In this article, we will demonstrate how to perform a rule-based attack with hashcat to crack password hashes.
For this tutorial, we are going to use the password hashes from the Battlefield Heroes leak in 2013. These passwords are MD5 hashed and can be downloaded here.
This guide is demonstrated using the Kali Linux operating system by Offensive Security. Some commands may differ on other systems but the process will be the same.
As our base dictionary, we will use the rockyou wordlist. It comes pre-installed on Kali, or you can download it here.
What Are Rules and When Would I Use Them?
Although you can type each new pattern manually for each word in your list, this will quickly get impractical with larger wordlists.
Thankfully, we can express these patterns in programming terms using rules. With rules, we can create new passwords through modification of existing passwords supplied.
Though much smaller, the above would produce the same outcome of words as before. Not only is this quicker than manually creating each password you want to try, your dictionary file also won’t be as large.
In short, a rule-based attack allows you to express patterns which are applied to existing passwords to quickly generate new passwords to use.
Now that we can see the benefits of rules, we will now define some rules to use in our own rule-based attack. To define our own custom set of rules to use with hashcat, we need to store them in a file.
Note: This table is a condensed version from the hashcat wiki. The full version is available here.
To start, we will create some rules to do basic manipulation of the characters.
The colon entry instructs hashcat to try the original word. We'll be including this so we can compare how many passwords were cracked using unmodified passwords from the wordlist.
In this case we are appending characters one, two and three to the end of our passwords.
Where X is the character to replace and Y is the new character.
From the above, notice we've also included "Battlefield" with a capital "B" before the password.
The lines beginning with a "#" are used to indicate to hashcat that the line is a comment.
Now that we have our rules file and providing you have the Battlefield hashes and rockyou password dictionary, we are ready to start cracking the password hashes.
In order to log the effectiveness of our rules, we’ll make use of hashcat's debug commands. The debug option in hashcat works by logging a rule to a file every time it successfully cracks a password.
-m 0 Identify the hash as MD5.
bfield.hash The hash file to use.
-r rules Points hashcat to our rules file called “rules”.
--debug-mode=1 Writes the rule whenever it successfully cracks a password.
--debug-file=matched.rule The name of the debug file where the matched rules are stored.
From our output, the run shows 154,009 hashes were cracked in total, however we do not know how many passwords each rule cracked.
sort matched.rule Sorts the rules by grouping each occurrence of the rule with each other.
uniq -c Used to count up the number of occurrences of each rule.
sort –n –r Sorts the counted number of rules numerically in descending order.
Analysing the results it's clear that adding the number one to the end of the passwords was the most effective rule, cracking an additional 15337 password hashes that would otherwise have been missed. Cumulatively we can see that the other rules also resulted in a lot of additional cracked hashes, showing the importance of applying good rules.
Furthermore, notice that adding “battlefield” at the beginning of our passwords cracked thirty-six hashes, however the other rules using the word didn’t crack any.
It is worth mentioning that hashcat contains some rule files by default.
If you want to view the rules contained in each file, the format is the same as what was covered in this article.
As previously mentioned, only the commonly used rule functions were covered in this tutorial. To view a full list of available rule functions, you can do so on the hashcat website here.
In this guide, we created and used our own custom rules in hashcat to perform a rule-based attack. We started by covering what rule-based attacks are and why they are used. We then proceeded to create our own rules and use the rockyou dictionary to crack MD5 hashes from the Battlefield Heroes leak in 2013.