1
$\begingroup$

Taking a graduate computer security class, part of our current assignment is to crack 50 Unix md5crypt password hashes, due on Thursday, October 8th (in eight days.) I've managed to crack 49 out of the 50 passwords using hashcat, but the last password seems borderline impossible within the time given to us.

The hash for this password is $1$gT$qN6H47wSbSr4TaWFkuo/c.

The restraints on this password (given through hints from the professor) are as follows:

  • The plaintext is 8 characters long
  • The first character and last two characters are lowercase
  • There are two numeric characters, and the rest of the password consists of only uppercase and lowercase letters (no symbols).

The best approach I could come up with was using a mask attack with the mask ?l?2?2?2?2?2?l?l, where ?2 = ?l?u?d, but this would take a maximum of 20 days on my single desktop machine, far too long to be able to complete the assignment.

I could potentially try to assume that characters 1-5 (inclusive) are not lowercase, which allows us to use the same mask with ?2 = ?u?d, which cuts the max crack time to 1 day 13 hours. Certainly within the realm of possibility, but that's only in the case that my assumption is correct.

To be clear, this last password apparently isn't required for full credit, but at this point, I'm just curious to see how it could be cracked as fast as possible.

Is this crack possible within the remaining 8 days we're given, or is our professor setting us up to fail without giving us any further hints? Are there any other novel approaches I could take to crack this password faster?

Improve this question
$\endgroup$
5
  • 1
    $\begingroup$ There are $\binom{5}{2}=10$ choices of 2 digits among 5 middle characters, totalling in precisely $10 \cdot 26^3 10^2 52^3 \approx 2^{41.17}$ possibilities. For using programs, these can be covered by the 10 masks. I think $2^{41.17}$ should be doable within a day on a GPU. $\endgroup$
    – Fractalice
    Oct 1, 2020 at 15:48
  • 4
    $\begingroup$ a bit of searching around indicates that you may want to have a look at the rules engine of hashcat. Also you may want to check whether you have access to more powerful machines. $\endgroup$
    – SEJPM
    Oct 1, 2020 at 15:50
  • 2
    $\begingroup$ First and easy thing is to count how many possible passwords matching the three conditions there are; do this, and show us your result $a$ (Fractalic tried that, but at least I can instill some dose of doubt about this spoiler :-). Find $b$: how many passwords match the pattern that you reportedly determined would take $20$ days on your hardware. Hint: the time required is $20\,a/b$ days (for the same unstated proportion of the password space explored). With a minor change to JtR, or competent parameterization (perhaps with a simple script), that value can be reached. $\endgroup$
    – fgrieu ♦
    Oct 1, 2020 at 15:51
  • $\begingroup$ There's still the question of whether the professor lied about the requirements. It's not unheard of for such a thing to occur, just to f*k with students. Assuming the professor *didn't lie, however, you should be able to crack that password; adding a GPU would do just fine. That is, if you have access to a GPU to break hashes. $\endgroup$
    – Serpent27
    Oct 2, 2020 at 6:10
  • 1
    $\begingroup$ What was the result of this? Did you find the password? [moderator note: this comment was originally posted as a question. Either pings the OP, who was kind enough to answer] $\endgroup$
    – Sam
    Feb 23, 2021 at 22:10

1 Answer 1

Reset to default
2
$\begingroup$

Coming back to answer this since I see someone is wondering if I was able to do it.

The professor, seemingly realizing that this assignment wasn't possible in the time given, gave another hint that made this doable.

  1. The plaintext is 8 characters long
  2. The first character and last two characters are lowercase
  3. There are two digits, and the rest of the password consists of only uppercase and lowercase letters (no symbols).
  4. The second character is a digit

Using these criteria, there are only 12 possible arrangements for the remaining characters (characters three, four, five, and six, which contain a digit, two uppercase letters, and a lowercase letter.)

I made a list of the following masks in an .hcmask file, ran it through hashcat, and the crack now only took roughly eight hours.

?l?d?d?l?u?u?l?l
?l?d?d?u?l?u?l?l
?l?d?d?u?u?l?l?l

?l?d?l?d?u?u?l?l
?l?d?u?d?l?u?l?l
?l?d?u?d?u?l?l?l

?l?d?l?u?d?u?l?l
?l?d?u?l?d?u?l?l
?l?d?u?u?d?l?l?l

?l?d?l?u?u?d?l?l
?l?d?u?l?u?d?l?l
?l?d?u?u?l?d?l?l

The password ended up being cracked successfully: e3IDq9wv

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.