Cryptohaze.com

Added "exit after finding N hashes" option. It's not in this download, but will be in the next one.

opensource.org

My hope is to modify the hashfile compare routine to treat the input list as a regexp (really for my need I just need to key of the last two nt hash bytes). So instead of matching off a true collision I'm filtering the output file to only hashes which end in p14 + p15. The output list of all potential hash matches would then be analyzed by another program. Adding this feature to your existing code should be quick, and I suspect it could be written to toggle on/off this behavior.

Further details as to why this is useful: http://www.willhackforsushi.com/code/asleap/2.2/README

Uh huh. I'm aware of open source, I just said "the source isn't open right now." It may or may not be at some point in the future, partly depending on algorithm contributions from various people. Zero_Chaos and I have gone back and forth on hashcat, and the more people that crusade for me releasing the source, the more they're likely to just irritate me.

As for the hash, is it the LM hash (LanMan), or the NTLM hash (MD4 of unicode)?

And, my understanding is that you'd like the input to be the last 2 bytes of the hash, and the output to be any full password/hash that matches this? More details on what *exactly* you need would be very useful.

I'm happy to add such things given details. If it's a useful feature, I'm willing to add it.

I don't know the back story of why the source wasn't available or even what license various components fall under. It's just frustrating to contribute code for binary releases *shrugs*

That's essentially it. Yes, NTLM hash. This would allow generating filtered word lists for the ms-chap challenge/response weakness. asleap incorporates a CPU based genkeys.

He's talking about NTLM Challenge http://en.wikipedia.org/wiki/NTLM#NTLMv1. It uses the NTLM hash as three keys (7 bytes, 7 bytes, and 2 bytes) for DES encrypting of the salt. It's easy to crack the 2 byte key which you can use so you only need to use DES to check the password once every 65,536 times.

I don't yet have a clean, cross platform build environment, so any source release ends up with tons of people bitching about it not compiling cleanly without modifications on some OS, and expecting me to know details of how to fix it.

It's really rather annoying.

Now on a keyboard... additional information since I'm not dead tired:

Right now, the code is in *heavy* flux. I'm actively making significant modifications as I'm adding new features, trying to find the best place to put things. This means that all the interfaces/classes/etc are getting iterated as I'm adding new functions.

Eventually (hopefully within the next few weeks) things should stabilize to the point where the following are true:
- The code runs on ALL platforms, not just Linux (I have to go to boost threading for this, among other things)
- The code actually *compiles* cleanly on all platforms without hacking (don't ask what I had to do to get the old multiforcer sources compiled on Windows...)
- The classes/structures/etc are fairly solid and not changing on a daily basis.

At *this* point, then I'll start considering open sourcing of the tool. Right now, all it would do is piss people off, as things are quite literally changing, often significantly, on a daily basis. So there's absolutely zero guarantee that anything written would compile against newer versions of code, and it's very likely that it wouldn't.

The good news is that with the changes I'm making, adding new hash types and even totally new hash *concepts* is going to be much easier. It's class based, and has several encapsulation concepts that are making things much easier. For instance, all current hash functions (MD5/NTLM/MD4/SHA1, only the 1st two being supported in the current beta) are just extensions of the "HashTypePlain" instance - the amount of new code needed to implement them outside the CUDA files is pretty much zero. Except that, currently, I've changed where things go in this hierarchy about 4 times in the last week, such that code built against one revision of it flat out wouldn't work against others.

--------------

So, long story short, yes, I do plan to open source it and accept contributions, but only after the basic framework is solid and not actively changing. Make sense? Thanks.

Sc00bz wrote:He's talking about NTLM Challenge http://en.wikipedia.org/wiki/NTLM#NTLMv1. It uses the NTLM hash as three keys (7 bytes, 7 bytes, and 2 bytes) for DES encrypting of the salt. It's easy to crack the 2 byte key which you can use so you only need to use DES to check the password once every 65,536 times.

Thanks, that looks fun

Given that I'm working on a DES engine, I might be able to do more than just the initial step, though I'll get to that first.

Hi

Im new in the forumworld, sorry in advanced of bad spelling and if i got it wrong where to put the post. But have played a lot around the last days with both the Multiforcer and Cryptohaze. Really loving it.

Like the new features in 0.80 and would love seeing the new interface, but just keeps saying this:
"Creating 1 threadsCuda error: too many resources requested for launch.s "! Is there anything im missing ?

I've installed the new nvidia drivers and also the newest cuda driver. Quiet everything in nvidias repo on cuda. And still get the a bow error. Im running on ubuntu 64x on GT230, has the new version stopped support on 200 series! The 0.72 version still runs good.

Also i was wondering if any ones got a benchmark on GTX 295 vs. GTX 480 in both Cryptohaze and Multiforcer i need a upgrade in CUDA

Got 3 questions more sorry but really love it, and learning a lot running it. Even my son on 5years love seeing the screen run hashes His learning some to along the way until he grows up and want dad to buy more cuda.

when i run ./GTRCrack -h MD5 -c charsets/charsetnumeric -s "hash" -o hashoutput.txt # Can i run it aginst a text file containing the hashes instead of only one hashstring (-s) ? almost have triad anything and read up, but do not seam to support on-les I'm missing it

when runing ./GTRgen # can i make it generate by automatic 5 tabels like from 0-5 instead of manually changing the value.

And the last one, how to make the charset index compitable with otter rainbow tables tools. I mean when done gen. a table is it at all possible to make it run in rcrack or otters. I'm would love to try a test run with pyrit passthrough and gtr tables.

Good weekend to all.

cablefree wrote:Im new in the forumworld, sorry in advanced of bad spelling and if i got it wrong where to put the post. But have played a lot around the last days with both the Multiforcer and Cryptohaze. Really loving it.

Donations always welcome...

cablefree wrote:Like the new features in 0.80 and would love seeing the new interface, but just keeps saying this:
"Creating 1 threadsCuda error: too many resources requested for launch.s "! Is there anything im missing ?

I set the default thread and block count to suitable values for fermi cards for testing. I'm guessing you have a very low end card. Try passing '--threads 64 --blocks 20' or such to it and see if it works. I really need to autotune for that stuff...

cablefree wrote:I've installed the new nvidia drivers and also the newest cuda driver. Quiet everything in nvidias repo on cuda. And still get the a bow error. Im running on ubuntu 64x on GT230, has the new version stopped support on 200 series! The 0.72 version still runs good.

The GT230 is *NOT* a GTX200 series card. It looks like it has 64 shader processors, so it's a fairly low end card. Drop the thread/block count, or get a better card.

cablefree wrote:Also i was wondering if any ones got a benchmark on GTX 295 vs. GTX 480 in both Cryptohaze and Multiforcer i need a upgrade in CUDA

With the new code, the 400s are a bit quicker. I don't have exact benchmarks, but I'll try to get some up soon. I have access to both sets of cards.

cablefree wrote:when i run ./GTRCrack -h MD5 -c charsets/charsetnumeric -s "hash" -o hashoutput.txt # Can i run it aginst a text file containing the hashes instead of only one hashstring (-s) ? almost have triad anything and read up, but do not seam to support on-les I'm missing it

Not currently, That will be in the next release.

cablefree wrote:when runing ./GTRgen # can i make it generate by automatic 5 tabels like from 0-5 instead of manually changing the value.

No.

cablefree wrote:And the last one, how to make the charset index compitable with otter rainbow tables tools. I mean when done gen. a table is it at all possible to make it run in rcrack or otters. I'm would love to try a test run with pyrit passthrough and gtr tables.

You can't. My tables use a different reduction function that is not compatible with other tables.