Hashcat integration

[e-ago]

Hashcat integration

[necrose99]

https://github.com/s3inlc/hashtopolis
Also a nice tool, hascat related.
Using agents could sniff keys useful for red teams.

[e-ago]

Thank you! For the moment BitCracker has been integrated as John The Ripper plugin ( using --format=bitlocker-opencl ) . Currently we are not working with the Hashcat team, but if there is the need we can think to start a collaboration.

[cyrus104]

I'm am already using Hashtopolis, with the latest hashcat binaries, to disitribute across a small number of systems my auditing system. Hashtopolis works great for me because I'm looking at multiple algorithms but having bitlocker capabilities would great.

[e-ago]

Good news: we are starting a collaboration with the Hashcat team.
In the next future BitCracker will be the opencl-bitlocker format in Hashcat.
I'll let you know when it will be released.

[cyrus104]

This is great news, thanks!

[cyrus104]

Gocrack, from Fireeye might be able to do something similar too. Maybe, the way it runs might prevent this type of functionality.

Any update with the hashcat integration?

[e-ago]

Working on it...

[stevenliuit]

@cyrus104
Can you use my dictionary library to help me crack the hash? I ran for a week and haven't cracked it yet. Below is the hash of my user and pass.
hash_recv_pass.txt

$bitlocker$2$16$df4d3254aa7554fa0b02509876bf11eb$1048576$12$6070c179822fd20106000000$60$38cf5f73b5b8fb90713f0ea203427ad01ac7bf95cf7efd194d907d152ba09ec412809236d8ef65da95d6ff6ba51832f50af757f3a9c706e939b5faae

hash_user_pass.txt

$bitlocker$0$16$b67ada75e2f1325d818d59489bae3811$1048576$12$6070c179822fd20103000000$60$bac4aab037d3fe9cfb0028281128905a090a7abf01b05aa0da6df27a00e2af0f8a8ab24a3369de3aea96d70f81ee689dcb54530546b505a092cd6a2a

[cyrus104]

@e-ago, hope you had good holidays. I wanted to check the status of getting a hashcat mode for bitcracker.

Thanks

[roycewilliams]

BitLocker "User Password" hashes (that are not TPM-based) are supported in the upcoming 6.0.0 release of hashcat (and also available in the latest GitHub and hashcat.net/beta), using mode 22100.

[cyrus104]

Awesome to hear this.

…

On Thu, Jun 11, 2020, 1:02 AM Royce Williams ***@***.***> wrote: BitLocker hashes are supported in the upcoming 6.0.0 release of hashcat (and also available in the latest GitHub and hashcat.net/beta), using mode 22100. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#6 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AALWQ4423QGNKNCLVSP4JATRV7DENANCNFSM4FAE4X4Q> .

[turbofiesta]

Nice!
When the Hashcat will be able to crack TPM based hashes ($bitlocker$2$, $bitlocker$3$)?

[cyrus104]

The original task was completed, would like to also see $2$ and $3$.