Cain & Abel - Step 5: Brute Force Attack

So in the previous lecture we couldn't crack the password of the user cyber lab. So let's try to crack it with the brute force attack. Brute force attack needs a lot of time because it tries all the possibilities. So if you choose the correct character set, the success rate of cracking a password by brute force attack is theoretically 100%. But how long will it take? If the password length is more than eight, it will take months, years, or thousands of years to try all the password possibilities for any ordinary computer. So as you see in the table, the LM password is not empty for cyberlab. A tip here. The hash of an empty password starts with a D and ends with four e. Look at the LM hash of the guest user. Split the hash into two identical parts. You'll see two hashes that start with AAD and end with four E. As I mentioned before, the LM method splits the password into two seven character passwords and then takes the hash, which means we have to crack two seven character passwords. Well fair enough. LM method converts the password to all caps, so the character set is not so big. We can crack an LM hash in an acceptable time interval. So right click on the cyber lab line. In brute force attack, select LM hashes. The brute force attack window is a bit different from the dictionary attack window. It has expected no dictionary list now. Instead we have a character set combo box. The default character set are just uppercase letters and numbers. No alphanumeric characters in the set. So to keep the demo fast, let's just go with this set. It says two hashes loaded. And as you know, the hash value is split into two identical parts. On the upper right hand corner, we can choose the minimum and the maximum length of the passwords for lm method. Max length for the password is seven, so this configuration is perfect. Now I press the start button to start the attack. Wow. It found the value of one of the hashes in milliseconds. So let's look at the hash file. Yeah, it's the second part. So that means that the password ends with q. I think the password of the cyber lab user is the same with the passwords of the administrator, except the dot at the end, but we'll see. So let's look at the key rate. Kane tries more than 10 million passwords in a second. Now that's pretty fast. In the time left frame, we can see that the trying all possible passwords will take about two hours unless Kane cracks it. So let the Kane run for a while. All right, and we're back. It took more than an hour. And here's the result. We're lucky because no alphanumeric character is in the password, and we succeeded to crack it. The first part is 1234 cu cu cu.