Cracking Password Protected Zip Files on Linux with FCRACKZIP

I recently was given the keys to the castle and once inside I did the usual snooping around and well in the end I found myself with a collection of password protected Zip files that I knew had all kinds of juicy info inside. Now I have cracked protected Zip files in the past on Windows using a few tools some friends of mine made, but I had never done it since I had moved to my new Linux setup. I decided to make a little tutorial out of the whole incident for anyone interested or in a similar situation. In my search and review I ended up using a tool called FCRACKZIP, and this will be the focus for today's writeup. They actually support a Windows binary version which syntax should be identical to what your about to read. You can download the appropriate package for you from the makers homepage here: FCRACKZIP.

If you are on a Linux machine you can install it using apt-get, like so:

COMMAND:  sudo apt-get install fcrackzip

Now if you have some protected Zip files laying around then that's great, but if you don't you can perform a quick command to make one.  Here is the syntax and quick example:

COMMAND: zip --encrypt -r <ArchiveName> </target/U/want/2/zip>
EXAMPLE: zip --encrypt -r sup3rs3cr3t /home/hood3drob1n/Desktop/fcrackzip-TuT.txt

You will get a prompt after you hit enter which will ask you to type in the password, and then again to confirm it. You should then have a password protected Zip file to use for further testing.

First, as with any tool, we start by quickly reviewing the documentation and then the help menu. Here is quick shot of the main features as outlined in the help menu:

COMMAND: fcrackzip --help

I will note since it may not be clear at first that the '-c' charset option has a few options which will aid you if you are going to perform a straight bruteforce attack on the password:
    a => lower aplha charset [a-z]
    A => UPPER aplha charset [A-Z]
    1 => numerical charset [0-9]
    ! => Special charset [!:$%&/()=?[]+*~#]
    : => Used to mark additional characters to add into the charset

You should typically start with a wordlist and then move to bruteforcing after. In order to perform Dictionary based attack just point it at the wordlist and zip file you want to crack open:

COMMAND: fcrackzip -D -p 500-worst-passwords.txt -u -v --method 2 sup3rs3cr3t.zip
        => try to cracking using 500-worst-passwords.txt as our pass list

NOTE: I experienced app crashes if I didn’t place the password list in same location i was running fcrackzip from so just do some copying or moving if you experience similar issues to work around the issue...

Once you have exhausted your wordlist options you can move to bruteforce attacks. Now you can use the '-l <min>-<max>' option to set the min and max password lengths for bruteforce attacks, or you can use the '-p' init option to set the default value and starting string for cracking, for example:

COMMAND: fcrackzip -b -c a -l 1-8 -u -v sup3rs3cr3t.zip
        => bruteforce attack using the lower aplha charset, testing for lengths 1-8

NOTE: use of the '-u' option cuts down on the false positives as it actually tries to unzip the file using the password. It may increase load and time a little but will greatly cut down on false detections. I highly recommend using this option for pretty much all attacks...

Another example using a bruteforce attack against a fixed length via the -p/init option. It works like so:

COMMAND: fcrackzip -u -c a1 -p saaaaa sup3rs3cr3t.zip
        => test a-z0-9 but only for those of 6 char in length, starting at string 'saaaaa'

This sums up the general usage of fcrackzip and you should now be on your way to opening up all those pesky zip files you don't seem to have passwords for. I'm sure there are other tools out there, but this one worked well for me so thought I would share....

Until next time, Enjoy!

An Explanation of Hashcat Rules

I have come to realize that there is not a lot of solid documentation on how rules work or what rules do what, so I thought I would share my personal cheat sheet that I made for anyone else that may find it helpful. The better your rules are the more passwords you will find when cracking. It is also helpful to be able to customize the rules being used to fit the target as different techniques may yield varying results on different hash lists. I am not a pro but the below is a brief overview of how Hashcat Rules work and a few tricks that should help to get you started and on your way.

