Plundering and pillaging password and passphrase plains for profit

Plundering and Pillaging Password and Passphrase Plains for Profit

Speakers: Will Hunt, Co-founder, Insecurity

Conference: Security Fest

YouTube: https://www.youtube.com/watch?v=8nUNZVAtl94

Overview

In this comprehensive Security Fest talk, Will Hunt, co-founder of UK-based pentesting company Insecurity and a key organizer of the Defcon Password Village, delves into advanced password and passphrase cracking techniques that extend far beyond conventional wordlist and rule-based attacks. Titled "Plundering and Pillaging Password and Passphrase Plains for Profit," the presentation explores a fascinating array of strategies designed to uncover passwords that resist typical cracking methodologies. Hunt’s insights are particularly valuable for pentesters seeking to maximize their recovery rates and for defenders aiming to understand the full spectrum of threats to user credentials.

The talk emphasizes that while standard dictionary attacks and common rule sets are effective for a significant portion of passwords, a substantial number of real-world credentials, often found in large data breaches, exhibit unique characteristics that require more sophisticated approaches. Hunt meticulously dissects how human psychology, insecure system configurations, and the complexities of global language and keyboard layouts contribute to these "weird" passwords, making them both seemingly strong and surprisingly vulnerable to targeted attacks. He introduces a suite of tools and methodologies, predominantly centered around Hashcat, to exploit these nuances.

This presentation is crucial for anyone involved in digital security, from offensive security professionals who need to demonstrate the true crackability of corporate passwords to defensive teams responsible for implementing robust password policies and secure hashing practices. By exposing the often-overlooked vulnerabilities arising from human-generated patterns, nested hashes, Unicode characters, and even the misuse of secure-sounding identifiers, Hunt provides a critical roadmap for navigating the evolving landscape of credential compromise.

Background

▶ Watch: Introduction, speaker background, and talk overview (0:00)

The landscape of password cracking has evolved significantly since the early days of simple dictionary attacks. While foundational tools like Hashcat and prominent wordlists like RockYou remain indispensable, the sheer volume and diversity of data breaches have revealed increasingly complex and often illogical password patterns. The core problem addressed by Hunt's talk is the inadequacy of traditional cracking methods when confronted with these anomalies. Many users, attempting to create "strong" passwords, inadvertently introduce predictable structures or rely on flawed generation methods that, paradoxically, make their credentials easier to crack with the right techniques.

Historically, password cracking focused on brute-forcing alphanumeric combinations or applying common substitution and appending rules to dictionary words. However, real-world data shows that users frequently employ multi-word passphrases, utilize non-ASCII characters (like emojis or foreign language scripts), or even embed hashes or personal identifiers directly into their passwords. Furthermore, system administrators sometimes implement insecure hashing migrations (e.g., re-hashing an unsalted MD5 with bcrypt) or store hashes in unexpected nested formats, creating new attack surfaces.

Prior work in the field includes the development of sophisticated rule engines within tools like Hashcat, such as Hunt's own "one rule to rule them still" (a revamped version of his 2017 "one rule to rule them all") and Janice's toxic3 rule, which optimize case toggling and common modifications. The concept of hash shucking, famously demonstrated by Sam Crowley (chicken man) at Defcon Password Village, highlighted how nested hashing can expose fast inner hashes. The increasing prevalence of Unicode and diverse keyboard layouts also necessitated specialized techniques to account for non-standard character sets, moving beyond the ASCII-centric view of password cracking. Hunt's talk builds on this foundation, providing practical, actionable strategies for uncovering these less obvious, yet prevalent, password vulnerabilities found in modern data breaches, many of which he draws from resources like Pwned Passwords and Hashmob.

