okay hello cypher count okay all right
welcome to track two so I'm talking
about some cluster cracking and a not so
new tool called mdx find that not very
many people know about so don't further
ado let's have a look at this the next
slide so who I I'm Robert Reid I am part
of silence or prime which is a hobbyist
a dragon group and we basically you love
to crack passport so that's what we do
and we rather enjoy doing it I'm a
student currently / systems
administration and network security
specialty so my kind of thing yeah I'm
all about passwords you know so you know
basically at the end of the day though
you know I'm just a guy with a few
graphics cards look into spin spin
cycles and that happens to be on you
know cracking passwords so sorry for
brian is a group of obvious patrick
crackers we compete in all major
professional level Patrick writing and
most people in our group view is maybe
12 machines at most so they're pretty
they can manage work relatively easily
however we
terminals and k2 graphics cards in my
basement so the not immediately in the
world to manage all that manual so
basically I was looking for a way
possible to try and get that easier and
there was an existing tool out there
called hash the bus and hash the bus was
prank red like the idea by it was
wonderful and in the beginning you know
I would like I said I was the only
person in our group that had kind of an
experience with hash 2 plus everyone was
kind of like so I'm constantly pushing
for members to have a look at how simple
it was the handle is kind of worked like
it was really nice you can just issued
task and all of your machines go towards
won't ask and all were collectively
together which is amazing all man is
awesome most of the time you're trying
to pack many views and one single
computer is possible her to get as much
bang out of it so one name I get to be
done from one of our members and he says
hey if I program some changes ashta puss
would you be interested in testing and I
said yeah oh yeah you bet I'm good says
the hell out of that but so does the
development cramp up to an under way so
while the original code was worked and
worked well um it can take a lot of
lines of redundant cobalt server and
client side and it was mainly caused by
the constant changes of hash cab if you
look that hash cat in the past six
months or a year it has changed
dramatically it is insane how much
that's changed you know it's gone open
source it's gone to this whole new level
it is an amazing tool and Adam is
amazing for me so has to book you
basically you know it's more fine coat
and a lot of developers to spend less
time tracing through and more time
developing and as developers just about
everyone's like oh yeah
that's good for me so saying he is our
head developer he's basically develop
99% of haschke pussy and a huge safety
goes out to him for all of that and
blazer is our client developer he
developed the entire client and we're
currently using and I tested it has to
just about everything you can think of
and then again we still find stuff
that's wrong with it but it works really
well right now the same is also the
career in order of hashes org in essence
on work is a treasure trove of
information if you crack passwords and
this site is completely new to you shame
on you you should know about this site
the amount of information you can get
from here is just insane so again you
think you saying for putting this out
developing this making it what it is
because it is absolutely awesome of the
stuff you can get from so basically the
dictionary and you can find on hashes
org if you run a password on it for your
company and if you run the hands of
dollar dictionary and it results in zero
crack patches somebody needs one hell of
a race because that is amazing and I
know how to be men and all sincerity
insight is crazy usually on average if
we get you know some sort of dumped out
in the wild solid sixty percent if not
higher just by using the hatches out our
dictionary so if you're not using it you
should be so what is handsome but we
have some upper you know multi-user
environment we have concurrent workers
we have really quick tab dispatch and
our work or flexibility is amazing so
basically here if we break this down you
don't want that user again each of them
has their own permission levels some of
the Reno
edmonds ya gotta Jana that kind of same
stuff concurrent workers concur workers
you can have as many workers as possible
and they will all work on the exact same
task if you so choose for them to do so
which is awesome this is a huge problem
we're dealing with a scam is trying to
distribute it and I believe this does it
very well so just as the kind of an
example here of usage you know as far as
weird or flexibility goes as suppose you
lost orders to come and go as they
please so you do not have to have
dedicated Hardware doing this point or
seven it can be hardware that you use
for whatever purpose and then when it's
done being used for that purpose you
used to practice so for example a kind
of a complaint with system admins is
that I don't have any dedicated hardware
you know how do i oughtn't answers with
that just for an example now security
licenses terror but you could leverage
every computer in your office after
hours to crack experts not an if you
know who never come again hearing lies
that's horrible I kind of gives you an
idea what you could potentially do and
you can use that you know even in the
cloud you can so wanted to I would
recommend it but you could technically
put this entirely open the crowd clouds
and having the main workers as possible
and so just keep in mind that whatever
her clients that you have running though
whose clients will be receiving all of
the ashes all of the cracked ashes all
of your earth list rules I mean
everything so just keep that in mind
from a security standpoint that all
