Post cover image
Photo by Nana Dua on Unsplash

May 10, 2022

Cracking Passwords is Faster than Ever Before

The new GPUs are beasts at brute-forcing passwords. There is no secure password.

By David Amrani Hernandez

3 min read

In this tutorial I will use Kali Linux as it is the most widely used framework for this kind of tasks and it is built on top of the Debian distribution which is currently the most widely used.

We will make use of Hashcat, the default password cracking tool, using the GPU and some wordlists that collect the most used passwords.

Installing GPU drivers

In order to optimise the use of Hashcat we must use the GPU instead of the CPU. These GPUs are intended to process graphics as fast as possible and in a different way than the processor, performing simpler and faster calculations… something that comes in handy when brute-forcing passwords.

Let's update our system and see what driver we have installed and is using our graphics card.

kali@kali:~$  sudo apt update
kali@kali:~$  sudo apt -y full-upgrade -y
kali@kali:~$  sudo reboot -f
kali@kali:~$  lspci | grep -i vga
        07:00.0 VGA compatible controller: NVIDIA Corporation
        [GeForce RTX 3090]
kali@kali:~$  lspci -s 07:00.0 -v
        ...
        Kernel driver in use: nouveau
        Kernel modules: nouveau

The nouveau driver is managing our GPU. Let's replace it with the Nvidia driver:

kali@kali:~$  sudo apt install -y nvidia-driver nvidia-cuda-toolkit
kali@kali:~$  sudo reboot -f
kali@kali:~$  lspci -s 07:00.0 -v
        ...
        Kernel driver in use: nvidia
        Kernel modules: nvidia

And finally, confirm that hashcat is using the GPU driver correctly:

kali@kali:~$  hashcat -I
...
Backend Device ID #1 (Alias: #2)
  Name...........: NVIDIA GeForce RTX 3090
  Processor(s)...: 40
...
Backend Device ID #2 (Alias: #1)
    Type...........: GPU
    Vendor.ID......: 32
    Vendor.........: NVIDIA Corporation
    Name...........: NVIDIA GeForce RTX 3090

Benchmark Comparison

As we can see in this comparison, this year's graphics cards are performing much better than previous models, doubling the performance and even surpassing it.

GeForce RTX 2070 SUPER, 6719/8192 MB, 40MCU
Hashmode: 0 - MD5
Speed.#1.........: 34762.3 MH/s (76.85ms) @ Accel:64 Loops:1024 Thr:1024 Vec:8
Hashmode: 100 - SHA1
Speed.#1.........: 11034.0 MH/s (60.45ms) @ Accel:16 Loops:1024 Thr:1024 Vec:1
Hashmode: 1400 - SHA2-256
Speed.#1.........:  4268.5 MH/s (78.00ms) @ Accel:16 Loops:512 Thr:1024 Vec:1

GeForce RTX 3080 Ti, 11328/12288 MB (3072 MB allocatable), 80MCU
Hashmode: 0 - MD5
Speed.#1.........: 64368.0 MH/s (41.45ms) @ Accel:32 Loops:1024 Thr:1024 Vec:8
Hashmode: 100 - SHA1
Speed.#1.........: 20632.8 MH/s (64.78ms) @ Accel:16 Loops:1024 Thr:1024 Vec:1
Hashmode: 1400 - SHA2-256
Speed.#1.........:  8817.0 MH/s (75.84ms) @ Accel:8 Loops:1024 Thr:1024 Vec:1

GeForce RTX 3090, 24064/24576 MB (6144 MB allocatable), 82MCU
Hashmode: 0 — MD5
Speed.#1………: 65079.1 MH/s (41.37ms) @ Accel:32 Loops:1024 Thr:1024 Vec:1
Hashmode: 100 - SHA1                                                           Speed.#1.........: 22757.6 MH/s (60.21ms) @ Accel:16 Loops:1024 Thr:1024 Vec:1
Hashmode: 1400 - SHA2-256                                                           Speed.#1.........:  9713.2 MH/s (70.57ms) @ Accel:16 Loops:512 Thr:1024 Vec:1

Using wordlists

Since we are talking about cracking passwords, one of the most efficient and widely used techniques is to make use of dictionaries to find out passwords. Dictionaries are huge lists containing millions or billions of commonly used passwords, and they compare them one by one until they find the password we are interested in.

Currently the most common site to obtain these dictionaries is weakpass.com. Here you can find a lot of dictionaries with any kind of passwords (user, wifi, databases, linux, latin, russian…) or you can create your own dictionary using an input list of words and mixing them.

You can find from small lists with a few thousand passwords, for example linux users, to lists of billions of users that occupy several hundred Gb on your computer.

Here is a comparison of the results of the different dictionaries launched on a huge list of passwords. As you will see, the biggest dictionaries are the ones that get the best results for obvious reasons.

Wordlist tests Wordlists Wordlists only Wordlist,Cracked,Cracked %,Size (MB),Keyspace,TTE (s),Time score,Size score,Hitrate %…

We can run this tool just with this command, where passwords_to_decrypt.lst is our list with encrypted passwords and /usr/share/wordlists/rockyou2021.txt is our wordlist downloaded from weakpass:

kali@kali:~$  hashcat -a0 -m0 passwords_to_decrypt.lst /usr/share/wordlists/weakpass_3a
...
CUDA API (CUDA 11.4)
====================
* Device #1: NVIDIA GeForce RTX 2070 SUPER
...
f710540d440604fdc98aa7b6b9bf7bff:Campeon1978
df38e32f11f2874b9f1c777d4ac3d723:carlos151170
9210e4122053e0e6425868eff56e7e26:Carmelo2552
e80645d07264c618e1c88d0a4c233489:Carmona60
fa8ef8f2425f38bbe6355d8a982c0d7a:colokasia
19f8e9ad71a54198ff06da07e88423b3:Cote1303
dfb92bd9078e7aee4140b64808b117ef:Delgado5791
44992fafead891b72413d0b66c348b98:entreparis

Using Brute-Force

Using brute force has never been faster and more efficient than it is today thanks to the latest GPUs that are delivering better than usual performance. That's why the high demand and shortage of stock, because of its high efficiency in simple calculations very useful for processes such as password cracking or cryptocurrency mining (the latter much better remunerated).

Now that we have such superior performance, we can use brute force to reach more common password lengths such as 10 or 14 characters. Let's see how to do it:

kali@kali:~$  hashcat -a3 -m0 ./pass_to_decrypt.txt ?a?a?a?a?a?a?a?a?a?a
...
44992fafead891b72413d0b66c348b98:entreparis
5bdcd2e788a4eaf36c7cbc52095f03dc:kiriki2015
65e09a25b3fa63977a08aa0d9acedf53:dievabo313
bb466f9376f8de566ea602c501bfa439:5Caracoles
c5a115b187094127cc19c030db1e71ae:german8778
...

Also we can mix a dictionary with a bruteforce attack, so basically, hashcat will test every word in the wordlist but, also will add our bruteforced input to it, for example:

hashcat -a6 -m0 ./pass_to_decrypt.txt ./my_wordlist.txt ?d?d?d?d
...
41e1be2beae2a7965807b33d6aacc5f5:john19943
1ce071804d8ba40a1902bd1c2b9ef22a:ohmyfuckinggod1998
704ec151967f0c31ea9228a462637847:julianroh1969
...

As you can imagine, this kind of mixed attacks are meant to save a lot of time, especially for very long passwords or when you have some information about the password (they usually consist of a text part at the beginning and a digit part at the end).

Hope you enjoyed it and see you soon.

🍻 Regards