 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
 |
"Crack Me If You Can" - DEFCON 2010 |
 |
 Posted: Wed Jul 28, 2010 2:02 pm |
 |
|
| ToXiC |
| Moderator |
 |
|
| Joined: Dec 01, 2004 |
| Posts: 181 |
| Location: Cyprus |
|
|
 |
|
 |
|
| Code: | The Details:
Scenario:
As a part of an authorized penetration test of a large corporate network, you have captured a large number of password hashes. The hashes are from Active Directory, UNIX systems, LDAP servers, routers, etc. As part of your analysis, your client has asked for password complexity statistics, what their users are doing right and/or wrong related to generating passwords, and identification of weak passwords. You only have 48 hours to complete this effort.
Logistics:
On Thursday, at a specified time, KoreLogic will release a file containing 53,000 password hashes. The file will contain passwords of varying types (such as SHA, SSHA, MD5, DES, Lanman, NTLM, etc.) and will range from being "easy" to extremely difficult to crack. The password file is not simply 53,000 randomly generated passwords which would favor the person or group with the most GPU/CPU bruteforcing horsepower. Instead, the password file contains passwords based on what we believe are challenging patterns. Passwords will be of varying lengths, patterns, and complexity. Creative password cracking techniques, rules, dictionaries, and tools will be needed. The teams who are smart about the methods they use (i.e., teams who can crack more, with less work) will most likely be the most successful.
The goal of the contest is twofold:
1. To crack as many passwords as possible.
2. To crack all the "administrative/root" passwords.
The contest will be judged on a point system where:
1. Each user password cracked earns 1 point.
2. Each administrative password cracked earns 100 points.
Teams must provide their results directly to KoreLogic prior to 11:59 PM (PDT), Saturday, July 31. (Details on how to submit TBD, but probably PGP-encrypted emails.)
Rules:
* You MAY use as many systems/cores/CPUs as you wish.
* You MAY use systems NOT located at DEFCON.
* You MAY work with other team members not attending DEFCON, as long as at least one team member is physically attending.
* You MUST ONLY use systems that you are authorized to use.
* You MUST NOT attempt to gain unauthorized access to any system used by KoreLogic or another team.
* You MUST NOT attempt to interfere with the efforts of another team.
* You MUST NOT attempt to steal passwords from or techniques/methods used by another team.
* To be eligible for a prize, you MUST agree to share your techniques / methodologies and describe the resources/tools used to crack the passwords.
* KoreLogic staff are not eligible for the contest.
* The file containing the password hashes will not be released until the start of the contest.
Any violation of the rules will result in immediate disqualification from the contest. Any illegal activity will be reported.
Results:
KoreLogic staff will validate each submission and will announce the winning teams on Sunday, (time TBD). The team with the highest score will be the winner. If there is a tie in total points, the team that submitted their entry first will place higher.
KoreLogic will present the winning team's results, which will include what passwords were cracked and what passwords were not. The winning team will be required to present their techniques/methodologies, describe the resources/tools used to crack the passwords, and describe any lessons learned (arrangements can be made for the camera-shy).
At the conclusion of the contest, KoreLogic will:
* Announce the winners and award the prizes.
* Release the entire password list.
* Provide statistics on which types of passwords were totally missed by all teams.
* Provide statistics on which types of word lists were totally missed by all teams.
* Release a number of word lists and John the Ripper rules under an open-source license. Taken together, these rules and word lists will be able to crack a majority of the 53,000 passwords.
Prizes:
KoreLogic will be giving away the following prizes for first, second, and third place:
* First Place: $600 (or equivalent item)
* Second Place: $300 (or equivalent item)
* Third Place: $100 (or equivalent item)
Good luck!
We will be announcing more details closer to the event. In the meantime, please contact defcon-2010-contest@korelogic.com with any questions (PGP key) |
Guys if somebody will attend Defcon we can make a nice team so can take part at the competition. |
|
_________________
who|grep -i blonde|talk; cd~;wine;talk;touch;unzip;touch; strip;gasp;finger;gasp;mount; fsck; more; yes; gasp; umount; make clean; sleep;wakeup;goto http://www.md5this.com |
|
|
|
|
|
|
|
| Posted: Wed Jul 28, 2010 5:05 pm |
|
|
| earthquaker |
| Advanced user |
 |
|
| Joined: Jun 02, 2008 |
| Posts: 111 |
| Location: q8 |
|
|
|
|
|
|
| sounds fun, count me in if u find someone attending |
|
|
|
|
| Posted: Thu Jul 29, 2010 2:50 am |
|
|
| crownonfire |
| Beginner |
 |
|
| Joined: Jul 29, 2010 |
| Posts: 1 |
|
|
|
|
|
|
|
|
|
|
|
| Posted: Thu Jul 29, 2010 10:35 am |
|
|
| earthquaker |
| Advanced user |
|
|
| Joined: Jun 02, 2008 |
| Posts: 111 |
| Location: q8 |
|
|
|
|
|
|
| how about posting it here? post the password files in here to everyone can participate since the team is unlimited and can use help from other people not attending ... this can be major fun :=P |
|
|
|
|
| Posted: Thu Jul 29, 2010 10:59 am |
|
|
| vince213333 |
| Advanced user |
 |
|
| Joined: Aug 03, 2009 |
| Posts: 737 |
| Location: Belgium |
|
|
|
|
|
|
| Quote: | | Release a number of word lists and John the Ripper rules under an open-source license. Taken together, these rules and word lists will be able to crack a majority of the 53,000 passwords. |
I'm definitely waiting for that one ^^ I'd love to join you guys but I'm way to busy with work :s |
|
|
|
|
| Posted: Thu Jul 29, 2010 11:20 am |
|
|
| earthquaker |
| Advanced user |
|
|
| Joined: Jun 02, 2008 |
| Posts: 111 |
| Location: q8 |
|
|
|
|
|
|
| aren't we all busy and have work to do? its just the fun we're seeking , living the competition hehe nothing serious about it |
|
|
|
|
| Posted: Thu Jul 29, 2010 3:17 pm |
|
|
| ToXiC |
| Moderator |
|
|
| Joined: Dec 01, 2004 |
| Posts: 181 |
| Location: Cyprus |
|
|
|
|
|
|
|
_________________
who|grep -i blonde|talk; cd~;wine;talk;touch;unzip;touch; strip;gasp;finger;gasp;mount; fsck; more; yes; gasp; umount; make clean; sleep;wakeup;goto http://www.md5this.com |
|
|
|
| Posted: Fri Jul 30, 2010 7:18 pm |
|
|
| earthquaker |
| Advanced user |
|
|
| Joined: Jun 02, 2008 |
| Posts: 111 |
| Location: q8 |
|
|
|
|
|
|
|
|
|
|
www.waraxe.us Forum Index -> General discussion
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
Discussions
Tools
Content
Info
Membership:
Latest: 
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 152
Members: 0
Total: 152