these clients will have very sensitive
so I'm see here skip ahead right now the
way it stands we have AC sharp client
that is it our plans are to expand on
this to Java and Python but right now
our CSR client works beautifully with
Windows Mac and when
so you can do anything you would like
young problem with men is that the hat
cap is not automatically come with gmac
binaries so you have to build it
yourself let's see no issue there
otherwise windows and linux works so the
client and server communication used to
implement which is a pretty upper grades
but it's pretty simple for developers to
write clients in their own language of
choice or possibly implement non hash
that tools to work with extra seat if
you so choose so let's have a look here
what's what's compatible so medical uses
just about every hashtag known the man
if that doesn't accuracy can be limits
however the increment mode and mass
files are not and it was kind of a tough
and the reason why is because as an end
user you see one single command and you
say I want to increment through all the
way from one character to 10 characters
you see this one single command hashcash
does not run that ass once a man that
has a whole bunch of subcommands and the
reason why I asked it does that is for
basically optimization that's why though
and at the end of the day it's extremely
hard to distribute that because hash
that doesn't allow you to be like hey I
only want to run one part of this
subcommand I don't know how to run one
chunk of it none of that is supported so
you can run the equivalent task and ask
you pussied as we do any of these runs
as well you just have to separate them
up into individual tasks which really
isn't too big of a problem this like
you're not like hey I want to run on a
mass bottle it has you know five hundred
thousand reasons so we need some
terminalis you can probably any further
the agent is the combined effects of
unity compute work a task is addy
command you wish to be completed the key
base is the size leave if you test it's
not necessarily the actual space sighs
and there's reasons for that
hash cabin or fully understand that but
I'm just going to leave it kind of a for
the southern charm cells of Artemis of
the total command key space and exam is
a cracked hash that is globally think
across all ages reconfigure tasks our
save tags can be deployed to many
hatchlings super pants are a collection
of tasks that could be deployed to
Minneapolis and super hands lips are
combined collection of two or more
excellence so unfortunately before we
get straight into the webview I'm here
there's kind of some back and stuff you
have to understand or they get kind of
this full picture of what's really
happening here and what is so I mean
anything about it so we'll have a look
at the output from a client machine and
of course the progress is basically the
progress of the current chunk that your
client is running the speed is obviously
the performance your team and cracks are
how many hatchet second car accident
last status output so that number will
be updated basically reset every time
you see a line them up accepted our how
many hashes the server has received to
confirm since the last status don't put
sent our hands as the other agents have
cracked in the cluster and have RF and
have already cracked in the cluster and
will be removed from uncracked ashless
on the local agent so that's kind of
they keep all the agents updated I which
is really really good especially if
you're doing like salt and passwords the
name of the game you're cracking
passwords is reduce the amount of salts
that way you can go a little bit faster
so basically if one is cracked it
stinked across all of your agents and it
keeps everything on my skin fast and
pretty and very nice the way you wanted
to so the Hume is how many messages the
client is waiting to send to the server
I mean this could be cracked themselves
this could be status updates and our
queue system basically continues hold on
let me tell check no mature
yes so one of the biggest problems
you're working with Ashton bus is that
SQL server gets overloaded very very
easily and why they did that was
basically because the client had no idea
what the server was doing and let's say
the client cracks 10,000 20,000 you know
half a million hashes within the last
status update and yes ql servers like oh
man we have this you texted me right
well the next five seconds per roll
around in the conoco i have 110,000 more
here you go and sooner or later you have
a serious bottom line going and mysql
server crashes this resulted in lost
cracks lost to work whole bunch around
which in our case is just unacceptable
so we made it you today it would be like
what is the server doing is everything
okay and it's not okay let's continue
work but will check and make sure that
that's river is there because there will
obviously send it here's what we're
doing usually crack yo yo yo okay so now
with that this is a live demo so let's
hope that everything works okay here
pretty much this is our UI here and
let's say one of the cool things about
has to put here is that so we have
hashtag releases what that is is that
automatically updates all of your
clients as soon as you mash categories
comes out so basically all you do is you
run the binary on crime and any changes
that happen has to receive or have to
post how to make it updated so the
client binary itself gets updated and
any of the hashtag releases that come up
you put them on the server and then find
a lot of Mac MacDonald unpacking your
red rock which is pretty awesome
so speaking of agent here when you're
adding in ages basically just have a
talent for the net firing and you run
that binary that's the first thing
that's going to ask you for is the URL
of your server of course and the
publisher that you have the pouches are
a one-time voucher and basically it's