Here is a quick trick for generating rules via oclHashcat itself and saving them so we can review and learn how to create our own rules. You need to generate as many rules as the tool will allow, try "-g 999999" from command line (or just define number of rules to generate in the GUI).  We will then need to use debugging to help save the rules, which can be accomplished by adding this to the end of your command:

                –debug-file=C:\Hashcat\recorded.rule –debug-mode=1

In order to avoid confusion later, I must call out that oclHashcat (GPU) works using a left and right mask. The tool breaks each attempt into two pieces to speed up the attack, a right mask and a left mask. This allows us to define how either side is used during an attack: dictionary based, hybrid dictionary+rules, a defined mask to use based on charsets provided, or some combination of the above. Things will become clearer once you have investigated and played around with the rules a bit, so hang in there...

Charsets are broken into the following groups:

                ?l is all lower case letters from a to z

                ?u is all upper case letters from a to z

                ?d is all digits from 0-9

                ?s is all special characters on a standard keyboard

                ?h is all ISO-8859 characters or “HEX” characters

                ?D is all 8-bit characters from the German alphabet

                ?F is all 8-bit characters from the French alphabet

                ?R is all 8-bit characters from the Russian alphabet

                ?1 is custom user defined charset

                ?2 is custom user defined charset

                ?3 is custom user defined charset

               

NOTE: foreign alphabet call is case sensitive.

               

These are used by themselves, customized or combined to form a mask. In order to use the custom user defined charset simply define the charset(s) before using, like so:

                -1 abc

-2 123

                ./oclHashcat hash.txt ?1?1?1?1 ?2?2?2?2

This will try to crack hashes from hash.txt of 8 characters in length using the charset defined of abc for the ?1 instances and 123 for the ?2 instances. You can keep it simple or get as complex as you like. Here are some more charsets you could use instead:

Reference Charsets:

                0123456789

                aeiou

                AEIOU

                aeiouAEIOU

                bcdfghjklmnpqrstvwxyz

                BCDFGHJKLMNPQRSTVWXYZ

                bcdfghjklmnpqrstvwxyzBCDFGHJKLMNPQRSTVWXYZ

                abcdefghijklmnopqrstuvwxyz

                ABCDEFGHIJKLMNOPQRSTUVWXYZ

                abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ

                !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

                ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789

                ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

                abcdefghijklmnopqrstuvwxyz0123456789

                abcdefghijklmnopqrstuvwxyz0123456789!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

                abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789

                abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

Top Used Characters in English passwords based on statistical analysis (done by others):

                etaoinsrhldcumfpgwybvkxjqz

                eaosrinl1tmcd2hbuyp

                eaosrinl1tmcd2hbuypg3k0456wf798

Here is a link if you’re interested in statistics based around other languages:   http://www.bckelk.ukfsn.org/words/etaoin.html

               

Complete overview of the Hashcat Rules and what they do:

•  l = lowercase all letters of each word in wordlist
•  u = uppercase all letters of each word in WORDLIST
•  c = capitalize first letter of each word in Wordlist
•  C= make the first letter of each word in the wordlist lowercase and makes the rest of the letters uPPERCASE
• t = tOgGLe cAsE fOr AlL wORdS
• TN = tOgGLe cAsE for character position N, where N = the letter N spaces from left starting position
• r = reverse each word in wordlist (so it is sdrawkcab - backwards)
• d = duplicate each word in wordlist in combo fashionfashion
• f = duplicates each word in wordlist in reverse fashionnoihsaf
• $N = append character to end of each word in wordlist, where N=the appended char to each word
• ^N = prefix character to add to start of each word in wordlist, where N=the char to prefix to each word
• pN = append word to itself N times
• { = shift characters in word one space to the left|eftl
• } = shift characters in word one space to the right|trigh
• [ = deletes the first character of each word in wordlist
• ] = deletes the last character of each word in wordlist
• 'N = truncate each word in wordlist at position N
• DN = if you don’t want to truncate the entire word but only delete specific char you can use this one, deletes the character in position N of each word in the wordlist
• xNM = delete the characters from a range, where the range is defined based on character position from position N through position M
• iNM = insert character at defined position, where N defines the character position and M defines the character to insert
• oNM = if you don’t want to insert but replace this will overwrite, N defines position to overwrite and M defines char to overwrite with
• sNM = swap and replace all occurrences of character defined by N with character defined by M (helpful for 1337 changes)
• @N = removes all instances of the character defined by N from each word in the wordlist
• zN = duplicates the first character of each word in wordlist N times
• ZN = duplicates the last character of each word in wordlist N times
• q = duplicates every single character in each word from the wordlist (so there will be ttwwoo ooff eeaacchh)

