Printable View
That's the problem with doing a bruteforce attack, that's why many people suggest using a wordlist.Quote:
Originally Posted by Quest
I think crunch can still do what you are asking for, maybe not exactly how you would like it done though. LOL
Use google and do a search for "A day with tape". :-)
yes I've read his blog about crunch. Very useful, but I failed to notice anything helpful to make crunch start spewing out non-outer-planetary words.
Passwords that ppl create are logical. Passwords that Crunch generate are illogical. That's a big prb me thinks when trying to crack a human generated 8-10 character set.
That is why you use a hashcat brute force attack with masks.Quote:
Originally Posted by Quest
You can define that (for example) the first 6 characters are letters with the 1st of that six is always a capital. Out of the remaining 4, 3 are numbers and the 4th digit is a special character.
This means we get Aaaaaa000! to Zzzzzz999* are everything between. Its more likely that a password will be Lasors165! instead of A3%h@j&d6^
I've never used hashcat before so I'm not sure how to write it into FrankenScript just yet, I'll have to look into it at a later time as my things to do list is rather big. LOLQuote:
Originally Posted by staticn0de
Maybe crunch can be used to generate all combinations and then filtered using sed or awk.
Quote:
That is why you use a hashcat brute force attack with masks.
You can define that (for example) the first 6 characters are letters with the 1st of that six is always a capital. Out of the remaining 4, 3 are numbers and the 4th digit is a special character.
This means we get Aaaaaa000! to Zzzzzz999* are everything between. Its more likely that a password will be Lasors165! instead of A3%h@j&d6^
The problem remains. Hascat will go trough all illogical and logical combinations(within the specified parameters) before finding Lasors165, as Hascat can't(?) separate vowels from consonants.
In other words...
Lasors165
Capitalized consonant | vowel | consonant | vowel | consonant | consonant | three digit number.
*sees a logical pattern here*
But before Hashcat stumble on that passphrase, it generated things like Cpakwb519 a million times, for hours, even with the most strict parameters(arguments). There has to be a more logical way to do this without a dictionary, and the key to this problem is to separated the vowels from the consonants as 2 different character sets.
Another way would be to use these programs as is, and have a rig the size of a car, with 54 video cards, plugged in directly on a power central. Brutforce hein?
Anyways, very glad to have you guys onboard =] I see a fork in Crunch&Hashcat's future :cool:
Unfortunately no forks. Not for hashcat anyway. It is not open source.Quote:
Originally Posted by Quest
Thank you staticn0de
Your comment triggered me to run over their forum to ask the question, and a search lead me to that..
https://hashcat.net/wiki/doku.php?id...ustom_charsets
a plain text file with the .hcchr extension, containing the characters(vowels and another file with consonants) is all that is needed, it seems.
I'll do abit more digging for Crunch.
Hi guys Im new and iI have some issues in extracting the files from the archive. Can someone post or send me the files inside? Please
Hi guys I'm new and facing some initial issues, i can't extract the script from the downloaded file, please can someone help me? Thank you in advance.
I also had that problem when i first downloaded it, i seem to remember it was an incomplete download. After googling around i found an alternative download which was no problem. Out of interest when you download it does it have .exe on the end of the file if so that was the incomplete file i also first got. If its any help i'll see if i can find my source and point you in the right direction.
Try this link:
http://66ptdww17j.1fichier.com/
oki I'm back. I will do my best to experiment with oclHashcat and Crunch this week...
What I was looking for is actually called "Markov Chains". http://blog.spiderlabs.com/2012/07/h...ov-chains.html
i'm following a very interesting lead http://hashcat.net/forum/thread-1291.html for injecting 'intelligence' into oclhashcat.
Atom, has created a .bin called "statsprocessor-0.083" based upon "Markov Chains". http://hashcat.net/wiki/doku.php?id=statsprocessor
Edit: Actually "Markov Chains" is already included in ocl/cudaHashcat
http://hashcat.net/wiki/doku.php?id=oclhashcatQuote:
* Markov:
--markov-hcstat=FILE Specify hcstat file to use, default is hashcat.hcstat
--markov-disable Disables markov-chains, emulates classic brute-force
--markov-classic Enables classic markov-chains, no per-position enhancement
-t, --markov-threshold=NUM Threshold when to stop accepting new markov-chains
Now just need to figure it out. If anyone has some experience using the above arguments, please share.
can't stop progress
philsmd, over at Hashcat.net was good enough to help me out with my quest http://hashcat.net/forum/thread-3668.html Thank you Phil
Can you work with that information Slim? Let me know. I will do some experimenting on my end also..