just a one-time password that you enter
in for whatever client is connecting and
then you know that that agent has
assented that vouchers only use a normal
single time to make brand new one which
is a pen occation token is given to the
clients for them you use the medication
server from their own own and that event
occation deals with files hash lists I'm
kind so basically nothing is going to
happen unless you have a valid token
you're probably wondering hey how do we
get some answers in this ring because I
know that would be my first question too
so let's will drop some md5 hashes in
here if we get to that page eventually
hey okay so we'll just give us a sample
name our hash site and this drop down
all of the path in here is completely
editable server-side you can put
anything like in here that way whenever
hashtag gets updated you can just kind
of pop you in trees in this thing's a
ride and everything like i said before
everything is supported that hash can't
supports binary files wv8 just what in
cash let's keep imagine but for this for
definitely 2295 cos you know it's nice
and fast so like I said before the
hexose format you can help load a
regular text file the MW PA for
we do not support the oath of UVA for
men because you'll WPA format is garbage
so the course binary files should be
electric ripped and stomach we have a
bunch of different sources we can do we
can pay some clipboard we can do from
upload we can do from a import directory
on the server only we can also give it a
download URL and this is basically
server wide so anything you would be
importing into nasty pussy you have
these options to work but for this case
we'll just stick with the file upload
and then hopefully in a couple seconds
we'll have about 4,000 hatches oh my
mystical here look lovely we'll see boom
there we go so we have zero crack we
have over 4,000 uncracked so let's make
a task right we want to crack these
hashes so the command line box here the
commitment box basically hey any command
you can think of that hash cat supports
an automatically outputs into the seal
island called hashtag on console so the
only thing the UV enter in here are your
task related stuff you're not going to
be adding a you know a binary you're not
going to be adding agent specific stuff
you are literally entering the task in
the task alone you're worthless rumel
this set so like for here just for an
example will do like I'm community brute
force
alright so just going to do all
characters there if you wanted to do a
word list and the word lists to take
across all the ages of course we select
the app will stay up we probably
tendrils on that discuss we will put
everyone's favorite invest xt4 right
everyone loves then so now I'm a lot
scroll down here which everyone knows
and we see there's a few other things
that we could possibly edit here usually
the default super good I'm except for a
few things were obviously it's whatever
your preference you know your task me
Chum size is basically how long you wish
to have your agent working on the
specific task our chunk of a task i
should say and usually we found the 10
minutes for you you can usually go up
from there if you really wanted to but
at times per game i only have to lose
you no connection to nor whatever
happens that way it's nice and easy to
distribute a new chunk that's not really
weird sighs the next thing you love the
point but you can technically do
whatever length but the temp is small
and it's lonely another issue with hash
purpose was let's say you have like one
character to character three character
for character five character etc and
we're trying to put all of the agents on
whatever task was the highest a county a
problem with this where okay everyone's
on like one character well it can take
like a couple nanoseconds very much
that's nothing so we kind of set it up
to be like hey if this task is really
small like we only group in 11 agent i'm
right so then we could be like oh well
these are you know meant for you know
let's say five different agents can i'm
five different cats instead of five
different agents going to one single
task if one of them gets you know has a
little i'll say one of them gets
actually given the task and then the
rest of them are like oh no not what if
we do something we go to the next
it was really slow the way to how to set
up but and now we also have seen you
only stop to this completely sever can
GPU because obviously so now Berlin's
run a helped a lot better run cpu GPU so
we kind of separated those off from one
another so you can technically have two
different kind of pads going you have CP
machines only doing their thing and keep
you only doing their thing but anyways
let's let's create this test and then if
you say hey we have had created that's
awesome but it's going to run because we
don't have any priority the highest
Tasker the is priority gets run first
there's a few other no exceptions to
that but basically rule of thumb is
whatever the highest priority to grant
first 20 doesn't get ran at all unless
you want to manually assign agents to
that test so let's give this a priority
of 100 and we should see some ages pop
up there in seconds plug them that
shouldn't be a very quick to be a very
quick task here so we kind of want to
check out the details here so click on
the Nationals leave we'll see all the
run fun fun fun tails you got to go to
yellow and comfort the bottom use t able
to get three agents hitting there and
right now we're figuring out how long
the task is for benchmarking the agents
to see how much compute power that they
have and it will calculate out how long
is it going to take or how long ago
chunks we give it in order for that
agents me busy for the next ten minutes
so i use those pretty short hats so we
have all those crack in the key nice big
green bar means you have some cracked
and i'm sure that there's going to be a
