Cracking MS-CACHE v2 hashes using GPU

Question

As most people here will know, Windows caches domain/AD credentials in a format known as MS-Cache v2. Obviously, these would be excellent passwords to gain during a penetration test when local access is obtained on a workstation.

My understanding is that these can't be attacked using rainbow tables. However, aside from using JTR and Cain, I don't see many options in software to crack them. Specifically, I'd like to use my GPU's (4x Nvidia cards) to try and crack these. Alternatively, if I could run distributed software, that would be a reasonable second best.

A few questions then:

• What options are there for recovering MS-Cache passwords?

• Can anyone provide a technical breakdown of how MS-Cache (v2) is generated/attacked?

• Is MS-Cache v2 used to encrypt credentials stored on a domain controller?

Edit:

I'm only interested in MS-Cache v2 Hashes as generally i wouldn't come across machines older than Windows XP in a domain.

Answer 1

MS-Cache is a pretty simple format - it's an MD4 hash of the password, followed by the username in lower case, and hashed together MD4( MD4(Unicode(password)) + Unicode(tolower(username)) ). I'm not sure of the technical difference between MS-Cache and v2; but nothing I can find suggests they're not susceptible to a RainbowTable attack (in fact, Cain & Abel seems to have support for MS-Cache and MS-Cache v2 tables - "Added MSCACHE v2 Hashes Cryptanalysis via Sorted Rainbow Tables" in v4.9.4).

The MS-Cache credentials are not stored on the domain controller (except for users that logon to it directly) - they are stored as MD4 hashes of the passwords, related to the username. You may be interested in this technet piece about how they're hadled.

Regarding GPU accelleration, it looks like John the Ripper has MD4 support; that may be what you're after. Otherwise there is this article on attacking Windows passwords with the GPU (specifically, you may be able to adapt ighashgpu for your purposes) and, as mentioned by Lucas in the comments below; rcracki_mt has GPU support.

[Update]

MS-Cache v2 is described in detail (with code) at openwall.info, and importantly PassLib mentions it's also known as 'DCC2', which may help with future searches (though info is frustratingly scant). As for attacks against it, from openwall:

In other words, incremental brute-force attacking for different search spaces, depending on the character set and the password length, will take ages. So it is a good idea to do some intelligent password guessing when attacking DCC2 hashes, i.e. rule-based dictionary and probabilistic attacks.

With that python module and PassLib you should be able to put together something involving PyCUDA and PassLib, but it doesn't look like it's been done by anyone before.

Answer 2

From this page, I see a description of MS-Cache v2 as the MD4 hash of the concatenation of the "NTLM hash" of the password, and the username (converted to lowercase, then encoded in "Unicode", which means "little-endian UTF-16" in Microsoft terminology). The "NTLM hash" is MD4 computed over the password (there again in little-endian UTF-16). So the hash involves two nested MD4 invocations and is "salted" by the user name.

Rainbow tables are "just" precomputed tables (with a trick which saves a lot of space); they can crack hashes which were encountered during the table building phase, but none other. Therefore, you can build a rainbow table for MS-Cache v2, but only for a specific user name; the table would not be applicable to hashes for other users. Therefore, such a table would make sense for a user name which is often found in many domains, namely "Administrator", but this is still of limited applicability. Cain & Abel pretends to include (since version 4.9.43) support for generating and using rainbow tables on MS-Cache v2 hashes, but, of course, for a single user name at a time.

If you only have one hash to crack, then building the table would take more time than brute force cracking (building a rainbow table which covers N possible passwords takes time about 1.7*N whereas brute force cracking has an average cost of about N/2, so the table is worth building only if trying to crack at least 4 hashed passwords, all with the same username in the case of MS-Cache v2).

I did not find freely available, already computed rainbow tables for MS-Cache v2 and username "Administrator".

---

MD4 is an ancestor to MD5 and maps very well to GPU (even better than MD5) so your four GPU should be able to try potential passwords by the billion(s) per second. The "jumbo" version of John the Ripper is documented to support MS-Cache v2 with GPU (under the name "MSCash2"), albeit with some inefficiencies on the password generation side (to hash one billion passwords per second, you have to generate one billion potential passwords per second, and that could starve the most well-intentioned CPU). At the very least, this will give you some source code to play with, and a "reference implementation" which would be handy for tests.

A quad-core Core2 2.4 GHz CPU, without any GPU at all, should be able to compute 80 millions of MD4 hashes per second, with SSE2-enhanced code (estimation from an implementation of mine which did 48 millions of SHA-1 hashes per second), translating to 40 millions of passwords per second. This is already quite good, by password cracking standards, although of course the GPU will be vastly more efficient. It would be a nice programming exercise.

Answer 3

A very good tool you should try is oclHashcat, which is a GPU only hash cracker, it works on Windows and Linux and supports multi-GPU as well.

There are two versions of this software which are useful for you, oclHashcat-lite which is a single hash cracker and oclHashcat-plus which can crack up to 15 million hashes at the same time.

For example, using the command line parameters which follows this line, you will bruteforce MS-CACHE 2 hashes which are kept in a specified file (example.hash) trying the lower_alpha_numeric charset. The cleartext will be saved into a file:

cudaHashcat-plus64.exe -o out.txt -a 3 -1 ?l?d -m 1100 --increment-min=1 example.hash

More information are available in the Wiki.

P.S.: Because this script uses the increment mode it will check up to 15 digits passwords (36^15).