#GPU OFFICE PASSWORD CRACKER HOW TO#

This post is also meant to be a tutorial on how to use Cudahashcat so I will try to showcase each of the attack modes even though it may not be totally necessary. My plan was to run all of the basic password attacks against each of these lists and get all of the low hanging fruit passwords out of the way and then recombine the hash lists and start the more advanced password recovery tactics. This gave me 11 hash file lists to work with. Link00.txt link01.txt link02.txt link03.txt link04.txt link05.txt link06.txt link07.txt link08.txt link09.txt link10.txt link11.txt linkedin.hash

:~/LINKEDIN_WORKING/cudaHashcat/HASHFILES# ls :~/LINKEDIN_WORKING/cudaHashcat/HASHFILES# split -dl 10000000 -additional-suffix=.txt linkedin.hash link I used 10 million lines to split up my list but you may want to use less. You can decide what is a manageable number of lines based on your hardware specifications. It is more than capable of loading up the whole 117 million hashes at one time, however because not everyone has a box of this size I decided to split up the list into more manageable chunks. After removing all of the duplicates and blank lines we were left with 117,205,871 unique hashes to crack.Īt TrustedSec, we have a large password cracking server that was provided to us by Jeremi Gosney and the fine folks over at Sagitta. The list contains a large number of duplicate hashes which is valuable for statistical analysis but we don’t need that to go over cracking methodology. The list we received contained 167,370,909 entries in a SHA1 unsalted hash format. Our hope is that by now everyone on this list has reset their password and is no longer using the password they used for LinkedIn in 2012, however since we cannot be sure, we have no plans to share the list so please don’t ask. The passwords gained from these types of breaches are very valuable to us on penetration tests because people often reuse passwords across work and social media. The LinkedIn list offers an opportunity for us at TrustedSec to share our password recovery methodology step by step and show how we attack large password breach lists. Our friends over at Korelogic have already posted an excellent analysis of the list showing the most common words, patterns, and other statistics so we are not going to rehash that information. TrustedSec was able to acquire a copy of the list and use it for research purposes. Unless you’ve been living under a rock for the past few months you have probably heard about the dump from the 2012 LinkedIn hack being released.

This blog was written by Martin Bos, Senior Principal Security Consultant – TrustedSec By Martin Bos in Password Audits, Security Testing & Analysis

Gpu office password cracker