PBKDF2 Cracking: Brute Force & Dictionary Attacks

G5 Cyber Security

2 weeks ago

TL;DR

This guide shows you how to try and crack a file encrypted using PBKDF2 key derivation. We’ll cover brute-force and dictionary attacks, focusing on practical tools like John the Ripper and Hashcat. It’s important to remember that attempting to crack passwords without permission is illegal.

Understanding PBKDF2

PBKDF2 (Password-Based Key Derivation Function 2) isn’t a direct encryption method itself, but it strengthens passwords before they are used for encryption. It takes your password and ‘stretches’ it using a salt and many iterations to make brute-force attacks much slower. The more iterations, the harder it is to crack.

Prerequisites

A Linux environment (Kali Linux is recommended).

John the Ripper installed:

sudo apt update && sudo apt install john

Hashcat installed: Download from https://hashcat.net/download/ and follow installation instructions for your system.
The encrypted file you want to crack (and ideally, information about the encryption method used).

Step 1: Identify the Hash Type

You need to know what kind of hash PBKDF2 generated. Often, this is indicated by the filename or documentation associated with the encrypted file. Common formats include:

bcrypt
scrypt
PBKDF2-HMAC-SHA1/SHA256/SHA512 (often just called PBKDF2)

If you’re unsure, try using a hash identification tool like Hashcat’s example hashes page to see if your hash matches any known types.

Step 2: Cracking with John the Ripper

Load the Hash File: Use the john command. For example, if your file is named ‘encrypted.txt’:
```
john encrypted.txt
```
Run a Brute-Force Attack (Simple Passwords): This tries all possible combinations of characters within a specified length. Be warned: this can take *very* long even for short passwords.
```
john --format=bcrypt encrypted.txt ?a?a?a?a?a?a?a?a
```
(This example tries 8-character passwords with only lowercase letters ‘a’). Adjust the format and character set as needed.
Run a Dictionary Attack: This uses a list of common passwords to try and match the hash.
```
john --wordlist=/usr/share/wordlists/rockyou.txt encrypted.txt
```
(Replace /usr/share/wordlists/rockyou.txt with the path to your dictionary file).
Check Results: Use
```
john --show encrypted.txt
```
to see if any passwords were cracked.

Step 3: Cracking with Hashcat

Determine the Hash Mode: Hashcat requires a specific mode number for each hash type. Check Hashcat’s wiki for the correct mode.
Run a Brute-Force Attack:
```
hashcat -m 3200 encrypted.txt ?a?a?a?a?a?a?a?a --attack-mode 0
```
(-m 3200 is an example for bcrypt, adjust as needed; –attack-mode 0 performs a straight brute force).

Run a Dictionary Attack:

hashcat -m 3200 encrypted.txt /usr/share/wordlists/rockyou.txt --attack-mode 0

(Again, adjust the hash mode as needed).

Use Rules: Hashcat rules modify dictionary words to create variations (e.g., capitalization, adding numbers).
```
hashcat -m 3200 encrypted.txt /usr/share/wordlists/rockyou.txt --rules=best64
```
Check Results: Hashcat will display cracked passwords as they are found in the console. Results are also saved to a file (usually hashcat.potfile).

Step 4: Optimizing Attacks

Use a Good Dictionary: Rockyou.txt is common, but larger and more specialized dictionaries can be more effective.
Rulesets: Experiment with different Hashcat rules to generate password variations.
Hardware Acceleration: If you have a powerful GPU, use it with Hashcat for significantly faster cracking speeds (Hashcat automatically detects compatible GPUs).
Masks: For brute-force attacks, create custom masks to focus on specific character sets and lengths.
```
hashcat -m 3200 encrypted.txt ?l?l?l?l?l?l?l?l --attack-mode 0
```
(This example tries 8 lowercase letters)

Important Considerations

Legality: Cracking passwords without permission is illegal and unethical. Only attempt to crack passwords for systems you own or have explicit authorization to test.
Time: Brute-force attacks can take an extremely long time, even with powerful hardware.
Resource Intensive: Cracking attempts consume significant CPU/GPU resources.