Key Findings

▶ Watch: Using delimiters and rules in hashcat passphrase attacks (2:00)

Will Hunt's talk unveils several critical findings that challenge conventional wisdom in password cracking and highlight pervasive vulnerabilities:

• Passphrase Complexity is Often Superficial: While multi-element passphrases appear strong, common human tendencies like adding delimiters (spaces), capitalizing first letters, and using predictable word combinations make them highly susceptible to advanced combinator and rule-based attacks using tools like Hashcat's prince processor and combinatorx.
• Targeted Markov Chains Outperform Generic Brute-Force: By building custom Markov models from domain-specific text (e.g., Minecraft wikis for a Minecraft breach), attackers can achieve significantly higher crack rates in the initial phases of a brute-force attack compared to generic models like RockYou, recovering thousands more passwords within the first hour.
• Hash Shucking Exposes Inner Weaknesses: The practice of re-hashing an unsalted, fast inner hash (like MD5 or SHA256) with a stronger outer hash (like bcrypt or NTLMv2) creates a "shucking" vulnerability. Attackers can recover the inner hash without knowing the cleartext, drastically reducing cracking time and enabling attacks like pass-the-hash in Active Directory environments.
• Unicode and Transliteration are Underestimated Vectors: Users frequently employ Unicode multibyte characters, including emojis and foreign language scripts. Furthermore, passwords typed on non-standard keyboard layouts (e.g., Zhuiyin for Mandarin) can be transliterated into ASCII-like forms, making them crackable with custom character sets, hex encoding, and lookup table attacks, even if they appear random to the eye.
• Nested Hashes are a Common, Unexplained Phenomenon: Data breaches contain a surprising number of passwords that are themselves hashes (e.g., MD5 of MD5 of password), often without a clear reason for their existence. These nested hashes, sometimes multiple layers deep, represent low-hanging fruit for attackers using tools like mdxfind.
• "Secure" Human-Generated Passwords are an Illusion: Hunt emphatically states that entropy does not apply to human-generated passwords. Users' attempts to create complex passwords by using personal identifiers (Bitcoin addresses, national ID numbers), predictable patterns (alternating consonants/vowels), or flawed "secure password generators" (e.g., Unix epoch time + SHA256 + Base64) result in passwords that are easily cracked despite their perceived randomness.
• Hashcat Rule Optimization is Crucial for Efficiency: Understanding Hashcat's internal workings, particularly the 31-character limit for optimized kernels (-O), allows for the identification and removal of redundant rule operations, significantly improving cracking efficiency for fast hashes.

Technical Deep Dive

▶ Watch: Generating multi-element passphrases with Print Processor & CombinatorX (2:55)

Hunt’s presentation is a masterclass in leveraging Hashcat’s advanced capabilities, often in conjunction with other specialized tools, to tackle challenging password scenarios.

Passphrase Cracking Techniques

For multi-element passphrases, Hunt demonstrates several powerful Hashcat techniques:

1. Combinator Mode (Attack Mode 1): The simplest approach for two wordlists is hashcat -a 1 -m <hash_mode> <hashfile> <wordlist1> <wordlist2>. To add delimiters, the -j and -k rules are used. For instance, hashcat -a 1 -m <hash_mode> <hashfile> <wordlist1> <wordlist2> -j '$ $' inserts a space between words. These can then be piped to Hashcat with a rule set for further mangling: combinatorx <wordlist1> <wordlist2> | hashcat -a 0 -m <hash_mode> <hashfile> -r rules/toxic3.rule.
2. Prince Processor: For generating multi-element candidates from a single wordlist (3 or more elements), prince processor is highly effective. An example shown is prince.bin --len-min 3 --len-max 4 --elem-max 4 --case-permute <wordlist> | hashcat -a 0 -m <hash_mode> <hashfile>. This can also handle pre-delimited wordlists.
3. Combinatorx: Part of Hashcat Utils, combinatorx allows chaining up to eight wordlists with custom separators, offering greater flexibility than prince for specific delimited structures. For example: combinatorx -s ":" <wordlist1> <wordlist2> <wordlist3> | hashcat -a 0 -m <hash_mode> <hashfile>.
4. Case Toggling Rules: To address the common human tendency to capitalize the first letter of words in a passphrase, rules like toxic3 (by Janice) or Hunt's 3&e are invaluable. These rules intelligently toggle case after delimiters or at the start of words, significantly increasing the chances of cracking.

Engrams and Targeted Markov Chains

Beyond dictionary attacks, engrams and Markov chains offer a statistical approach to brute-forcing.