handful more coming in you see down here
on the bottom life that we have about
1600 or so each time of Rajesh
is trying to upload all those to mysql
server and i'm sure that will grow a
little bit larger but so let's get into
some nuts and bolts like most of that
stuff is already attached to this I'll
get into some stuff that maybe isn't in
hash the bus that's kind of cool so we
can look at out of pre-configured asks a
lot of times in your running Hanson's
you probably have like a set list of a
let's throw in business business that
stuff you always try and some stuff that
works right so there's a way to save
half son half the book here if I could
find my little notes you can see I have
a whole bunch sitting here and they look
exactly like tasks right I mean they're
pretty much the exact same thing only
the priority is floating and what I mean
by that is if I issue you know ID number
98 up here and I want to issue that
again to another of this that priority
of 5,000 is going to be the very first
ones give you 5,000 and if there's
another task re running in the queue
it's going to add whatever is in the Q
plus Phi house that way you always have
a unique ID and you can just reply thing
out tasks left and right all you want
and everything is all nice and happy
we're not confused at what we see drive
so I don't mean kind of you know make
these we have a nice ring so in the new
task just like we're before instead of
selecting a hash list because leave it
as pre-configure task we can pop
waterproof wanted in here it would show
up as a pre-configured task and you
could issued out too many hands lists
which may be quick example up really
easy how to do that so select our ash
list and down if we scroll down a little
bit we see it's on a pre-configured cash
down here if you just check them all off
that's that's great Patroclus head that
and that's wonderful and Brooks okay but
we were kind of thinking
work but you want to fetch right we want
to blast out a buncha one right after
that because that's awesome so we made
super tasks and super task basically
allow you to group together freaking
that your tasks they are able to SUVs
out to any hash those do you have so you
can queue up work really really fast and
the key was awesome because you can just
kind of move stuff around as you see
willy-nilly and everything will
automatically kind of figure itself out
and whatever it is will get ran first
but we don't want to see all the agents
you know running together as laundry so
let's make something name let's make
something a little bit longer
[Music]
alright just couple seconds we should
have at least one client connected here
and all of them will connect all the
chunks and although be working
collectively on single task which is
pretty awesome because you really didn't
have too many options to do that other
than you know doing a manually splitting
tags by hand and issuing the command
line and it's a gigantic pain and if you
wanted to stop one of them and do
something else you have to issue that
jump to another client and it's an
absolute mess and let's say you get
something else you want to run something
completely different or you have to
manage adcast sessions and a whole bunch
of other things it becomes a mess really
really fast so as to what you'd be able
to handle this you know pretty well i
think that most of the basics covered
for this there's a few more like native
hearing things that are kind of nice but
I don't have a hole on the time here so
I want to get into mdx pride a little
bigs and yes is a pretty amazing program
and that's many people know about so
yeah mdx fine here zweifel ended up
mating making this a long time before i
sign up for sure pine was ever even a
consideration waffle made and started
developing yes fine then bx fine is such
a wonderful program and that's how many
people know about it so i really really
want to get this up here have a few
people always look at it so basically
what waffle is seen is he's like if
someone else's don't follow your
standard pattern of like md5 and sha-1
and shop 256 water for whatever reason
that is and there's also tools that
struggle with extremely large hasss
talking the millions you know if you
were planning on running you know has
that she definitely enhances long it's
not a lot of tools out there there to be
able to tree through that without
crashing and without taking a ton of
memory without a lot of problems
happening and mdx mine addresses these
issues thank you well so development
friend excellent started in 2013 after
noticing there were some some after
noticing that some hand solutions for
ashes were them some ashes which is kind
of interesting we call that iteration so
md5 inside of md5 inside of md5 would be
a cripple iteration right so the
original idea for ndx finals just simply
iterate mu buck that's where the name
comes from this iterate handy five this
means nice so but nowadays there's
almost 500 algorithms that mdx mine
starts and that's a huge number 4 and X
I mainly because and the x value still
fluid with what you can do with it and
as a result you technically have
billions of variations edging on Rosie's
that you couldn't have the x value based
off the standard or the 500 than it
currently supports because you can next
ashes with her hash algorithms with and
hash algorithms you technically have I
mean any hash number that you can think
of inside of another hashing algorithm
is possibility so the excellent kind of
tackles the squeeze as you can imagine a
huge test I mean that's not playing
around so what is mdx mine run on just
about everything windows linux mac OS
arm in fact some of the stuff that you
coded for the raspberry PI's and a
couple of another in and solutions that
are out there that are kind of like them
were actually better performance for
about performance per dollar they were