OK, so now you have an idea of what is available to you to use in creating your own custom rule sets. Open your favorite text editor and go to town creating your own custom rules, and save as "name.rule" and save in your rules folder. If you want to customize your rules to share with the world it might also be helpful to add some formal titles and descriptions. If you want to add this to your rule file then simply add comments using a “#” symbol and everything that follows is assumed as comment. You will want to add them to the top of the file and label them so it is clear. If you want to follow the format provided by the Hashcat team then you should call out a description of the rule file, the author or created by, and the version if you go multiple rounds on a rule set (trust me this part helps). It should look like this:

# Rules: HR’s custom rule set

# Created by: Hood3dRob1n

# Version: 1.0

:

l

c

u

t

$0

$1

$2

…blah more rules…

NOTE: you can use either “Author” or “Created by”, and you can shorten to just “V” instead of typing out the full word “Version” followed by the number (i.e. “V1.0”)

To teach by example:

Here is an example of what the famous “Best64.rule” file looks like (available in the Hashcat forums user contribution area). This is based on statistical analysis of common passwords. I have //commented each line item so you can see how each rule is applied.

==================================================================================

## rule: best 64 rules by statistics, manually optimized

## limits: none

## example: none

## extras: none

: //this does nothing

l //lowercase

c //capitalize the first letter

u //uppercase

t //toggle case

$0 //append 0 to end

$1 //append 1 to end

$2 //append 2 to end

$3 //append 3 to end

$4 //append 4 to end

$5 //append 5 to end

$6 //append 6 to end

$7 //append 7 to end

$8 //append 8 to end

$9 //append 9 to end

$0 $1 //append 01 to end

$1 $2 //append 12 to end

$1 $2 $3 //append 123 to end

c $0 //capitalize the first letter and append a 0 to the end

c $1 //capitalize the first letter and append a 1 to the end

c $0 $1 //capitalize the first letter and append a 01 to the end

c $1 $2 //capitalize the first letter and append a 12 to the end

c $1 $2 $3 //capitalize the first letter and append a 123 to the end

[ //deletes the first character of the word

[[ //deletes the first two characters of the word

[[[ //deletes the first three characters of the word

[[[[ //deletes the first four characters of the word

] //deletes the last character of the word

]] //deletes the last two characters of the word

]]] //deletes the last three characters of the word

]]]] //deletes the last four characters of the word

[    $1 //deletes the first character of the word and appends 1 to the end

[[   $1 //deletes the first two characters of the word and appends 1 to the end

[[[  $1 //deletes the first three characters of the word and appends 1 to the end

