Summoning the Password Cracking Beast

Size: px

Start display at page:

Download "Summoning the Password Cracking Beast"

Judith Hood
5 years ago
Views:

1 Password Summoning the Password Cracking Beast Brian Johnson Security Enthusiast / Podcaster 7 Minute Security Jeff Melnick Solutions Engineer Netwrix

2 Agenda Introduction Build an awesome cloud-based password-cracking rig Download millions of known pwned passwords Dump and crack user accounts from Active Directory Make sure your password policy is strong enough to resist password cracking Netwrix Auditor Demo

3 Who s this guy? Security engineer for 7 Minute Security Podcaster Not famous Tiny movie star

5 Build the password-cracking beast

6 Deploy the VM

7 Test the SSH connection

8 Protect the SSH connection

9 Protect the SSH connection

10 Change the host name

11 Change the paperspace password

12 Install essential software

13 Install essential software

14 Install NVIDIA drivers

15 Check out our sweet benchmarks!

16 Gather wordlists

17 Grab a bunch of wordlists for cracking

18 Grab a bunch of wordlists for cracking (singing We will, we will, rock you! )

19 Grab a bunch of wordlists for cracking

20 Grab a bunch of wordlists for cracking

21 Grab a bunch of wordlists for cracking

22 Grab a bunch of wordlists for cracking

23 Optimize the password lists!

24 Tweak the Hatecrack config

25 Adjust the config files

26 Adjust the config files

27 Crack our first hash!

28 Our first crack job!

29 Dump and crack AD user hashes!

30 Import test users into Active Directory

31 Create AD backup (with hashes!)

32 Upload hashes to the beast

33 It s cracking time!

34 It s cracking time!

35 Conclusion Password cracking is (relatively) cheap and (relatively) easy! o o o o o Create a cracking VM in Paperspace Download a ton of wordlists Optimiяe them with Hatecrack Dump hashes out of Active Directory It s cracking time!

36 Netwrix Auditor Know Your Data. Protect What Matters.

37 About Netwrix Corporation Year of foundation: 2006 Headquarters location: Irvine, California Global user base: over 300,000 Recognition: 7 years among the fastest growing software companies in the US More than 140 industry awards

38 Make sure your password policy is strong enough to resist password cracking Enforce Password History policy This policy will set how often an old password can be reused. It will discourage users from reusing a previous password, thus preventing them from alternating between several common passwords. Maximum Password Age policy This policy determines how long users can keep a password before they are required to change it. It forces the user to change their passwords regularly. Minimum Password Age policy This policy determines how long users must keep a password before they can change it. It will prevent a user from dodging the password system by using a new password and then changing it back to their old one Minimum Password Length policy This policy determines the minimum number of characters needed to create a password. You would generally want to set the Minimum Password Length to at least 8 characters since long passwords are harder to crack. Passwords Must Meet Complexity Requirements policy By enabling this policy, you ll go beyond the basic password and account policies and ensure that every password is secured. Store Password Using Reversible Encryption for All Users policy This policy should only be enabled on a per-user basis and then only to meet the user s actual needs. If your company uses an application that needs to read a password in a password database which is normally encrypted, then that is the only time you would want to enable this setting.

39 Useful links Join our next session Password123456: Protecting Your Active Directory Castle on March 9 am PT / 12 pm ET Read our Password Policy Best Practices Guide Check out Netwrix Auditor for Active Directory and its password expiration notification tool If you want to learn more about Netwrix Auditor, register now for the upcoming Product Demo!

40 Useful links Password cracking in the cloud a step-by-step instructional sheet how to crack hashes in the cloud server: github.com/braimee/0709b df864b886b750bc42ce Creating AD backup dump of user accounts and hashes how to dump the hashes out of Active Directory and get ready to crack them: github.com/braimee/4dd6fb4f88e4bdd07e093a919064de96

41 Questions?

42 Thank you! Brian Johnson Security Enthusiast / Podcaster 7 Minute Security Jeff Melnick Solutions Engineer Netwrix

4 Ways Your Organization Can Be Hacked

Behind the Scenes 4 Ways Your Organization Can Be Hacked Brian Johnson President, 7 Minute Security Jeff Melnick Netwrix, Systems Engineer Agenda Quick introductions The ways your organization can be hacked