Yeah I think so, it shouldn't be to difficult to build it into FrankenScript.Quote:
Originally Posted by Quest
I've scrapped the other versions of FrankenScript due to it having to many issue's, so I'm rewritting everything again.
I have to say ive been following the growth of this script and find it very interesting. Its not the normal approach to a how too, in fact i'd personally say its far more informative. The collaberation between you guys to create and over come problems, should be encouraged and admired. Keep up the good work. :cool:
Hey skycrazy! Glad you enjoy the show =]
I'm just a user with a big mouth. Slim does it all, it's his creation. I would love however to see staticn0de work on this project..
@Slim, any ideas to invoke ocl/cudaHashcat without the full path? Now I'm using this syntax..
That will be a small problem, as there will be 4 sets of command lines. Two for ocl(i386 and x64) and two for CUDA(i386 and x64).Code:cd /usr/share/cudahashcat/ && ./cudaHashcat64.bin -w 3 -m 2500 /root/capture.hccap -a 3 ?u?l?l?l?l?l?d?d
Also, Markov Chains doesn't seem to kick in. May have to use a mask...
Sorry mate but I still haven't had chance to look into hashcat, I've been busy decorating and and rewritting FrankenScript in my spare time.Quote:
Originally Posted by Quest
If you can look into hashcat I can get all the info from you once I've finished FrankenScript.
yes don't worry. Making progress http://hashcat.net/forum/thread-3668....html#pid20987 went from 45days -to- 4hrs for a 8 character set.
Can't see options for Crunch for injecting intelligence into it. So it will stay brutforce(and dumb) unless someone has an idea.
For decorating, lighting is very important and often neglected ;)
Hey Quest,Quote:
Originally Posted by Quest
I've made a short shell script that will check if hashcat is installed and then offer to set up links so that it can be called without full path (can be called with cudahashcat32 and cudahashcat64)
I was toying around within Frankenscript to insert it as a menu check when hashcat was selected for use.
I don't see it being hard to check the arch type running the script so it can select if you want cudahashcat32/64 and install only the correct one so it is called with the "cudahashcat" command. Could be the same for oclhashcat, nothing a grep of pci devices wont fix (as it looks for nvidia or ATI)
either way, the script I just made in about 5 minutes (don't judge my terrible coding skills) which works (just)
Code:#!/bin/bash
#staticn0des hashcat insert
#check if installed
if [ -f /usr/share/cudahashcat/cudaHashcat32.bin ] && [ -f /usr/share/cudahashat/cudaHashcat64.bin ]; then
echo "cudaHashcat32.bin and cudaHashcat64.bin found"
else
echo "cudaHashcat32.bin and cudaHashcat64.bin not found in /usr/share/cudahashcat/."
echo "Download them from hashcat.net and extract to /usr/share/cudahashcat/"
echo ""
read -p "Press any key..."
fi
#check if bin links are installed
if [ -f /usr/bin/cudahashcat32 ] && [ -f /usr/bin/cudahashcat64 ]; then
echo "cudahashcat bin links found. Call directly with cudahashcat32 and cudahashcat64 from terminal"
else
echo "cudahashcat bin links not found. cudaHashcat cannot be called without full path"
echo "Install bin links now?"
read -p $GREEN"[y/n]:$STAND " bin_link_option
#Install bin links
if [[ $bin_link_option == "y" ]]; then
cat > /usr/bin/cudahashcat32 <<EOF
#!/bin/bash
cd /usr/share/cudahashcat/ && ./cudaHashcat32.bin "$@"
EOF
cat > /usr/bin/cudahashcat64 <<EOF
cd /usr/share/cudahashcat/ && ./cudaHashcat64.bin "$@"
EOF
chmod +x /usr/bin/cudahashcat64
chmod +x /usr/bin/cudahashcat32
fi
fi
you rock my friend! That will actually solve the problem of implementing cuda/ocl into FS. Let's see what Slim has to say..
