roycewilliams

Hashkiller-accepted format	Hashcat mode	MDXfind algo	John CPU	John GPU
IPB2+, MyBB1.2+	2811	MD5-MD5SALTMD5PASS	not supported?	not supported?
Joomla	11 / 400 ?	MD5PASSSALT	Dynamic_1 (len 1-23); Dynamic_2001 (len >23)	not supported
MD4	900	MD4	Raw-MD4	Raw-MD4-opencl
MD5	0	MD5	Raw-MD5	Raw-MD5-opencl
md5($pass.$salt)	10	MD5PASSSALT	Dynamic_2001; Dynamic_1016 (long salt)	not supported?
md5($pass.md5($salt))	not supported	MD5-PASS-MD5SALT	Dynamic_1011 ?	not supported?
md5($salt.$pass)	20	MD5SALTPASS	dynamic_4	not supported?
md5($salt.$pass.$salt)	3800	MD5SALTPASSSALT	dynamic_5	not supported?

roycewilliams

# hashcat benchmark for irongiant - 2017-10-13

# Format: aggregate table (sum of all devices)
# Devices: 6x NVIDIA 1080 Founders Edition
# Overclock: none
# Power limit: 150W (reduced from default 180W)
# hashcat version: v4.0.0rc4
# OS: Ubuntu 16.04 LTS
# NVIDIA driver: 375.66

roycewilliams

# hashcat benchmark for irongiant - 2017-10-13

# Format: default (each device shown separately)
# Devices: 6x NVIDIA 1080 Founders Edition
# Overclock: none
# Power limit: 150W (reduced from default 180W)
# hashcat version: v4.0.0rc4
# OS: Ubuntu 16.04 LTS
# NVIDIA driver: 375.66

roycewilliams

roycewilliams gist index

anchored/updated: 2020-05-24

hashcat-benchmarks (newest first)

• benchmark_hashcat-v5.1.0-1524-g4d286d5d_irongiant_2019-12-24.txt (power throttled 150W; just prior to release of 6.0.0)

  • https://gist.github.com/roycewilliams/cff5e962547513f830911936cec9dab9
  • Table summary format: https://gist.github.com/roycewilliams/41f09d1b01b14eb5b672b56572f3cf10

• benchmark_hashcat-v5.1.0-1387-gec987e68_irongiant_2019-08-18.txt (power NOT throttled)

roycewilliams

#!/bin/bash
#-----------------------------------------------------------------------

# Created: 2017-10-17
# License: MIT
# Author: tychotithonus

#-----------------------------------------------------------------------
# Get list of algorithms.

roycewilliams

Rough summary of developing BadRabbit info
------------------------------------------

BadRabbit is locally-self-propagating ransomware (ransom: 0.05 BTC), spreading via SMB once inside. 
Requires user interaction.
Mostly targeting Russia and Ukraine so far, with a few others (Germany, Turkey, Bulgaria, Montenegro ...) 
Not globally self-propagating, but could be inflicted on selected targets on purpose.
May be part of same group targeting Ukraine generally (BACKSWING) (per FireEye)
Confirmed to use ETERNALROMANCE exploit, and same source code and build chain as NotPetya (per Talos)
Mitigations are similar to Petya/NotPetya resistance. An inoculation is also available (see below).

roycewilliams

# hashcat benchmark for irongiant - 2017-10-27
# version 4.0.0 release - https://hashcat.net/forum/thread-6965-post-37159.html

# Format: default (each device shown separately)
# Devices: 6x NVIDIA 1080 Founders Edition
# Overclock: none
# Power limit: 150W (reduced from default 180W)
# hashcat version: v4.0.0
# OS: Ubuntu 16.04 LTS
# NVIDIA driver: 384.90

roycewilliams

# hashcat benchmark for irongiant (aggregate speed, sorted by speed) - 2017-10-27
# version 4.0.0 release - https://hashcat.net/forum/thread-6965-post-37159.html

# Format: default (each device shown separately)
# Devices: 6x NVIDIA 1080 Founders Edition
# Overclock: none
# Power limit: 150W (reduced from default 180W)
# hashcat version: v4.0.0
# OS: Ubuntu 16.04 LTS
# NVIDIA driver: 384.90

roycewilliams

#-----------------------------------------------------------------------
# same-quad-list.txt: a list of same-quad IPs by owner w/DNS status
#
# The CIDR network is the largest contiguous/bit-boundary-aligned block 
#  that is allocated to that entity (actual allocated range may be larger)
# NOTE: some ranges not yet converted to CIDR.
# Updates welcome - leave comment and/or ping [email protected]
#-----------------------------------------------------------------------
# For human efficiency, some records are repeated here as comments.
#

roycewilliams

# Based on scans.io / Rapid7 FDNS-ANY as of 2017-05
43fcc.gov-tyrm.pw,a,141.8.226.58
54fcc.gov-kuje.pw,a,141.8.226.58
70fcc.gov-omvc.pw,a,141.8.226.58
79fcc.gov-zdjg.pw,a,141.8.226.58
ach.fcc.gov,a,192.104.54.107
ach.fcc.gov,aaaa,2620:0:610:36::107
achadmin.fcc.gov,a,192.104.54.150
achadmin.fcc.gov,aaaa,2620:0:610:36::150
apigateway.fcc.gov,a,192.104.54.83