amazing for what they were awesome so in
the x-plane consult hansen's with very
long hatchlings 10,000 characters are
supporting doesn't say
then that's awesome because there's not
too many tools authoring that can
actually do lines in a single hash and
the ex mine introduced the extender on
the time you see a a password cracking
out program out there that originally
came from up he was the one that first
said hey we have a problem with really
complex passwords when the output in
utf-8 and you name it and in a way to
output them and I think this is the way
it should be done and everyone kinda
thought of it so that's pretty cool test
factors of 2 megabytes long originally
created with the mdx mine so here is
where mdx mind really starts to shine
really kind of show its capabilities you
could run one you can run to we can run
100 million hashes within the exponent
and the performance is basically the
same that's awesome if you guys have
ever tried to run in few million hashes
you realize how cubes that is if you
know in particular you know for this
example here we're running 78 million
hashes and we'll took three seconds
longer than one single ash that's
awesome but because of this week is
really really cool stuff with this so we
can do you know why not run all of your
own soul patches all the time doesn't
matter from performance standpoint we
can can everything into X fine and safe
and what why wouldn't just one list when
you can run them all over matter right
so one of the most common uses for
injects by it is strong multiple hats
types of the exact same time and this is
ready x is really cool so let's say you
just obtained a brand new dictionary and
you want to run run than one picture
through all your cash flows you can
totally do that so traditionally you
know you would have to run each lift
separately like from the dictionary
through your finances and your shallow
that your cell to use excel so you know
what it'd be really nice to run it
through just once just one come in you
know you and the ex fine you know you
can totally do that and you promise
should you go and you can run all any
algorithm at the exact same time you
just feed him in the hands to air out
sorry I'm Jack sign and then the x value
will automatically hatch them out as
long as you say hey you know Maxie or
whatever so again the flexibility you
have the X fine you just really really
good stuff so let's take the ideology of
running all the helpers in pero para lo
and let's take that a step further so
your pen testing team and when your
members was able to dump a user's table
on a company my smell server right so
but the only thing you'll love this hash
right here is that as 32x anyone tell me
what everyone is no you need more
information right and usually you would
do ok let's try md5 because they I mean
with 95 is a pretty solid cast I come en
dlm come yellow could be where so we
have a list of hashes have no idea what
the elements or combination algorithms
are happy so our example dump you know
again it's 32 bags you know then DX
going to handle figuring out what this
is relatively easily I just throwing a
few commands over and we'll break this
down just a little bit the very next
slide your rental it's kind of tense so
everyone is kind of used to pass can't
handle the over the news for you for
when you're cracking new example you'd
be like it's specifically state I want
sha-1 you run that with dash cam 1
Hunger right and because of this
ideology of everyone doing that and the
x value can be kind of difficult to
understand in person and when you look
at the sort of help your kind of like
well this help is not really helping me
but that's because you have to change
your way of thinking when you're dealing
with an x mark but then the X fine just
doesn't do just do this one algorithm
you can do that but you can do any other
than you wish and basically what that
does is cover how you do that is because
you could do you basically tell mdx
finder whatever regex you want your do
analysts so in this example here we see
okay we're calling in the x-men we want
to search all algorithms with that date
at that age all we want to exclude
anything insulted because we're going to
think back to our MySQL table i showed
in my example right in CT Styles same
thing with user so basically mdx mine
does salt and use your separate from
each other so you can use the kind of
interchangeably as salts because again
you don't know what algorithm that
you're using does it salt with the
username you know as the data that's
sitting in there and it looks like a
salt amount of salt etc and then we can
iterate up to five algorithm or iterate
five times with whatever algorithm that
is currently recognize so you can just
say if you want to do md5 nested 100
times you can just say dash h and then
you can go carrots md5 dollar sign and
then say I 100 and that would be I'm you
bike generated 100 times you can do
whatever you like with this and then a
super awesome when you start thinking
about stuff up hey you know I don't know
what this is or what kind of really
weird algorithm are they using chances
are if ash guy doesn't support it check
on any fun at the x5 products you just
have to tell if that this is exactly
what I want so basically I'm kind of
running out the clock here but um so I'm
pretty much finished by the mdx mines is
not going to replace your existing
cracking software but is one of mazing
like flexible tool you should have it
your toolbox if your password cracker so
if you have any questions or any help
with any of this stuff anything that you
want to check out if you need
clarification whatever Sonia or channels
for priming emails and whatever getting
ahold of us do something would you try
to help you out we're just
buncha guys that love cracking passwords
so with that you know thank you guys for
coming it's great wonderful thank you
guys so much
[Music]