• Engrams: These are sequences of characters or words. Tools like grammar (recommended over older tools) can analyze existing cracked passwords or large text corpora (e.g., song lyrics, film scripts, the Bible) to identify common character or word sequences. This helps in building highly targeted wordlists or masks. Hunt demonstrated an analysis of the Bible and Quran against Pwned Passwords, showing the types of engrams that appear.
• Markov Chains: Markov modeling predicts the probability of a character based on the preceding character(s). Hashcat has an inbuilt Markov table based on RockYou, but Hunt emphasizes the power of targeted Markov models. Using HStatGen (from Hashcat Utils), one can build a custom Markov model from a highly specific dataset (e.g., Minecraft wiki content for a Minecraft-related breach). This custom model is then compressed and used with Hashcat's brute-force attack mode (-a 3) via the --markov-hc option. In a specific Minecraft breach example, using a custom Markov model recovered over 10,000 more passwords in the first 60 minutes compared to Hashcat's default RockYou-based model, highlighting the significant initial performance gain.

Scaling Masks and Hybrid Attacks

For scenarios where parts of a password are known, scaling masks combine wordlists with character masks. Hashcat's Attack Mode 6 (Hybrid Wordlist + Mask) or Attack Mode 3 (Pure Mask) are used. For example, if a password starts with a number, has an unknown lowercase middle, and ends with a special character, one could use: hashcat -a 6 <hashfile> <numbers_wordlist> ?l?l?l?l -r rules/append_special.rule. It's crucial to be aware of Hashcat's internal buffer limits (32-bit for A6, 64-bit for A3), which dictate the maximum length of the mask before an integer overflow occurs.

Hash Shucking (Cracking Hashes with Hashes)

This technique exploits insecure hashing migrations or configurations where a strong outer hash wraps a weaker, unsalted inner hash.

• Concept: If a system stores bcrypt(md5($pass)) instead of bcrypt($pass), an attacker can take a list of uncracked MD5 hashes (e.g., from another breach) and re-hash them with bcrypt. If a match is found, the attacker now knows the MD5 of the password, effectively "shucking" the outer bcrypt.
• Hashcat Support: Hashcat has specific modes for these nested hashes (e.g., -m 11600 for bcrypt(md5($pass))).
• Practical Implications: In AD environments, this applies to NTLMv2 hashes, which are essentially HMAC-MD5 of the NTLM hash. If an attacker has uncracked NTLM hashes (a fast hash), they can use them to attack NTLMv2, potentially leading to pass-the-hash attacks even without cleartext passwords. This significantly accelerates cracking compared to attacking the slower outer hash directly.

Unicode and Multibyte Character Attacks

With the global adoption of computing, passwords containing non-ASCII characters are common.

• UTF-8 Complexity: UTF-8 characters can range from one to four bytes. Hashcat processes bytes, not characters.
• Hex Character Sets: The recommended method is to create custom character sets containing hex-encoded UTF-8 code points. For example, Arabic characters (e.g., U+0600 to U+06FF) would be represented by their hex bytes (e.g., D880 D881).
• --hex-charset: This Hashcat flag tells the tool to interpret the custom character set as hex.
• Emojis: Emojis typically use four UTF-8 hex bytes. A mask for a single emoji would use four custom character set placeholders (e.g., ?1?1?1?1).
• Hex in Rules: Hashcat also supports hex in rules, allowing for appending or prepending specific Unicode characters to candidates.

Transliteration Attacks

This technique targets passwords typed on non-standard keyboard layouts.

• Keyboard Layouts: A password like "myspacepassword" typed on a Zhuiyin (Taiwanese) keyboard layout can result in a seemingly random string of ASCII characters. If the system hashes this transliterated string, it becomes crackable.
• Lookup Tables: Hashcat legacy attack mode 5 supported table lookup attacks. Modern approaches involve creating lookup tables from wordlists of a target language (e.g., Russian words from GitHub) and then translating them into their transliterated ASCII equivalents.
• Real-World Success: Hunt demonstrated significant crack rates by taking a Russian wordlist, transliterating it, and then running it against data breaches, recovering passwords that would be impossible with standard English wordlists.

Entropy Misconceptions and Rule Optimizations

Hunt debunks the common misconception that high entropy alone guarantees password strength for human-generated passwords. Human biases and predictable patterns undermine theoretical entropy calculations.

