...m-hash-of.html

zeruelx - i didnt see the options, but could i enter plain text to find hashes? well, not that i couldnt just look it up with my cracker.

nihil - thanks for the "p" it certainly is worth more than my "¢". btw, i also have a Swedish keyboard. bought it for 99¢ and its been roasting in my trunk for at least... 10 months. you wanna buy it for 98¢? its still BRAND new!

Hi e><ius,

I did a bit of rooting around and it seems that LM hash will support 142 characters. Also I did see mentioned that LC5 may have problems with non-Latin characters.

Nothing personal here mate, but when I used to play with these sort of tools I would give it a real simple password first, just to make sure that it was set up right and I was using it properly ;)

Also, have you checked that LM hash hasn't been somehow disabled? I believe that you do it somewhere in the Registry by changing a "0" to a "1".

just a few thoughts................

nihil

not offended. im still getting used to it. i did not try simple characters yet. and i have not changed my registry from 0 to 1. but ill check when i get home.

have you heard of Cain & Able? i ran it on my old machine for the hell of it once, and it automaticly dug out all the users and revealed the pw's. it took it 1 second or something (didnt say or have log). and also it came across internet connection pw's for my DSL. so does this actually brute force? or is it just plain faster than LC5?

e><ius,

Yes I have heard of Cain, as far as I know it does dictionary, brute force and cryptoanalysis.

I have no idea which tools are the most appropriate or fastest these days as I haven't used them for a while in a comparative scenario.

The reason I suggested trying with a simple password first is that you know it should work, and work quickly. That way you can verify your set up and methodology.

Incidentally, in the example you gave, you know that a dictionary attack won't work, so you could speed things up by turning that option off. ;)

With brute force, check what characters you are using in your characterset.

My suspicion would be that LC5 may not be handling the "@" symbol?

Quote:

---

Originally Posted by nihil

Hi e><ius,

I did a bit of rooting around and it seems that LM hash will support 142 characters. Also I did see mentioned that LC5 may have problems with non-Latin characters.

Nothing personal here mate, but when I used to play with these sort of tools I would give it a real simple password first, just to make sure that it was set up right and I was using it properly ;)

Also, have you checked that LM hash hasn't been somehow disabled? I believe that you do it somewhere in the Registry by changing a "0" to a "1".

just a few thoughts................

---

Regardless of what LM can actually support, from what I understand, a password over 14 characters or using special characters automatically makes Windows use an NT hash.

Quote:

---

Originally Posted by nihil

Incidentally, in the example you gave, you know that a dictionary attack won't work, so you could speed things up by turning that option off. :)

---

Why didnt i think of that? (rhetorical question)

Quote:

---

Originally Posted by nihil

My suspicion would be that LC5 may not be handling the "@" symbol?

---

... and along with the first 7 characters? maybe so? ::back to testing phase::

FOUND!

20C5893D4E5336007BD5CA7982B10D14

=

Q!1W@2E#3

it took my machine 3 days to find. not bad? or bad? still had 17days to do the whole search.

took astalavista.net 3 seconds... maybe i shall switch my resources

That does seem rather a long time for a 9 character LM hash.............. based on your machine specs. Were you running it as a dedicated job, or were you doing other stuff as well?

OK your password was relatively strong, but I would still have expected it to be cracked in hours rather than days?

well... i couldnt make L0pht go faster... fastest it goes = used no more than 50% of cpu power always. i did set it on lower priority so it wouldnt lag my comp when i was on it. 3.9ghz p4 and 2gb ram. it seemed to come out as MD5 . i dont know if SP2 automatically uses it.

where do i search the registry for that option 0 - 1 for LM - MD5?

Quote:

---

Originally Posted by e><ius

well... i couldnt make L0pht go faster... fastest it goes = used no more than 50% of cpu power always. i did set it on lower priority so it wouldnt lag my comp when i was on it. 3.9ghz p4 and 2gb ram.

---

When you crack passwords you use a 100% dedicated machine set to prioritise programs, rather than services. You do not run other applications at the same time.

Quote:

---

it seemed to come out as MD5 .

---

It didn't ;)

Quote:

---

i dont know if SP2 automatically uses it.

---

It doesn't ;)

Quote:

---

where do i search the registry for that option 0 - 1 for LM - MD5?

---

You don't. You might try a search engine such as Google to find out why, or just go to post #11 in this thread and follow the link I gave you there. :rolleyes:

Quote:

---

Originally Posted by nihil

When you crack passwords you use a 100% dedicated machine set to prioritise programs, rather than services. You do not run other applications at the same time.

---

in XP, where can i change the settings to force/allow 100% cpu power for the program (and not services)? would i go as follows, "Task Manager >> Processes >> Right-click program >> set "Realtime" processing" ?

and i remember reading about that registry option... just didnt know which stack of papers was it in. :( thx for redirecting

Hah! so you now know that with a Windoze password it will be LM or NT?

MD5,4,3,2 (don't remember if there was a 1.........it would have been before my time:D) relate to encryption algorithms, but not those used on your native Windoze password.

Hmmm, a bit difficult right now as my XP box is offline for refurbishment, but you go into <Settings> and then <Control Panel> and look at whatever it offers for memory management............... I think that you might have to go to "advanced" (settings) to do that? You have an option to select services or applications priority.

Just go into task manager and shut down applications you are not using......use the system tray to do this first. if the memory is available and the CPU power is there, then Billy Windoze will generally do it reasonably right. Also make sure that it is not connected to the internet, so you can turn off AV and firewalls.

The registry option I pointed you to (from the opposite direction as I recall:D) will stop the use of the (weak) LM hash. As I said, Billy Windoze will only use LM or NT hashes.

By "100% dedicated" I mean that it is the only application that you are running; not that it is using 100% CPU........

From the time it took your kit, I would suspect that it might have defaulted to an NT hash?............please try to get hold of an older device for experimentation.............I never feel comfortable with students using production boxes for this kind of stuff.

Quote:

---

Originally Posted by D0pp139an93r

Windows still defaults to LM hashes for backwards compatability.

---

Hmm, thats odd. I thought this myself, but now i'm confused (sorry to get a little off subject, but its somewhat relevant, cause you need to know what type of hash your cracking).
Anyway, I have used cain to retrieve password hashes from my computer, and it used to give me an LM and NTLM hash, but I recently tried to get the LM to show someone else how Cain works, and it only gave me the NTLM hash, and my password is only 6 characters long. Could this be a recent windows update, as I'm the only person who uses my computer? Or has something else changed the registry setting?

Hi metguru,

This is how to check your Registry setting:

http://geeksaresexy.blogspot.com/200...m-hash-of.html

Do you actually have a DWORD entry "NoLMHash"? if not, then Windows should use its defaults, I would have thought?

I don't think that it is a Windows update as this is what Microsoft have to say:

http://support.microsoft.com/kb/299656

That article was last reviewed 31 January 2007. I would have thought that if there had been a patch since then, that changed the default, MS would have announced it, as there must be a lot of outfits around the World that still support legacy systems on networks. I don't think that MS would want all the helpdesk calls? :D

thats odd, nolmhash has a value of 0. oh well..

Hmmmmm, no ideas mate...............I can only go by what MS tell us :confused:

Have you tried creating a new account and see what it does with that?

Why would you enable dictionary crack options at all? Just curious because it seems like it's a completely random string. Also, have you tried ophcrack live cd?

not it

it was just a test earlier... then i turned it off because i knew i'd be wasting my precious computer time.