Waraxe IT Security Portal  
  Login or Register
::  Home  ::  Search  ::  Your Account  ::  Forums  ::   Waraxe Advisories  ::  Tools  ::
April 1, 2020
Menu
 Home
 Logout
 Discussions
 Forums
 Members List
 IRC chat
 Tools
 Base64 coder
 MD5 hash
 CRC32 checksum
 ROT13 coder
 SHA-1 hash
 URL-decoder
 Sql Char Encoder
 Affiliates
 y3dips ITsec
 Md5 Cracker
 User Manuals
 AlbumNow
 Content
 Content
 Sections
 FAQ
 Top
 Info
 Feedback
 Recommend Us
 Search
 Journal
 Your Account



User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9145

People Online:
Visitors: 779
Members: 0
Total: 779
PacketStorm News
Currently there is a problem with headlines from this site
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> General discussion -> "Crack Me If You Can" - DEFCON 2010
Post new topic  Reply to topic View previous topic :: View next topic 
"Crack Me If You Can" - DEFCON 2010
PostPosted: Wed Jul 28, 2010 2:02 pm Reply with quote
ToXiC
Moderator
Moderator
 
Joined: Dec 01, 2004
Posts: 181
Location: Cyprus




Code:
The Details:

Scenario:

As a part of an authorized penetration test of a large corporate network, you have captured a large number of password hashes. The hashes are from Active Directory, UNIX systems, LDAP servers, routers, etc. As part of your analysis, your client has asked for password complexity statistics, what their users are doing right and/or wrong related to generating passwords, and identification of weak passwords. You only have 48 hours to complete this effort.

Logistics:

On Thursday, at a specified time, KoreLogic will release a file containing 53,000 password hashes. The file will contain passwords of varying types (such as SHA, SSHA, MD5, DES, Lanman, NTLM, etc.) and will range from being "easy" to extremely difficult to crack. The password file is not simply 53,000 randomly generated passwords which would favor the person or group with the most GPU/CPU bruteforcing horsepower. Instead, the password file contains passwords based on what we believe are challenging patterns. Passwords will be of varying lengths, patterns, and complexity. Creative password cracking techniques, rules, dictionaries, and tools will be needed. The teams who are smart about the methods they use (i.e., teams who can crack more, with less work) will most likely be the most successful.

The goal of the contest is twofold:

   1. To crack as many passwords as possible.
   2. To crack all the "administrative/root" passwords.

The contest will be judged on a point system where:

   1. Each user password cracked earns 1 point.
   2. Each administrative password cracked earns 100 points.

Teams must provide their results directly to KoreLogic prior to 11:59 PM (PDT), Saturday, July 31. (Details on how to submit TBD, but probably PGP-encrypted emails.)

Rules:

    * You MAY use as many systems/cores/CPUs as you wish.
    * You MAY use systems NOT located at DEFCON.
    * You MAY work with other team members not attending DEFCON, as long as at least one team member is physically attending.
    * You MUST ONLY use systems that you are authorized to use.
    * You MUST NOT attempt to gain unauthorized access to any system used by KoreLogic or another team.
    * You MUST NOT attempt to interfere with the efforts of another team.
    * You MUST NOT attempt to steal passwords from or techniques/methods used by another team.
    * To be eligible for a prize, you MUST agree to share your techniques / methodologies and describe the resources/tools used to crack the passwords.
    * KoreLogic staff are not eligible for the contest.
    * The file containing the password hashes will not be released until the start of the contest.

Any violation of the rules will result in immediate disqualification from the contest. Any illegal activity will be reported.

Results:

KoreLogic staff will validate each submission and will announce the winning teams on Sunday, (time TBD). The team with the highest score will be the winner. If there is a tie in total points, the team that submitted their entry first will place higher.

KoreLogic will present the winning team's results, which will include what passwords were cracked and what passwords were not. The winning team will be required to present their techniques/methodologies, describe the resources/tools used to crack the passwords, and describe any lessons learned (arrangements can be made for the camera-shy).