[[[[ $1 //deletes the first four characters of the word and appends 1 to the end

D1 //Deletes the first character of word

D2 //Deletes the second character of word

D3 //Deletes the third character of word

D4 //Deletes the fourth character of word

D5 //Deletes the fifth character of word

D6 //Deletes the sixth character of word

'7  //deletes any characters beyond the seventh character position

'8  //deletes any characters beyond the eighth character position

'9  //deletes any characters beyond the ninth character position

$2 $0 $0 $0 //appends 2000 to the end of each word

$2 $0 $0 $1 //appends 2001 to the end of each word

$2 $0 $0 $2 //appends 2002 to the end of each word

$2 $0 $0 $3 //appends 2003 to the end of each word

$2 $0 $0 $4 //appends 2004 to the end of each word

$2 $0 $0 $5 //appends 2005 to the end of each word

$2 $0 $0 $6 //appends 2006 to the end of each word

$2 $0 $0 $7 //appends 2007 to the end of each word

$2 $0 $0 $8 //appends 2008 to the end of each word

$2 $0 $0 $9 //appends 2009 to the end of each word

$2 $0 $1 $0 //appends 2010 to the end of each word

$2 $0 $1 $1 //appends 2011 to the end of each word

$2 $0 $1 $2 //appends 2012 to the end of each word

$s //append an "s" to the end of each word

$e $d //append "ed" to the end of each word

$i $n $g //append "ing" to the end of each word

Z1 //duplicate the last letter of each word one timee

d //append each word to itself

sa@ //swap all occurrences of the character "a" for "@"

se3 //swap all occurrences of the character "e" for "3"

================================================================================= 

NOTE: Rules can only be applied on wordlists, not masks.

I hope you find this overview helpful and if you have any suggestions or if I missed anything please comment so I can make sure it stays up to date, and covers all the needed material to get you started. Until next time, Enjoy!

Laters,

H.R.

Cracking Password Hashes with CPU & GPU Power

UPDATE: New video at bottom...

Today I am going to tell you about a kick ass tool for cracking hashes on Windows platform that is capable of leveraging the power of your CPU or even better the power of your GPU(s)...or BOTH. I am even going to use a few pictures for a first, hope you like it. The genius developers behind Hashcat and oclHashcat just released a new version which puts everything in a nice streamlined GUI that is very simple to use and works with both NVidia (CUDA) and ATI (OpenCL) cards, or just plain old CPU power. If you're a console junkie they still have those versions available independently for download as well. You can find them all here: http://hashcat.net/files/. You can choose the one you want from the options on the left, but today I am going to be covering the wonderful new GUI that was just released (hashcat-gui_v0.4.2). I highly suggest you wonder the Hashcat site after you read through this as it is full of knowledge and well written overviews and examples. For now, I will cover some basics...

The entire suite of tools together with CPU and GPU is very powerful which helps to exponentially speed up the time to recovery and are capable of cracking the following types of hashes:

·        MD5 (and MANY variations)

·        SHA1 (and variations)

·        MySQL

·        SSHA-1

·        MD4

·        NTLM

·        Domain Cached Credentials (DCC)

·        MSSQL

·        SHA256

·        SHA-512

·        Oracle 11G

·        DES(Unix)

A few other highlights worth mentioning are that it does not require any installation (can run from USB) and it is FREE and also works on both 32 and 64 bit operating systems. The tool set is also capable of working under Linux and the console versions come pre-loaded with Backtrack 4 and 5 but I am excited and focused on the latest GUI release so I won’t be covering those as I am tired of typing out the commands (hence my excitement). The latest GUI wraps all of the previous console releases under one roof (hashcat, oclHashcat, oclHashcat-plus, and oclHashcat-lite). Now for some overview and review...

You will need to download the software from the link I gave you above and unzip the folder to wherever you would like to run it from. If you are using the GUI version then it doesn’t matter, if you are using the console version you need to navigate to that folder for it to work unless you modify your environment paths. You can just double click on the hashcat-gui64.exe or hashcat-gui32.exe, depending on your setup and it will launch the GUI. You should see this first (choose the one that fits your system);

Choose CUDA for NVidia cards and OpenCL for ATI cards or CPU if you don’t have any GPU to use. NOTE: If you select one of the GPU options it will load the CPU requirements as well so you only need to choose one option. Then it will load the GUI with all of the needed tools, and will then look like this:

Hashcat (Tab1):