• Rule Optimizations: When using Hashcat's -O flag for optimized kernels, a 31-character password length limit applies. Many common rules (e.g., D for duplicate, P for append duplicated word) can generate candidates exceeding this limit, resulting in no-operations (no-ops) that waste compute cycles. Hunt illustrates how to identify and prune these redundant operations, especially when intermediate password candidates exceed the 31-character limit, even if the final candidate is shorter after further rules (e.g., truncation). Tools like rule processor can help with this optimization.

Nested Hashing in Data Breaches and Password Placebos

Hunt provides compelling evidence from real data breaches (e.g., Gigo, Yoku from Hashmob) of incredibly "weird" password choices.

• MD5 of MD5 of MD5: Breaches contain numerous instances of passwords that are themselves MD5 hashes, sometimes multiple layers deep. The tool mdxfind can help visualize and identify these nested structures. In one Yoku breach, over 692 nested MD5s were found. Surprisingly, some plaintexts were found to be hashes themselves, only to be cracked to their original cleartext.
• Case Sensitivity of Intermediate Hashes: He shows that an intermediate hash (e.g., MD5) can be uppercase or lowercase, leading to entirely different final hashes. Attackers must account for both possibilities when shucking.
• Password Placebos: Users adopt seemingly secure but fundamentally flawed password choices:
• Cryptocurrency Addresses: Over 172 people used their Bitcoin addresses as passwords. Ethereum wallet holders even added 123! and ! to their addresses, believing it made them stronger.
• National ID Numbers: Attacks using masks tailored to national identity number formats (e.g., Swedish personal identity numbers) revealed numerous cracks in Pwned Passwords, demonstrating users' tendency to use highly personal, predictable data.
• Insecure Generators: Flawed "secure password generators" found on forums like Stack Overflow (e.g., Unix epoch timestamp + SHA256 + Base64 truncation, or alternating consonant/vowel patterns) lead to easily crackable passwords. Hunt demonstrated cracking a SHA1-based example from 2015 within 20 seconds.
• "Science" Passwords: Even chemical compound formulas, when used as passwords, can be cracked if attackers compile targeted wordlists and apply combinator attacks, as shown by Hunt recovering 121 cracks from a list of 190,000 chemical compounds.

Demo / Proof of Concept

▶ Watch: Applying case toggling and capitalization rules (e.g., Toxic 3) (4:50)

Will Hunt introduced and attempted to demonstrate hashcatalyst, a personal project he made public just before the talk. While the live demo encountered technical difficulties with video output, he clearly outlined its functionality and purpose.

hashcatalyst is described as a Hashcat wrapper, designed to automate non-distributed Hashcat workflows and minimize downtime. It is available as both a Windows batch script and a Linux bash script (with the Windows batch script being a deliberate choice over PowerShell for CMD users).

The core idea behind hashcatalyst is to chain multiple Hashcat attacks together. Instead of running a single attack and having the computer sit idle once it finishes (e.g., an attack completing in an hour when the user expects it to run overnight), hashcatalyst ensures that when one attack concludes, the next one automatically begins. This maximizes GPU utilization and cracking time.

Key features include:

• Attack Chaining: Users can select from 16 custom attack chains or define their own, allowing for complex sequences of wordlist, rule, and mask attacks.
• Comprehensive Logging: The tool logs every action, including timestamps for each individual attack. This logging is crucial for debugging; if an attack that should take hours finishes in minutes, it indicates a potential issue (e.g., an infeasible Hashcat calculation or an integer overflow).
• Configuration: Users configure the script by providing paths to their pot file, wordlist folders, rules folders, and nested rules folders.
• Integration with rit: The script integrates the rit binary (from Soshore Prime) for fast, in-place sorting and deduplication of wordlists. Hunt highlights rit's efficiency, especially compared to Windows' native sort command, which struggles with non-ASCII characters.

While the demo itself wasn't visible, the explanation of hashcatalyst underlined the practical challenges of optimizing non-distributed cracking efforts and provided a tangible solution for security professionals looking to streamline their password recovery processes.

Defensive Implications

▶ Watch: Leveraging N-grams for targeted wordlist generation and analysis (6:05)

The advanced cracking techniques demonstrated by Will Hunt have profound implications for defensive security strategies. Understanding how attackers can bypass seemingly strong passwords is essential for building truly resilient systems.