At the conclusion of the contest, KoreLogic will:

    * Announce the winners and award the prizes.
    * Release the entire password list.
    * Provide statistics on which types of passwords were totally missed by all teams.
    * Provide statistics on which types of word lists were totally missed by all teams.
    * Release a number of word lists and John the Ripper rules under an open-source license. Taken together, these rules and word lists will be able to crack a majority of the 53,000 passwords.

Prizes:

KoreLogic will be giving away the following prizes for first, second, and third place:

    * First Place: $600 (or equivalent item)
    * Second Place: $300 (or equivalent item)
    * Third Place: $100 (or equivalent item)

Good luck!

We will be announcing more details closer to the event. In the meantime, please contact defcon-2010-contest@korelogic.com with any questions (PGP key)


Guys if somebody will attend Defcon we can make a nice team so can take part at the competition.

_________________
who|grep -i blonde|talk; cd~;wine;talk;touch;unzip;touch; strip;gasp;finger;gasp;mount; fsck; more; yes; gasp; umount; make clean; sleep;wakeup;goto http://www.md5this.com
View user's profile Send private message Visit poster's website MSN Messenger
PostPosted: Wed Jul 28, 2010 5:05 pm Reply with quote
earthquaker
Advanced user
Advanced user
 
Joined: Jun 02, 2008
Posts: 111
Location: q8




sounds fun, count me in if u find someone attending
View user's profile Send private message
PostPosted: Thu Jul 29, 2010 2:50 am Reply with quote
crownonfire
Beginner
Beginner
 
Joined: Jul 29, 2010
Posts: 1




Hey guys, I am going do you want to join my team?

crownonfire@gmail.com
View user's profile Send private message
PostPosted: Thu Jul 29, 2010 10:35 am Reply with quote
earthquaker
Advanced user
Advanced user
 
Joined: Jun 02, 2008
Posts: 111
Location: q8




how about posting it here? post the password files in here to everyone can participate since the team is unlimited and can use help from other people not attending ... this can be major fun :=P
View user's profile Send private message
PostPosted: Thu Jul 29, 2010 10:59 am Reply with quote
vince213333
Advanced user
Advanced user
 
Joined: Aug 03, 2009
Posts: 737
Location: Belgium




Quote:
Release a number of word lists and John the Ripper rules under an open-source license. Taken together, these rules and word lists will be able to crack a majority of the 53,000 passwords.


I'm definitely waiting for that one ^^ I'd love to join you guys but I'm way to busy with work :s
View user's profile Send private message
PostPosted: Thu Jul 29, 2010 11:20 am Reply with quote
earthquaker
Advanced user
Advanced user
 
Joined: Jun 02, 2008
Posts: 111
Location: q8




aren't we all busy and have work to do? its just the fun we're seeking , living the competition hehe nothing serious about it
View user's profile Send private message
PostPosted: Thu Jul 29, 2010 3:17 pm Reply with quote
ToXiC
Moderator
Moderator
 
Joined: Dec 01, 2004
Posts: 181
Location: Cyprus




crownonfire wrote:
Hey guys, I am going do you want to join my team?

crownonfire@gmail.com


and your team is.... ?

_________________
who|grep -i blonde|talk; cd~;wine;talk;touch;unzip;touch; strip;gasp;finger;gasp;mount; fsck; more; yes; gasp; umount; make clean; sleep;wakeup;goto http://www.md5this.com
View user's profile Send private message Visit poster's website MSN Messenger
PostPosted: Fri Jul 30, 2010 7:18 pm Reply with quote
earthquaker
Advanced user
Advanced user
 
Joined: Jun 02, 2008
Posts: 111
Location: q8




https://contest.korelogic.com/defcon_contest_hashes.txt
View user's profile Send private message
"Crack Me If You Can" - DEFCON 2010
  www.waraxe.us Forum Index -> General discussion
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Post new topic  Reply to topic  




Powered by phpBB 2001-2008 phpBB Group






All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2013 Janek Vind "waraxe"
Page Generation: 0.062 Seconds