Locking Down Linux: Harden Sudo Passwords to Defend Against Hashcat Attacks « Null Byte :: WonderHowTo

Hacker's are always looking for new ways to exploit systems and exfiltrate passwords, even in hashed form. Sophisticated brute-force attacks powered by high-end GPUs can performmillions of password attempts per second. But Ubuntu and Debian users aren't completely helpless. There are ways to harden the hashed password to better defend againstHashcat attacks.Why Would an Attacker Steal My Sudo Password?Root privileges are usually required to access the /etc/shadow file in Ubuntu and Debian systems where hashed passwords are stored. An attacker extracting this data would suggest they already have root privileges. Root-level access could be acquired without knowing the target's password byexploiting the operating systemor physically exploiting the device.For example, Linuxkernel vulnerabilitiesare disclosed several times a year and never require knowing the target's password to gain a root shell. Likewise, the single-user mode feature is often abused toembed nefarious cronjobs. It can be configured with only a few minutes of physical access to the target device and doesn't require a password.Don't Miss:Steal Ubuntu & macOS Sudo Passwords Without Any CrackingIf an attacker has acquired root access by other means, why would they still need the sudo password? Well, there could be many reasons for this. The attacker may be trying to do one of the following.Pivot to other devices or services on the network, as well as learn the password scheme in use (e.g., Hunter321).Dump encrypted passwords stored in Chrome or Firefox browsers. These encrypted passwords are sometimes secured by the user's login password.Check for password reuse against popular social media and banking websites.Physically access the device to log in. If the attacker used single-user mode to extract the password hash, they may be trying to crack it to log in when the target device is unattended.There's really no telling how far an attacker can pivot with a single password that's been reused across accounts, websites, and network services.Don't Miss:Using Ubuntu as Your Primary OS (Network Attack Defense)How Debian & Ubuntu Securely Store PasswordsThe /etc/shadow file stores information about the target's password,salt,hashing algorithm, password expiration date, and so on. You can execute the belowgrepcommand using the$USERvariable, and the terminal will automatically search for the target's username in the /etc/shadow file.sudo grep $USER /etc/shadowtokyoneon:$6$oHP9lHDM$DyxrXl6U/t3A91eA4FWpc4n/Tn3tI.Cb1YRZT/p76kdcyTUiWTNMBDp1YrCFpJJtBRxfh71aGOZZHcXfY9qeN0:17762:0:99999:7:::The sections are separated by colons (:) as shown below. We'll be focusing on section 2. The other sections aren't relevant to defending againstHashcat(brute-force) attacks, so I'll skip over them for now.tokyoneon : $6$oHP9lHDM$DyxrXl6U/t3A91eA4FWpc4n/Tn3tI.Cb1YRZT/p76kdcyTUiWTNMBDp1YrCFpJJtBRxfh71aGOZZHcXfY9qeN0 : 17762 : 0 : 99999 : 7 :   :   :
----1-----|-----------------------------------------------------2----------------------------------------------|---3---|-4-|---5---|-6-|-7-|-8-|Section 2 is further separated by dollar signs ($) into three section.$6$oHP9lHDM$DyxrXl6U/t3A91eA4FWpc4n/Tn3tI.Cb1YRZT/p76kdcyTUiWTNMBDp1YrCFpJJtBRxfh71aGOZZHcXfY9qeN0
|1|----2---|---------------------------------------3----------------------------------------------|These sections consist of the hash type (1), salt (2), and hashed password (3). The6hash type indicatesSHA-512, but type5(SHA-256) is also common. Salts are random values used to help create strong, unique hashes. By today's standards, this hashed password is stored in a relatively secure form. But it can still become the subject of a targeted brute-force attack.Late-2018's EVGA GeForce RTX 2080 Ti GPU (Best for Password Cracking:): Buy fromAmazon|Best Buy|WalmartStep 1: Test the Hash Against HashcatOut of curiosity, I wanted to learn how many passwords a second Hashcat can perform against the above hash created in Ubuntu 18. This was tested with a genericNvidia GeForce GTX 1060 GPU. The GPU isn't high-end, but standard in many consumer desktops these days. It wouldn't be unreasonable to believe most hackers with dedicated password-cracking machines are capable of performing more computations per second with a superior GPU.hashcat -a 3 -m 1800 /tmp/password_hash.txt ?l?l?l?l?l?lhashcat (v5.1.0) starting...

OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: GeForce GTX 1060 3GB, 754/3018 MB allocatable, 9MCU

Session..........: hashcat
Status...........: Running
Hash.Type........: sha512crypt $6$, SHA512 (Unix)
Hash.Target......: $6$oHP9lHDM$DyxrXl6U/t3A91eA4FWpc4n/Tn3tI.Cb1YRZT/p...Y9qeN0
Time.Started.....: Tue Mar  5 02:25:23 2019 (15 secs)
Time.Estimated...: Tue Mar  5 03:36:19 2019 (1 hour, 10 mins)
Guess.Mask.......: ?l?l?l?l?l?l [6]
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 72631 H/s (403.13ms) @ Accel:1024 Loops:512 Thr:32 Vec:1
Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 884736/308915776 (0.29%)
Rejected.........: 0/884736 (0.00%)
Restore.Point....: 0/11881376 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:3-4 Iteration:3072-3584
Candidates.#1....: barier -> bjuhgi
Hardware.Mon.#1..: Temp: 62c Fan: 35% Util:100% Core:1847MHz Mem:3802MHz Bus:16

[s]tatus [p]ause [b]ypass [c]heckpoint [q]uit =>The above Hashcat command is performing aMask attack(-a 3) using the SHA-512 Unix hash type (-m 1800) with every possible six-letter lowercase (?l) combination. As we can see, it can perform 72,631 hashes per second (H/s). At this rate, it would only take one hour to try every six-letter combination of lowercase characters.And as we learned previously, six-character passwords are extremely common. At 72,600 H/s, cracking eight- and nine-character password hashes are very much within the realm of reality with a generic Nvidia GPU.Don't Miss:Crack Shadow Hashes After Getting Root on a Linux SystemStep 2: Harden the Password HashOf course, using a long and complex password would thwart most brute-force attacks. But let's take a different approach by increasing the hash's "SHA-rounds." SHA-rounds (better known asiterations) are used as a "slowdown factor," which essentially forces CPUs and GPUs to take significantly longer when computing a single password attempt. The higher this value is, the longer Hashcat will have to work to crack the hash.By default, Ubuntu and Debian use the SHA-512 crypt method with 5,000 SHA-rounds. As we see in the above Hashcat output, 5,000 SHA-rounds equates to almost 73,000 password attempts per second. Which isn't good news for Ubuntu and Debian users. Fortunately, the number of SHA-rounds can be manually increased to better defend against brute-force attacks. This can be done using thechpasswdcommand.Chpasswd, likepasswd, is a password management utility. It was designed to change many passwords in bulk while being able to specify the hash type and number SHA-rounds (among other things). To harden a password hash with chpasswd, use the below command.Warning (Read Before Proceeding):If your CPU is older than an Intel i3, don't use more than 750,000 SHA-rounds. Intel i7 users should not exceed 30,000,000 SHA-rounds. Significantly increasing this value can require a lot of CPU processing power and take minutes (maybe hours) to complete. Interrupting the command before it's finished could cause the system to become unstable. Use the below command with caution as setting the value too high can make it difficult to log in or break the system. Gradually increase the number of SHA-rounds if you wish to test the limitations of your CPU.sudo chpasswd -s 10000000 -c SHA512 <<< username:password; history -cThe above chpasswd command will use 10,000,000 SHA-rounds (-s) with the SHA-512 crypt method (-c). The<<<characters denote a string being used as the input data. In this case, the input is the username and desired password. To prevent the new password from appearing in the terminal history, append (;) thehistorycommand to clear (-c) it.Now,grepthe /etc/shadow file again to find a new section between the hash type and salt that readsrounds=10000000. This is an indication the chpasswd command was successful.sudo grep $USER /etc/shadowtokyoneon:$6$rounds=10000000$h6JNZ/CRSFfBbu$4ZcBt2md4dd3GsrL7jUv/269dMPP4k9PEQVbMOnThbRC3kFnOKIjHHDK3qg/kh1BNcPNU9EJtfggqPn4/8nSN0:17960:0:99999:7:::Step 3: Test Hashcat Against 10,000,000 SHA-RoundsLet's feed this new hash with 10,000,000 SHA-rounds into Hashcat and observe the number of password attempts it can perform.hashcat -a 3 -m 1800 /tmp/hardened_password_hash.txt ?l?l?l?l?l?lhashcat (v5.1.0) starting...

OpenCL Platform #1: NVIDIA Corporation
======================================
* Device #1: GeForce GTX 1060 3GB, 754/3018 MB allocatable, 9MCU

[s]tatus [p]ause [b]ypass [c]heckpoint [q]uit => s

Session..........: hashcat
Status...........: Running
Hash.Type........: sha512crypt $6$, SHA512 (Unix)
Hash.Target......: $6$rounds=10000000$cHi6OvAYRy$x8Z0kLn.JYAPOWQkH3RMy...2i3G30
Time.Started.....: Tue Mar  5 03:16:28 2019 (7 secs)
Time.Estimated...: Tue Jul 30 05:46:22 2019 (147 days, 1 hour)
Guess.Mask.......: ?l?l?l?l?l?l [6]
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:       24 H/s (410.36ms) @ Accel:1024 Loops:512 Thr:32 Vec:1
Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 0/308915776 (0.00%)
Rejected.........: 0/0 (0.00%)
Restore.Point....: 0/11881376 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:8704-9216
Candidates.#1....: sarier -> sjuhgi
Hardware.Mon.#1..: Temp: 56c Fan: 29% Util:100% Core:1873MHz Mem:3802MHz Bus:16

