[Music]
so my name is Adam log and I'm going to
be covering the lots of locks challenge
today um do you want me to just walk
through the whole thing real quick or do
you want me to just cover what I did
okay
sure you guys hear me
[Music]
okay is that any
better all right
cool so with the lock of locks challenge
pretty much you just netcat to um this
host on this port right here and they
provided you a word list to use and
effectively each time you you know
received a md5 or sha one sorry shot 256
or sha 512 hash you would then be
prompted to enter the clear text
password so it was a password cracking
thing so they gave you about I want to
say three minutes to actually you know
go through and do all these things so
instead of automating it um the first
thing I tried was actually you know
going through know taking each hash you
know I um Echo the hash into a
file and then um depending on what it
was staff in all guest in the Wisconsin
Center will the owner of a pensy truck
with a Indiana plate
2863
443 again a pensy truck with an Indiana
plate 286 3
443 your truck needs to be moved
immediately off the dock or it will be
towed in 15
minutes
we've still got time if you want to
wait um so again in this case right here
you could either use John the Ripper or
hashcat you know um in my case if I did
something like
um John
hashes and then gave it the actual word
list um
whoops which was that 10 million thing
right there
and give it the format
of
raw D5 then it would go through and it
would crack it and I'd copy that and
would paste it into the um next part of
the challenge right well again that was
taking too long to do because there's a
lot of going back and forth so I
actually figured okay they're using md5
they're using shot 512 and they're using
shot 256 we can literally go to hashes
dcom paste the hash here hit submit and
it'll tell us you know what it is and
then we can go back enter it and get the
next hash so um the better way to
automate this if we only had you know
like 10 seconds or so would be if you
took each of the um each of the word
list or each of the words in the word
list and then hash each one with md5 and
then um hash each one with sha 512 and
shot 256 and create a lookup table you'd
then pretty much be able to then you
know receive a hash look up what type of
hash it is um and then look up what
corresponding word goes with that so
sort of a reverse password cracking
approach in that aspect um but after you
I think you did about 10 of those you
get the flag down here and that's it any
questions I did do it one by one um a
lot of copy
pasta yep so I think honestly I could
probably try to run through it really
quickly so you take this
copy
pasta take that paste it in there and
then rinse and
repeat so um not anything too terrible
after I think the fourth or fifth one
then they start to actually capture you
and then you have to solve a capture
which takes a little bit of time but you
can see how this actually is pretty
efficient way of doing it um at least as
far as the manual way it
goes yeah so the question was uh is this
the way that I intended it to be solved
uh one of the fun things I've been
writing ttf challenges for probably like
I don't know eight or nine years now in
the fun thing is that nobody ever solves
them the way that I intended for them to
be solved like that that's part of the
reason I wanted to do the uh the 4X you
know fouron four multiplayer Showdown
today was to show off that there are a
ton of different ways that you can
approach each of these challenges so if
you're doing CTF de there is no right
way to solve a challenge I was talking
to somebody else that worked on it and
solved it they actually just copied and
pasted right into Google as well if you
search Google the hash you can get them
um I I part of the reason that I did 10
minutes or 3 minutes with 10 hashes is I
knew that you could actually maybe solve
it with a manual wave are fast enough um
the hash cat's one of the other options
because it's such a small word list you
can also pre-compute all the hashes so
like you can just take the Sha hash of
every single one in that word list and
have a lookup table and that's like a
pretty quick way to automate it so yeah
there are a ton of different ways and I
didn't have any particular plan on how
it how it could be solved
Yol any other questions go ahead what
would your
more
um like it wasn't just doing
single
but so are you saying like if the um if
the examples were stuff that um was
variations of SE a word list and we
didn't necessarily have these specific
words how would I go by cracking them in
an efficient manner you could
just
um okay yeah so um with tools like you
know hashcat for instance they have
several different modes and ways to
actually you know perform different
attacks so the basic dictionary list
guessing attack is one of them but they
also offer um options such as mask
attack so a mask attack lets you take a
dictionary word from a word list and
then append you know either like
multiple characters or um you could even
add you know specifics like only numbers
after this or um only symbols or only
letters and it lets you sometimes you
know um
combine um you know like let's say you
use like rock you as a word lless and
then you wanted to combine you know like
four characters after that you could
actually go through and it would take
every single um you know word one by one
it would then append you know like AA
through you know 99 or you know
depending if you had special characters
as well it would add those to every
single word before moving on to the next
word so it increases the size in the key
space that you have for guesses um
another option for that would be you can
take word list and you can combine them
together and you know like sort of like
Legos and you know make new words and
phrases and stuff so for things like
past phrases
um or you know passwords have spaces in
them things like that sometimes adding
you know one word list you know an
underscore or a space or a dash and then
another word list and you can you know
substitute that space Dash or whatever
with um you know a mask attack to add
another character in between there to
separate them out and you can sometimes
crack really long complex passwords that
way does that answer your
question routers it's n ver number so
once you figure out how their
combination for their default is any
wireless
password like hollow tree
127 any other
questions instead of uh 10es in the next
3 minutes 10es in the next 30 seconds
what would
you um so then in that case I would
basically um I take my word list let's
say we had
um
[Music]
um I think this will work nope I'm
missing a
quote we can try something like this
Trent knows exactly what I'm trying to
of do and is watching me struggle
through
this um well basically you'd have each
word and um let's see if this will
work so we have each word in the word
list right if we um we did an md5 some
of each
one you Echo
what
oh t
n
um okay yeah um
so I don't even know if I have md5
someone this
um no that's not going
to oh I see
okay that might work there we go so yeah
so pretty much you'd have that and then
you'd have
um Echo
Tech
word well you get the idea um I would
have to
yeah exactly that's sort of what the
idea behind this is so you can sort of
see what I was trying to accomplish
there youd basically have the password
and you'd have the um the hash for that
so um you could do it with pone Tools in
Python
um I don't have that installed here so
um I'm not going to be able to done with
that but effectively the idea behind it
is um you're you know again creating a
dictionary list so you'd have the word
in one dictionary and then um as the key
in the dictionary and the value would be
the hash and then um you'd automate it
so the pone tools would then connect out
to the netcat um server it would pull
down the hash parse it out and it would
say okay we have um an md5 type of hash
and this is the hash it would then
compare it to um what is stored in your
list so you run through a for loop on
there and then it would find okay here's
the um here's the hash that we have from
the netcat server here's what we have in
the dictionary and we can look up the
key value pair associated with that
return that value and then send that
onto the
server
any other
questions thoughts comments
concerns all right thank you guys
awesome yeah Round of Applause for Adam
he did not expect that have to do this
today I so and this is you for doing
that last minute um so we will meet back
here at three for the finals so if
you're one of the top five people to uh
to end up in the or on the scoreboard
show up uh bring a laptop and be ready
to plug in we're going to do a live live
hacking challenge um I a couple I know
at least one of the people had to bounce
so if you were not one of the top five
but still want to play like feel free to
have a laptop ready to go and plug in in
any empty seat that exists uh but we'll
kick that off uh right around 3 we might
have one more demo at 3 and then we'll
we'll do the live event right after that
so all right see you guys
thanks