Back to Top

The Details:


Scenario:

As a part of an authorized penetration test of a large corporate network, you have captured a large number of password hashes. The hashes are from Active Directory, UNIX systems, LDAP servers, routers, etc. As part of your analysis, your client has asked for password complexity statistics, what their users are doing right and/or wrong related to generating passwords, and identification of weak passwords. You only have 48 hours to complete this effort.

Logistics:

On Thursday, at 11:59 PM DEFCON time (US/Pacific), KoreLogic will release a file containing 53,000+ password hashes. The file will contain passwords of varying types (such as SHA, SSHA, MD5, DES, Lanman, NTLM, etc.) and will range from being "easy" to extremely difficult to crack. The password file is not simply 53,000 randomly generated passwords which would favor the person or group with the most GPU/CPU bruteforcing horsepower. Instead, the password file contains passwords based on what we believe are challenging patterns. Passwords will be of varying lengths, patterns, and complexity. Creative password cracking techniques, rules, dictionaries, and tools will be needed. The teams who are smart about the methods they use (i.e., teams who can crack more, with less work) will most likely be the most successful.

The goal of the contest is twofold:

1. To crack as many passwords as possible.
   
2. To crack all the "administrative/root" passwords.
   

The contest will be judged on a point system where:

1. Each user password cracked earns 1 point.
   
2. Each administrative password cracked earns 100 points.
   

Teams must provide their results directly to KoreLogic prior to 11:59 PM (PDT), Saturday, July 31. (See the HOWTO for details on how to submit.)

Rules:

• You MAY use as many systems/cores/CPUs as you wish.
  
• You MAY use systems NOT located at DEFCON.
  
• You MAY work with other team members not attending DEFCON, as long as at least one team member is physically attending.
  
• You MUST ONLY use systems that you are authorized to use.
  
• You MUST NOT attempt to gain unauthorized access to any system used by KoreLogic or another team.
  
• You MUST NOT attempt to interfere with the efforts of another team.
  
• You MUST NOT attempt to steal passwords from or techniques/methods used by another team.
  
• To be eligible for a prize, you MUST agree to share your techniques / methodologies and describe the resources/tools used to crack the passwords.
  
• KoreLogic staff are not eligible for the contest.
  
• The file containing the password hashes will not be released until the start of the contest.
  

Any violation of the rules will result in immediate disqualification from the contest. Any illegal activity will be reported.

Results:

KoreLogic staff will validate each submission and will announce the winning teams on Sunday, (time TBD). The team with the highest score will be the winner. If there is a tie in total points, the team that submitted their entry first will place higher.

KoreLogic will present the winning team's results, which will include what passwords were cracked and what passwords were not. The winning team will be required to present their techniques/methodologies, describe the resources/tools used to crack the passwords, and describe any lessons learned (arrangements can be made for the camera-shy).

At the conclusion of the contest, KoreLogic will:

• Announce the winners and award the prizes.
  
• Release the entire password list.
  
• Provide statistics on which types of passwords were totally missed by all teams.
  
• Provide statistics on which types of word lists were totally missed by all teams.
  
• Release a number of word lists and John the Ripper rules under an open-source license. Taken together, these rules and word lists will be able to crack a majority of the 53,000 passwords.
  

Prizes:

KoreLogic will be giving away the following prizes for first, second, and third place:

• First Place: $600 (or equivalent item)
  
• Second Place: $300 (or equivalent item)
  
• Third Place: $100 (or equivalent item)
  

Good luck!

We will be announcing more details once the event starts. In the meantime, please contact defcon-2010-contest@korelogic.com with any questions (PGP key)