I'm very happy with Markov Chains also...
funky words, but words non-the-less.Code:Mampho80
Mannti91
Maasos33
Markse91
Maetro80
Maltro80
Masoti91
Maiamo80
Maosos33
Matryo80
Mambul91
Manoti91
Maadro80
Mardro80
Maedro80
Malues33
Mascia80
Mairyo80
Maooti91
Matsos33
Mamsos33
Mankse91
Maaiti91
Sarint98
Sasers01
Salant98
Satint98
Samint98
Saastr98
Saelet98
Saiant98
Saomam34
Sanint98
Saront98
Sasham34
Salont98
Satont98
Samont98
Saatet98
Saeant98
Saitet98
Saouss01
Sandet98
Sartet98
Sasint98
Elmpil29
Elamol29
Eletol29
Elices29
Elosho29
Elntol29
Elrsho29
Elssho29
Ellula29
Eltrol29
Elmmol29
Eladol29
Eledol29
Eliela29
Eloomi29
Elnomi29
Elrula29
Elsomi29
Ellyla29
Elttol29
Elmula29
Elaces29
Eleela29
Eliomi29
Elotol29
Elnsho29
Elrdol29
Elsula29
Ellsho29
Ansina33
Anlles33
Anthal33
Anmpal33
Anamal33
Anetes33
Anicho33
Anosti87
Anntes33
Anrsti87
Anssti87
Anluse33
Antres33
Anmmal33
Anades33
Anedes33
Anieri87
Anoona33
Annona33
Anruse33
Ansona33
Anlyal33
Anttes33
Anmuse33
Stay tuned kids, this is interesting
I can do a copy and paste if that's what you want, that's if it's ok with staticn0de?.Quote:
Originally Posted by Quest
well yes that's a piece of the puzzle. Otherwise there will be 4 different command lines to invoke oclHashcat to match what setup a person has..
- nVidia (CUDA) i386 (cudaHashcat32.bin)
- nVidia (CUDA) x64 (cudaHashcat64.bin)
- ATi (ocl) i386 (oclHashcat32.bin)
- ATi (ocl) x64 (oclHashcat64.bin)
The script statcn0de has created will make your life easier to include oclHashcat in the next FS, I would imagine.
I do believe that it is ok with staticn0de for you to steal his code and run away. I will not tell.
Sure, use what you can.Quote:
Originally Posted by slim76
I'll make It less terrible when I get a chance. Add auto detect for ati / NVIDIA and detect 32/64 bit.
well I object!
It is called FrankenScript!! To make it less terrible would go against all international monster conventions. *Geez do I have to explain everything?*
:P
.............and now back to our regular broadcasting...........
so I'm working with 3 different .hcmask files(2 of them I will probly endup fusing together) that I would like to submit under peer review. All 3 files share common features. Minimum 8, maximum 10, last 4 characters can be anything including symbols...
What do you all think? Good or not good?Code:?d?d?d?d?d?d?a?a?a?a = min8 max10 | 6 numbers |*4 all characters
001999L*
002999L!
113999a?
004999nt
005999w$T3
1234567890
?l?l?l?l?l?l?a?a?a?a = min8 max10 | 6 lowercases | 4 all characters
salonang
saserang
saichang
saoteran
satonang
sammanges
sarter7*2b
saeanang$5
?u?l?l?l?l?l?a?a?a?a = min8 max10 | 1 uppercase | 5 lowercases | 4 all characters
Salonang
Saserang
Saichang
Saoteran
Satonang
Sammanges
Sarter7*2b
Saeanang$5
also Slim, it will be good to see if you can find a way for the user to build his own syntax, like you did with Crunch, where the user decides the character set, number of characters...
here is the oclHashcat operational sequence of events (as I see them).
I've created a wildHashcat folder inside the FrankenScript2 folder.
Path: /root/FrankenScript2/wildHashcat
This is only to gather all files oclHashcat FrankenScript related into one place.
In that wildHashcat folder I've placed 3 .hcmask files.
8-10-6numbers-4all.hcmask
8-10-6lower-4all.hcmask
8-10-1Capitalized-5lower-4all.hcmask
These files will be used as predefined user options to attack a captured handshake and to make Markov Chains 'kick in'.
1. The oclHashcat operational sequence should start with a captured handshake and creating a .cap file, just like before. So at this point nothing new for FrankenScript, as it can already do that.
2. That .cap file must be transformed into a .hccap for oclHashcat to use it.
Convert .cap into .hccap
Copy the .cap file to your Home folder. Then enter this command(replace the XXXXXXXXX with the file name).
A capture.hccap will be created in HomeCode:aircrack-ng XXXXXXXXXXXX.cap -J capture
I would like a more logical way to do this, so that everything is in the wildHashcat folder...
3. At this point an attack can be initiated on that newly created .hccap
Here one syntax that I'm using.
cd /usr/share/cudahashcat/ && ./cudaHashcat64.bin Path to directory && to start the program.Code:cd /usr/share/cudahashcat/ && ./cudaHashcat64.bin --status -w 3 -t 10 -m 2500 /root/FrankenScript2/wildHashcat/capture.hccap -a 3 /root/FrankenScript2/wildHashcat/8-10-6numbers-4all.mask
--status Will update the progression status automatically every 10 seconds or so.
-w 3 Not even sure what that does but it works. lol
-t 10 Markov threshold. Super important. Without the -t argument, Markov will go into "smart brutforce" and now the estimated time will be 45days. -t 10 is about 4hours.
-m 2500 WPA/2 Hash-type
/root/FrankenScript2/wildHashcat/capture.hccap Path to capture.hccap file
-a 3 Attack mode.
/root/FrankenScript2/wildHashcat/8-10-6numbers-4all.mask Path to .mask file
would like for staticn0de to shine in on all this...
Hey quest, I'm not sure what you want me to shine in on. It all looks good!
If you wanted hashcat to see the hccap file in the home folder after it was converted, don't use the full path. Replace the path to home with $HOME in the script so it always has a good starting point.
It would be good to package this script in a deb so it could place files and configs in etc for use. On that, the installer could set up links for hashcat. But, that's all up to slim as I'm just here to appreciate the great work he does.
@quest, the -w option sets a work load profile.
The options are 1,2 or 3. Details from hashcat below
* Workload Profile:
1 = Reduced performance profile (low latency desktop)
2 = Default performance profile
3 = Tuned performance profile (high latency desktop)
@Slim
I was trying out Frankenscript with my new adapter which arrived in the mail. I had the -1 error and could not capture any handshakes.
I added a one liner at line 232 which looks like this
Enable_Attack_Mode(){
<-snip out all of the attack mode section until the last few lines as I'm not copying and pasting ->
clear
ifconfig $wlanX down
airmon-ng start $wlanX
MAC_Address_Options(){
I only inserted the line ifconfig $wlanX down. This has fixed the -1 error and i'm capturing handshakes again. I can't see this change causing any errors down the road but it's not fully tested. Would you consider adding it in to the script as I doubt i'm the only person who will run into it.
Edit:
@Slim again
Mate, I was just trying to do an iw dev scan from the menu. It failed so I added a catch so I could see the error and go have a read.
I have two wifi adapters and am using wlan1 to scan the network. At line 334 you have defined wlan0 as the adapter so it can't detect if I selected a seperate one. I changed the start of this line to:
iw dev $wlanX scan
and the problem was solved.
Yeah I'm sorry about the issue's, hopefully this next version will be better. LOLQuote:
Originally Posted by staticn0de
I've rewritten most of FrankenScript again and I've made several changes:
FrankenScript now detects all available WiFi devices and all enabled monitor modes, you can now use multiple WiFi devices and monitor modes.
You can now perform multiple attacks against the same target or a different target at the same time.
sounds good! Maybe what happened to you with the HDD failure, had a purpose? Create new and better things? I've seen it numerous times where something bad would happen, but endedup, ultimately, being a good thing. That is what the apocalypse is, changes by disaster. Maybe the universe is trying to tell you something ;)
oh yes I would like to see that. Hopefully Slim, will take your knowhow and that opportunity to move things ahead :cool:Quote:
Originally Posted by staticn0de
little more testing with oclHashcat, and a couple of things stands out.
1. There is nothing to gain by having different lines in one .hccap file, for this reason..
Mask (?d?d?d?d?d?d?a?a) [8] = 3 hours, 27 mins
Mask (?d?d?d?d?d?d?a?a?a) [9] = 1 day, 10 hours
Mask (?d?d?d?d?d?d?a?a?a?a) [10] = 14 days, 11 hours
In other words, the command line and the 't' argument must be adapted according to the length of the passphrase in relation to the GPU capabilities to keep the time reasonable.
2. It is obvious now that the user will have to specify his own '-t XX' argument, as we do not have the same GPU, and what is true for me and my GPU is not true for others and their GPUs.
Here a couple of interesting leads as for building oclHashcat command lines..
PACK https://thesprawl.org/projects/pack/
pyHashcat http://hashcat.net/forum/thread-3478.html
RubyHashcat Wrapper http://hashcat.net/forum/thread-3505.html
(have not tried any of them)
3. Not using the '--status' argument anymore, as it remove the ability to pause, resume, bypass, stop.
and speaking of wrapping FS into a .deb, if FS can be invoked into a simple command, then what would prevent it from making the cut for Kali 1.1.0 ?Quote:
Originally Posted by staticn0de
It is scheduled for 1-1-15
Can someone test this out for me and report back please.
FrankenScript Download:
http://mir.cr/1XYIKG3H
- Kali 1.0.7 x64 -
Hopefully this is only on my end...
When choosing:
# [1] = Deauthenticate all connected clients #
# [2] = Deauthenticate a specific client #
or
# [1] = WEP Chopchop Without Association #
# [2] = WEP ARPreplay With Association #
# [3] = WEP Chopchop With Association #
# [4] = WEP Fragment With Association m
or
# [1] = Reaver & Default WPS Pin Keygens #
# [2] = Reaver Basic Settings #
# [3] = Reaver Custom Settings #
# [4] = Bully & Default WPS Pin Keygens #
# [5] = Bully Bruteforce Settings #
# [6] = Bully Custom Settings
all return with the same error:
Quote:
There was an error creating the child process for this terminal
Failed to execute child process "/root/FS3/Scripts/Deauthenticate_all_clients.sh" (Permission denied)
and does not empty Temp_Working_Dirctory, or exits when choosing [q] = Clean & Exit Script
I'm compiling a new live build now from 1.0.9. I'll have a try soon. Also, was the above a typo from you, Quest or the script?Quote:
Originally Posted by Quest
all the .sh permissions "allow executing file as program" are OFF Slim..
Quote:
There was an error creating the child process for this terminal
Failed to execute child process "/root/FS3/Scripts/
WEP_Chopchop_Without_Association.sh" (Permission denied)
no it's a Copy/PasteQuote:
Originally Posted by staticn0de
Decompress FS3 yourself and you will see the Temp_Working_Dirctory
Right click on FS3.sh, choose Properties and then select the permissions tab, now tick the Allow executing file as program.
Then open the Script folder and highlight all of the scripts, right click and then choose Properties and then select the permissions tab, now tick the Allow executing file as program.
Yes that's what I did. It works better now ;)
New prbs:
1.
[1] = Choose A Visable Client To Deauthenticate.
[2] = Input A Client To Deauthenticate.
[q] = Clean & Exit Script.
Please choose an option: 1
Input the number of a client or choose an option: 1
[1] = Basic Set Amount (Is set to send 4 deauth-requests).
[2] = Custom Amount (Input an amount of deauth-requests to send).
[q] = Clean & Exit Script.
Please choose an option: 2
2.Quote:
Input the amount of deauthetication requests to send: 10
Invalid destination MAC address.
"aireplay-ng --help" for help.
Invalid destination MAC address.
"aireplay-ng --help" for help.
Checking for a handshake every 7 seconds...
or
[1] = Basic Set Amount (Is set to send 4 deauth-requests).
[2] = Custom Amount (Input an amount of deauth-requests to send).
[q] = Clean & Exit Script.
Please choose an option: 1
Quote:
The captured handshake is bad, the file will be deleted.
3.
still does not clean the Temp folder
What's left in the temp folder after you've tried to clen it?.Quote:
Originally Posted by Quest
Are you running any attacks while trying to clean the temp folder?.