Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based...
Transcript of Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based...
![Page 1: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/1.jpg)
Summoning the Password Cracking Beast
Password 123456
Bob CordiscoSystems EngineerNetwrix
Brian JohnsonSecurity Enthusiast / Podcaster7 Minute Security
![Page 2: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/2.jpg)
Housekeeping
• All attendees are on mute
• Ask your questions!
• Questions will be answered during
the session or at the Q&A at the end
• You will receive a copy of slides and
webinar recording in the follow-up
• Duration: Up to 60 minutes
We hope you enjoy!
Type your question
here
Click “Send”
![Page 3: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/3.jpg)
Agenda
• Introduction
• Build an awesome cloud-based password-cracking rig
• Download millions of known “pwned” passwords
• Dump and crack user accounts from Active Directory
• Make sure your password policy is strong enough to resist password cracking
![Page 4: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/4.jpg)
Who’s this guy?
Security engineer for 7 Minute Security
Podcaster Not famous Tiny movie star
![Page 5: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/5.jpg)
![Page 6: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/6.jpg)
Build the password-cracking beast
![Page 7: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/7.jpg)
Deploy the VM
![Page 8: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/8.jpg)
Test the SSH connection
![Page 9: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/9.jpg)
Protect the SSH connection
![Page 10: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/10.jpg)
Protect the SSH connection
![Page 11: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/11.jpg)
Change the host name
![Page 12: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/12.jpg)
Change the paperspace password
![Page 13: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/13.jpg)
Install essential software
![Page 14: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/14.jpg)
Install essential software
![Page 15: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/15.jpg)
Install NVIDIA drivers
![Page 16: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/16.jpg)
Check out our sweet benchmarks!
![Page 17: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/17.jpg)
Gather wordlists
![Page 18: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/18.jpg)
Grab a bunch of wordlists for cracking
![Page 19: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/19.jpg)
Grab a bunch of wordlists for cracking (singing “We will, we will, rock you!”)
![Page 20: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/20.jpg)
Grab a bunch of wordlists for cracking
![Page 21: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/21.jpg)
Grab a bunch of wordlists for cracking
![Page 22: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/22.jpg)
Grab a bunch of wordlists for cracking
![Page 23: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/23.jpg)
Grab a bunch of wordlists for cracking
![Page 24: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/24.jpg)
Grab a bunch of wordlists for cracking
![Page 25: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/25.jpg)
Optimise the password lists!
![Page 26: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/26.jpg)
Tweak the Hatecrack config
![Page 27: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/27.jpg)
Adjust the config files
![Page 28: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/28.jpg)
Adjust the config files
![Page 29: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/29.jpg)
Crack our first hash!
![Page 30: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/30.jpg)
Our first crack job!
![Page 31: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/31.jpg)
Dump and crack AD user hashes!
![Page 32: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/32.jpg)
Import test users into Active Directory
![Page 33: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/33.jpg)
Create AD backup (with hashes!)
![Page 34: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/34.jpg)
Upload hashes to the beast
![Page 35: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/35.jpg)
It’s cracking time!
![Page 36: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/36.jpg)
It’s cracking time!
![Page 37: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/37.jpg)
Conclusion
• Password cracking is (relatively) cheap and (relatively) easy! o Create a cracking VM in Paperspace
o Download a ton of wordlists
o Optimise them with Hatecrack
o Dump hashes out of Active Directory
o It’s cracking time!
![Page 38: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/38.jpg)
Netwrix Auditor
Know Your Data. Protect What Matters.
![Page 40: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/40.jpg)
About Netwrix Corporation
Year of foundation: 2006
Headquarters location: Irvine, California
Global user base: over 300,000
Recognition:
7 years among the fastest growing
software companies in the US
More than 140 industry awards
![Page 41: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/41.jpg)
Make sure your password policy is strong enough to resist password cracking
This policy determines the minimum number of characters needed to create a password. You would generally want to set the Minimum Password Length to at least 8 characters since long passwords are harder to crack.
Minimum Password
Length policy
By enabling this policy, you’ll go beyond the basic password and account policies and ensure that every password is secured.
Passwords Must Meet Complexity
Requirements policy
This policy should only be enabled on a per-user basis and then only to meet the user’s actual needs. If your company uses an application that needs to read a password in a password database which is normally encrypted, then that is the only time you would want to enable this setting.
Store Password Using Reversible
Encryption for All Users policy
This policy will set how often an old password can be reused. It will discourage users from reusing a previous password, thus preventing them from alternating between several common passwords.
Enforce Password
History policy
This policy determines how long users can keep a password before they are required to change it. It forces the user to change their passwords regularly.
Maximum Password
Age policy
This policy determines how long users must keep a password before they can change it. It will prevent a user from dodging the password system by using a new password and then changing it back to their old one.
Minimum Password
Age policy
1 2 3
4 5 6
![Page 42: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/42.jpg)
Useful links
Join our next session
Password123456: Protecting Your Active Directory Castle on February 20 @ 1 pm AEDT / 10 am GMT+8
Read our Password Policy Best Practices Guide https://www.netwrix.com/password_best_practice.html
Check out Netwrix Auditor for Active Directory https://www.netwrix.com/active_directory_auditing.html
and its password expiration notification tool https://www.netwrix.com/password_change_reminder.html
If you want to learn more about Netwrix Auditor, register now for the upcoming Product Demo!
![Page 43: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/43.jpg)
Questions?
![Page 44: Summoning the Password Cracking Beast - Netwrix€¦ · • Build an awesome cloud-based password-cracking rig • Download millions of known “pwned” passwords • Dump and crack](https://reader030.fdocuments.in/reader030/viewer/2022040917/5e90ffaee8d99e517618ad49/html5/thumbnails/44.jpg)
Thank you!
Bob CordiscoSystems EngineerNetwrix
Brian JohnsonSecurity Enthusiast / Podcaster7 Minute Security