Let’s begin with an overview of Hashcat first and then I will take you through the other tabs. Hashcat is the part of the tool that leverages the CPU power to crack hashes, while the rest of the tools/tabs we will cover rely on the GPU(s). You will need to place your hashes in a file so you can load it in the tool, just click on open and browse to find and load. Next you can choose to check to remove the cracked hashes or not. I like to move copies into the local Hashcat folder to work on so I have backups elsewhere and find it nice to size it down as I go through all of my variations to get an idea of what is working and what isn’t (helps if you are working on large lists). You can also change the HASH:PASS separator if you do not like the default ":", but this is not typically needed. Also I have a nice trick I will share later that works if you keep the default. Next comes the wordlists, you can add as many as you have and then arrange the order of them as well. Simply click on the "Add files" button and browse to where you keep your Dictionary files. I have used shmoosh2x64.exe to combine all of my wordlists into a single file, I suggest you find a tool that works for you to keep the number to a reasonable level or by category so you can load in the ones you want or arrange as needed after loading them all in. Next you will need to identify the mode and the hash type to use. You can change the mode to alter your word list based on the description, by bruteforce mode, or you can go a step further and use rules to alter your word lists performing a hybrid attack.

I will assume you can figure out the Hash Type drop down menu but some may have trouble with the modes so here is a quick overview of the different attack modes:

·        straight - This mode will go through your dictionary from top to bottom without altering anything, if it is on your list it will find it if not it won’t...

·        combination - This mode will combine words together in the form of word1word1, word1word2 using the defined dictionary to pair the word combinations.

·        Toggle-Case - This mode will go through your defined wordlist and will alternate the Case used on each of the words, for example: word, Word, wOrd, woRd, worD, and so on...

·        Permutation - This mode will try to extend your wordlist by attempting to try all possible combinations of words that might be created from the characters used in each word. This can be accomplished through a good rule set so I won’t cover too much of it...

·        Table-Lookup - This mode allows you to compare Hashes against pre-computed hash tables. If you have these on hand or if you have created them yourself this may be helpful to you. I tend not to use rainbow tables so I will not go into this here...

·        Bruteforce - This will try to use bruteforce to find the password by simply trying every possible combination available given the charset to use and the min and max length to try, the time needed to run through all depends on the charset used and the strength of the setup you run it on.

I advise reviewing the Hashcat site for rules files as they can be used to manipulate your wordlist and make them exponentially more valuable and effective. They also can allow you to manipulate a wordlist as defined by the rule set used. You can use this to get the same affects as the Toggle-Case, Permutations, Combination, as well as custom ones like adding 2011 to the end or beginning of each word, or maybe in the middle instead. These types of things can all be defined in the rules and then loaded in to modify your wordlist on the fly. I generally run the "Straight" words attack mode and then roll through all of my rules I have setup one by one with a much higher rate of effectiveness.

              

Here are some possible charsets you might want to try out if you will be Bruteforcing your way to victory. Just keep in mind how they can impact time it might take to crack cycling through all possible combinations and also why it important to keep a secure password:

·        0123456789

o   3628800 Possible Combinations

·        abcdefghijklmnopqrstuvwxyz

·        ABCDEFGHIJKLMNOPQRSTUVWXYZ

o   403291461126605635584000000 Possible Combinations

·        !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

·        abcdefghijklmnopqrstuvwxyz0123456789

·        ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789

o   3.7199332678990121746799944815084e+41 Possible Combinations

·        ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

·        abcdefghijklmnopqrstuvwxyz0123456789!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

o   2.4800355424368305996009904185692e+96 Possible Combinations

·        abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789

·        abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

o   1.0873661566567430802736528525679e+146 Possible Outcomes

NOTE: Possible combinations can be derived using factorial functions: x! Where x = number of characters available to use, hence:

·        0123456789 - 10! OR 10 x 9 x 8 x 7 x 6 x 5 x 4 x 3 x 2 x 1 = 362800 Possible Combinations

That is all the math I will bore you with for now, sorry but thought someone out there might find this interesting. Once you have identified the method that works best for you simply setup all the options and point everything to the correct files and if you have elected to have the cracked hashes removed then you might want to also check the Output "Write recovered hashes to file" and point it to where you want the output to go to. It will create a new file if needed, and will share nicely with the other tabs if you decide to use one file for all of your outputs, you can also play with the output formatting as well to put in form of HASH:PASS or HAHS:HEX_PASS or HAHS:PASS:HEX_PASS.

