InsidePro
Link to original writeup (external, pdf)Resources
| Members | 16 |
|---|---|
| Handles | Admin, -=Cerberus=-, .Scorpio., dda, H0AX, Fzero, Kaiser, lindros, mastercracker, Mastermind, passcape, POLIMO, Porr3, teraflopgroup, test0815, Tyra |
| Software | Hash Manager / HM Tools, oclHashcat / cudaHashcat, Extreme GPU Bruteforcer, John the Ripper, Unified List Manager (ULM) |
| Hardware | Roughly 100 CPU cores, and roughly 50 graphics cards. |
Crack Me If You Can 2015
InsidePro Team
Write-up
Preparation
Before the CMIYC competition, we have developed a client for managing statistics, cracks, left lists, etc. This client was tested in the HashRunner competition and after a couple of improvements, was ready for the real test. We had also setup TeamSpeak server for main communications, a Google spreadsheet for splitting tasks amongst the team and a forum board for more elaborate messages. Finally, we have prepared a module to crack the new Argon2 hashes just in case they would have been part of the contest.
General strategy
Our global strategy pretty much stayed the same: Free for all in the first 12 hours focusing mainly on the fast hashes and then identify patterns to apply to the other hash types. Once a pattern is found to be present in the slow hashes, a group task is created to either quickly get the cracks out or to quickly see if the pattern is not worth pursuing.Contest
Like planned we went for the free for all approach in the first hours of the contest. However because of the submission format and the fact that the member responsible for password submission was working at the beginning of the contest, we were not able to properly submit our cracked list before around 12 hours into the contest.It was quickly noted that all passwords contained special/national characters so one of the approaches was to filter all the wordlists for only words with at least one of these characters in them. One of the patterns noticed was the Korean alphabet concatenated together such as "ieungpieups sangdigeut". We had hits in pretty much all algorithms with this pattern but the member who got them in the first place is unknown.
Using all the passwords gotten in the first day of cracking, one of our members created a custom charset on JTR and got several hits on various algorithms. The blowfish hashes kept us busy on trying to find new patterns besides the Korean alphabet. We did have a couple of passwords with Japanese words concatenated but could not find an attack with a reasonable keyspace to cover in time and get hits. At least we got some reasonable amount of hits on the SHA512crypt using a wordlist with passwords only in $HEX[] format that one of our member had. This has been the main group task that lasted almost the entire contest. Finally 2 other approaches did give some good results: 1) rules that insert special characters at every position of the word and 2) using the random rule generator of oclHashcat.