Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

I'm looking for a program that can use any GPU (ATI\NVIDIA) and can brute force a vBulletin hash - md5(md5($password) + salt)).

I have the salt and hash.

the password contains the symbols - a-zA-z0-9 the, length is of 7-8 charcters.

I'm going to run it on a windows platform (would like to use a freeware)

if you're asking why I'm doing it, I'm an owner of a big forum, a friend of mine changed his password for several accounts (mail, facebook, few forums\sites), he had forgotten his new password (he can't login to neither of the services), he's sure that he used the same password for all services (just copied\pasted).. and he's locked out (he can't do anything about it - for sure).

Thanks!

share|improve this question
10  
Can he use the "forgot my password" functionality on those sites? That seems like a simpler and better solution. – D.W. Sep 17 '11 at 1:38
3  
If he copied it out of a password input field, it may have turned into the appropriate number of "*", depending on the browser. – Hendrik Brummermann♦ Sep 17 '11 at 6:24
1  
he had a keyboard sniffer on his computer (maleware), so he went to a different computer, opened notepad and wrote his new pass, then he copied the password from the file directly to the change password forms, he forgot to save it and now he can't remember what he used (exactly), he can't use the forgot my password functionality - he's locked out of his mail. I've started breaking it but it's slow - 1.2M pass/sec'. – YSY Sep 17 '11 at 13:13
2  
Depending on who is his email provider, they may provide alternative ways to get access to his account. Gmail does, for instance (they'll ask a series of questions that likely only the account-holder could know correctly). – D.W. Sep 17 '11 at 18:34
According to their homepage oclHashcat can attempt >1 billion md5 hashes per second, depending on the GPU. But I'm not sure if it supports this specific scheme out of the box. – CodesInChaos Jul 21 '12 at 16:35

3 Answers

up vote 6 down vote accepted

I do not have exactly the software you want. However:

  • You can use any existing MD5 implementation and write the code which invokes it twice for all the potential passwords. See for instance sphlib; on my PC (Core2 x86, 2.4 GHz), this code should be able to evaluate more than 6 millions MD5 hashes per second, so that's 3 millions per second passwords with your double-hash scheme. That's per core: my PC is a quad-core, so the full machine could go up to 12 million passwords per second.

  • Most x86 processors offer SSE2 opcodes: instructions which can compute four 32-bit operations simultaneously. By using the C compiler intrinsics (supported by Visual C, the Intel C compiler, and GCC), you can use them without getting your hands into hand-written assembly. Using these opcodes, you can compute four MD5 instances in parallel. I estimate that my PC should be able to try out 30 millions of passwords per second with such an implementation (I have tried with SHA-1, which is similar to MD5).

  • With a 9800 GTX+ Nvidia GPU, you should be able to try up to 100 millions of passwords per second (there again, an estimate -- I can do 160 millions SHA-1 per second on that machine, so 200 millions of MD5 is a reasonable figure). This is not a top-of-the-line GPU (I bought it in January 2009); with a more recent card, 500 millions of passwords per second are achievable.

With 500 millions of passwords per second, you could explore the whole space of passwords up to 8 characters (in the alphanumeric range that you quote) in about one week. That's doable. It is also an interesting programming exercise.

share|improve this answer
1  
it's definitively an interesting programming exercise, if I'll use python's implementation of md5 it will take years, I can use Ctypes and then import the sphlib to python. I can cut the coding times, anything else will take me a few weeks to develop and test. I couldn't understand how does the processor can compute four MD5 instances in parallel? (where can I read about it?) for the last one I need to know how to use CUDA, it's the most promising option I have. – YSY Sep 17 '11 at 22:16
1  
it's weird that there are cracking programs that doesn't use all of the processor power they can (passwordpro is cracking 1.2M p/s on my quad core machine) when it can obviously crack much more in the same time (they are charging $ for their non demo version). – YSY Sep 17 '11 at 22:19
@YSY: SSE2 registers are 128-bit long. The paddd opcode (_mm_add_epi32() function in C) "adds" two such registers by 32-bit chunks, i.e. it performs four 32-bit additions simultaneously. There are other opcodes which handle the registers as four 32-bit values, enough to compute four MD5. Have a look at this code: this is the same thing, for another hash function called Shabal, which also uses 32-bit integer operations. – Thomas Pornin Sep 18 '11 at 14:06
up vote 3 down vote

In all honesty, you're boned if you want to do it cheap and fast. But, why not, it's a crappy Saturday, so let's give it a spin.

John the Ripper is your best bet. I suggest you read up on it. It has lots of features that can be used for good or for evil.

The number of passwords you are attempting to bruteforce is in the area of 218,340,105,584,896. At 1.2 Million guesses per second, that's about 5.8 years. And that's assuming you're using that tool right. Since he knows part of the password, you need to generate your own wordlist.

You could also distribute the cracking out to multiple computers, each processor you add would reduce the time by half, give or take. That's not cheap, especially if he wants it in the next week or so. It would take 300+ computers to deliver this password in a week, guaranteed.

He's really better off attempting to call the places he wants a password reset to and hoping they can help him out, or opening all new accounts. If password cracking was easy, nobody would use passwords.

Mike

share|improve this answer
you're right, I know John The Ripper but I haven't quite used it yet, I'll give it a try, in the mean time I've started using passwordpro (demo) which is nice, they offer a GPU version which should run on about 140m p/s which is quite amazing. I need to think how I can distribute the cracking without dividing the brute-force list myself. – YSY Sep 17 '11 at 22:04
I'm totally embarrassed by my answer now. Password cracking has come a long way in the past year and a half. – MToecker May 10 at 5:35
up vote 0 down vote

oclHashCat (both -lite and -plus) claims support for:

  • vBulletin < v3.8.5
  • vBulletin > v3.8.5

It's a very fast, GPU based password cracker.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.