TRICK: If you have want to take the found passwords form the output file and add them to the word list you can write your own batch script or Perl script to remove the hash from prefix using the "hash list separator" as your indicator mark to stop removing items from each line. If that doesn’t work you can copy and paste the list online here: http://www.md5decrypter.co.uk/list-tool.aspx. You can identify your hash list separator on the right hand side and then let it run. It will allow you to split the list into a separate hash file and a separate password file, which you can then add to your word list or manage as needed. See screenshot below:

 Everything so far relates to the main tab for Hashcat which relies on CPU power. This can be fine if you have a simple rule set or a small word list, but can take centuries if you have a rather complex rule set and a really large word list. For example, I am running this with the latest i7 core processor and can get speeds up at about 56 Million words a second which may take around 13 Hours if I let it go non-stop at an 8 character password with the "abcdefghijklmnopqrstuvwxyz0123456789" charset. If I wanted to start testing longer password possibilities or larger charsets it would start growing exponentially and would become unrealistic after a while. This is where it is handy to upgrade your motherboard with a few video cards and start putting them to use in cracking. The GPU cores can be used to help out the job and can achieve insanely high pass through rates. If we run the same bruteforce attack using my two GPU enabled cards (450GTS & 580GTX-ti) I can speed things up to about 800 Million Passwords a second to speed the attack time from ~13 hours to just under an hour. This makes a HUGE difference in completion time!!!

Let us now review the three (3) different GPU tools available and how and when to use them: oclHashcat/cudaHashcat, oclHashcat-plus/cudaHashcat-plus, and oclHashcat-lite/cudaHashcat-lite.

cudaHashcat/oclHashcat (Tab2):

There is cudaHashcat/oclHashcat which can be used for BruteForcing MD5, MD4, NTLM, DCC, SHA-1, and MySQL hashes. It is handy for bruteforcing a Large Hash list after exhausting all of your dictionaries. It also has the ability to apply rules to either side of the password combinations being tried (left vs. right side). This tool will take the default built in charsets or customer user defined charsets and will run much faster than any CPU bruteforce attempts. You can define the charset to use by using the mask feature and identifying the number of characters to use. You would need to define 4 on one side and 4 on the other to try all possibilities for 8 character hash. Here is a overview of what can be used to define how you want to perform this hybrid attack:

·        ?l = lowercase alpha (abcdefghijklmnopqrstuvwxyz)

·        ?u = uppercase alpha (ABCDEFGHIJKLMNOPQRSTUVWXYZ)

·        ?d = numerical digits (0123456789)

·        ?s = !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~

·        ?h = ISO-8859 characters from 0xc0 - 0xff

·        ?D = 8bit characters from German alphabet

·        ?F = 8bit characters from French alphabet

·        ?R = 8bit characters from Russian alphabet

·        ?1 = number one - use custom charset 1 (uses whatever you copy into the empty field)

·        ?2 = number two - use custom charset 2

·        ?3 = number three - use custom charset 3

·        ?4 = number four - use custom charset 4

?l?l?l?l ?l?l?l?l would define a password of 8 characters in length using all lowercase alphabet as charset to try all possibilities: aaaaaaaa-zzzzzzzz.

The custom charset can be used as needed, but I find them helpful to add specific combinations to the end or beginning of the passwords being used in the word list, for example you could define custom1 as 1, custom2 as 2, custom3 as 3, and custom4 as 4 and to define the last 4 characters as 1234, which depending on your placement can create a whole new dictionary. I have found ending with 123 has very high success rates on real life samples.

               ?l?l?l?l ?1?2?3?4 would define a password of 8 characters and would fix 1234 as the last four characters of each password attempted, from aaaa1234-zzzz1234. Hopefully you can see how this can be helpful when all dictionary attempts have been exhausted and/or you have some helpful information to help you narrow down the possibilities to be used - since you can define the placement and characters to be used in the attempts.