[s]tatus [p]ause [b]ypass [c]heckpoint [q]uit =>Only a mere 24 hashes per second can be guessed against this hardened hash, which can makeweak passwords like "zxcvbn"resilient against Hashcat, taking weeks to crack the hash.Conclusion: Pick an Appropriate SHA-Rounds ValueNow, this isn't a recommendation or argument to use weak passwords with 10,000,000 SHA-rounds. Reader's should increase the number of SHA-rounds in addition to using strong passwords. I'm using an absurdly high value in this article to demonstrate how far this kind of hardening can be taken. ButanySHA-rounds value over the default 5,000 will help defend against brute-force attacks. Even if only a little.SHA-round values anywhere over 1,000,000 will most likely make brute-forcing a completely insufficient attack vector. Higher values make it very difficult for an attacker on the system to learn the password. Increasing the SHA-rounds greatly diminishes the number of passwords per second Hashcat can perform.The major disadvantage to increasing the SHA-rounds is the amount of CPU processing required to execute a single sudo command or log in to the account. Higher SHA-rounds (e.g., 10,000,000) can take up to 10 seconds to compute a sudo command on a modern Intel i7 CPU. Older CPUs could take significantly longer. The trick is to find a sweet spot where it only takes about two seconds to compute the SHA-rounds. This way, brute-force attackers are still thwarted but it doesn't takeforeverto execute a single sudo command.If you enjoyed this article, follow me on Twitter@tokyoneon_andGitHubto keep with my current projects. For questions and concerns, leave a comment below or send me a tweet.Don't Miss:Using Ubuntu as Your Primary OS (Application Hardening & Sandboxing)Follow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo by tokyoneon/Null ByteRelatedHow To:Hack WPA WiFi Passwords by Cracking the WPS PINHow to Hack Wi-Fi:Cracking WPA2 Passwords Using the New PMKID Hashcat AttackHow To:Abuse Vulnerable Sudo Versions to Get RootHack Like a Pro:How to Crack Passwords, Part 3 (Using Hashcat)Hacking macOS:How to Hack a Mac Password Without Changing ItHow To:Use Hash-Identifier to Determine Hash Types for Password CrackingHow To:Hack 200 Online User Accounts in Less Than 2 Hours (From Sites Like Twitter, Reddit & Microsoft)How To:Hack WiFi Using a WPS Pixie Dust AttackHow To:Crack Shadow Hashes After Getting Root on a Linux SystemNews:'Beast' Cracks Billions of Passwords in SecondsHow to Hack Wi-Fi:Get Anyone's Wi-Fi Password Without Cracking Using WifiphisherHow To:Steal Ubuntu & MacOS Sudo Passwords Without Any CrackingHow to Hack Like a Pro:Getting Started with MetasploitHow to Hack Wi-Fi:Capturing WPA Passwords by Targeting Users with a Fluxion AttackHow To:Hack Wi-Fi Networks with BettercapHow To:Crack Password-Protected Microsoft Office Files, Including Word Docs & Excel SpreadsheetsHow To:Defend Yourself Against an Attacker with a KnifeHack Like a Pro:How to Crack Passwords, Part 2 (Cracking Strategy)How To:Extract Windows Usernames, Passwords, Wi-Fi Keys & Other User Credentials with LaZagneSecure Your Computer, Part 2:Password-Protect the GRUB Bootloader on Dual-Booted PCsHow To:How Hackers Steal Your Internet & How to Defend Against ItHow To:Get Packet Injection Capable Drivers in LinuxHow To:Make an Unbreakable Linux Password Using a SHA-2 Hash AlgorithmHow To:GPU Accelerate Cracking Passwords with HashcatHow To:Recover WinRAR and Zip PasswordsHow To:Get Free Wi-Fi from Hotels & MoreHow To:Create an SSH Tunnel Server and Client in LinuxHow To:Spy on the Web Traffic for Any Computers on Your Network: An Intro to ARP PoisoningNews:Complete Arch Linux Installation, Part 2: Graphical User Interface & PackagesHow To:Run Windows from Inside LinuxHow To:How Hackers Take Your Encrypted Passwords & Crack ThemHow To:Fix the Channel -1 Glitch in Airodump on the Latest KernelHow To:Recover Deleted Files in LinuxNews:Performance Hacks & Tweaks for LinuxNews:Cannot find windows loader after Linux install?Secure Your Computer, Part 1:Password-Protect your BIOS Boot ScreenHow To:Share Your Laptop's Wireless Internet with Ethernet DevicesHow To:Run a Free Web Server From Home on Windows or Linux with ApacheHow To:Use Wireshark to Steal Your Own Local PasswordsNews:Flaw in the Latest Linux Graphical Server Allows Passwordless Logins