1. Enforce Password Manager Usage: The most critical defensive measure is to mandate or strongly encourage the use of cryptographically secure password managers. Hunt unequivocally states that only machine-generated passwords, free from human bias and patterns, can achieve true uncrackability. Organisations should provide password managers to employees and educate them on their benefits.
2. Implement Robust Hashing Algorithms: Defenders must move away from fast, unsalted hashing algorithms like MD5 or SHA1. Instead, adopt modern, slow, salted, and key-stretching algorithms such as bcrypt, Argon2, or scrypt. These algorithms are specifically designed to resist brute-force attacks by introducing computational cost.
3. Avoid Insecure Hashing Migrations and Nested Hashes: Never re-hash an existing password hash (e.g., bcrypt(md5($pass))). If migrating from a weak hash, require users to reset their passwords upon next login, hashing the cleartext with the new, strong algorithm. Audit systems for any instances of nested hashing or storing hashes as passwords, which create significant vulnerabilities.
4. Educate Users on Password Security: Conduct regular security awareness training that specifically addresses the pitfalls of human-generated passwords. Emphasize that complexity and length derived from predictable patterns (personal info, dictionary words, keyboard transliterations, sequential characters) do not equate to security. Warn against using personal identifiers (Bitcoin addresses, national ID numbers) or "secure password generators" found online.
5. Implement Strong Password Policies: While password managers are ideal, policies for human-generated passwords should enforce a minimum length of at least 13 characters with a mix of uppercase, lowercase, numbers, and special characters. This provides a baseline for resistance against generic brute-force. Crucially, these policies should also disallow common patterns and known weak passwords.
6. Sanitize and Validate Password Input: Where possible, implement input validation that prevents users from submitting easily identifiable hashes, emojis, or common personal identifiers as passwords. While complex, this can prevent some of the "weird" password artifacts seen in breaches.
7. Monitor for Advanced Attack Patterns: Security operations centers (SOCs) should be aware of these advanced cracking techniques. Monitoring for unusual login patterns, repeated brute-force attempts with varied character sets (including Unicode), or attempts to exploit known nested hash vulnerabilities can provide early warning of compromise.
8. Pentesters Must Use Advanced Techniques: Offensive security teams performing penetration tests should incorporate these advanced cracking methods. By demonstrating the crackability of seemingly complex passwords, pentesters can provide a more accurate assessment of an organization's credential security posture and advocate for stronger defensive measures. This includes building custom Markov models, testing for hash shucking, and employing Unicode and transliteration attacks.

Key Takeaways

• Human-generated passwords are inherently flawed: Despite perceived complexity or high entropy calculations, human biases and predictable patterns make even "strong" passwords vulnerable to advanced cracking techniques.
• Advanced Hashcat techniques are essential: Going beyond basic wordlists requires sophisticated approaches like multi-element combinator attacks, targeted Markov chains, hash shucking, and specific handling of Unicode characters and keyboard transliterations.
• Hashing best practices are non-negotiable: Organizations must use modern, slow, salted, key-stretching algorithms (e.g., bcrypt, Argon2) and avoid insecure practices like re-hashing existing hashes or storing unsalted fast hashes.
• Data breaches reveal "weird" vulnerabilities: Real-world data shows passwords that are nested hashes, cryptocurrency addresses, national ID numbers, or products of flawed generators, offering low-hanging fruit for attackers.
• Automated tools streamline cracking: Wrappers like hashcatalyst can significantly improve the efficiency of non-distributed password cracking workflows by chaining attacks and minimizing downtime.
• Education and password managers are paramount: The most effective defense is to educate users against predictable password choices and, ideally, to encourage or enforce the use of secure, machine-generated passwords from a password manager.

About the Speaker(s)

Will Hunt, known online as "Stealth," is a highly experienced cybersecurity professional specializing in penetration testing and password cracking. He co-founded Insecurity, a UK-based pentesting company. Hunt began his career in forensics before transitioning to the offensive side of security in 2014, a move he says he has "never looked back" from. He is a respected trainer and speaker, having presented at numerous security conferences globally, and is now able to add Security Fest to that list. Will Hunt also plays a significant role in the community by helping to run the Defcon Password Village in Las Vegas, a prominent event dedicated to password security research and competition. His deep expertise in understanding and exploiting password vulnerabilities stems from extensive hands-on experience in real-world engagements and data breach analysis.