If you decide to use a dictionary instead of masks you can also combine rules to them as well on a left and right side basis, same as masks and custom charsets above, just fill out the details for the mandatory fields. I tend to reserve my dictionaries for the next tab though, so I will not cover that part here. The last thing to complete before running the GPUs at things is the Resources section. You will need to define the GPU(s) to be used. If they are all the same type then do nothing and it will use them all together, however if you have a mix match of cards like I do (due to budget reasons) then you can simpy define them using comma separated values. I use two different cards and it will only use one by default so I change the GPU devices to state "1,2" to instruct it to use both GPU #1 and GPU #2. You will find better results if you run the same type of cards, but this is a perfectly acceptable and working alternative for those that grow on a budget or over time. If you do a little research or are more familiar with your GPU then you can tweak your heart out with the workload tuning and GPU loops but the defaults will be fine for the average users. Finally choose to write your output file to where you want in the desired format and you can start the GPU attacks on your hash list. You will notice the command used is also displayed next to the start button if you want to learn the commands to do things from the console. This is also very helpful if you pause an attack and need to pick things up later, as the commands can be rather long and you can simply copy and paste it to where you need it. Once you hit start the command prompt should open and show the running status, you can the "S" button to show the status at any given time.

oclHashcat-plus/cudaHashcat-plus (tab3):

This was also formerly known as oclHashcat+/cudaHashcat+ and has recently been changed to the new name. This GPU tool is used to replace the outdated CPU cracker that we originally all came to love and known as Hashcat, and is very good for single or large lists of MD5, MD4, NTLM, DCC, and DES hashes. This takes your Dictionary and Password files and runs the same attacks on them that Hashcat would, but instead of using the CPU it uses the GPU power, which results in exponentially faster results.

Like on tab1 for Hashcat we will need to point it to our Hash list file, choose to remove cracked hashes or not, point it to your dictionary or password files (as many as you have or need - haven't hit the limit yet), identify hash type. Now you can’t choose attack modes here but you can point it at your rules files which will do way more than the default attack modes will ever do, so not much loss here. If you want to let the tool auto-generate rules based on the developer’s statistical analysis you can do that as well and define how many rules to generate. As done on the oclHashcat/cudaHashcat you will need to define your GPU cards to use in the attack if they are not of the same kind and adjust any of the other parameters if you are advanced enough to know what you are doing. Choose to write the output and format type if desired and that is it. As before it will open the command prompt for you and start running the dictionary attacks off the GPU devices identified.

Once it is running it will look similar to before, and you can use the "S" for up to date status check, "h" for help dialogue, or "q" to quit:

oclHashcat-lite/cudaHashcat-lite (tab4):

This GPU tool is a bit more precise and can only be used on a single hash at a time, but is capable of cracking MD5, SHA-1,MySQL > 4, NTLM< and Domain Cached Credentials (DCC) hashes at extremely fast rates.

This can be very handy when you have a high priority hash and want to focus everything you have on it to Bruteforce it. You will also need to define the mask to use if desired or you can simple provide the charset to use and the min and max parameters for password length. You can also instruct the tool to take charset in hex form by checking the available box.

As done for the previous tabs you will need to identify your GPU devices and tweak any advanced parameters you want. Lastly identify if you want to write the output to file and where and you are ready to fire away.

This completes the overview and review of the latest release from the Hashcat team for Hashcat-GUI-v0.4.2. I hope you have enjoyed this review and I hope you find this tool very useful in your hash cracking adventures. If you want to speed things up you can also run one attack from the GPU tools while simultaneously running an attack from the CPU powered Hashcat tab. I use this method regularly to allow the CPU to handle the small rule sets I have and let the more complex rules run through the GPU to save time. You can also let Bruteforcing of smaller length attempts run on CPU while running anything over 7 characters long on the GPUs to save yourself some time. Enjoy and follow up with the makers of the tool as it is being updated all the time and they never seem to stop amazing me. If you have a small problem or need some help please feel free to comment or drop me a line and I will do what I can to help out with GUI or console problems. This was not meant to be an end all be all of tutorials or overview, but I do think it is very helpful and quite amazing tool and wanted to share it with the world. Have fun cracking...

UPDATE - Here is the video I made to accompany the article above: