Rainbow Crackalack
Last updated
Last updated
If the database of NTLM password hashes for a Windows domain were obtained, the optimal strategy would be:
Use hashcat to brute-force all 1-7 character passwords (this can be done quickly).
Use hashcat to crack passwords based on rules (variable time).
Use rainbow tables to break complex 8-character passwords (a few hours).
Use rainbow tables to break complex 9-character passwords (a few days).
While brute-forcing 8-character passwords is very much possible with hashcat, it is inefficient to do so for smaller numbers of hashes:
As shown in the graph above, on a machine with a single NVIDIA RTX 2070 GPU, hashcat takes roughly 75 hours to brute-force one hundred 8-character NTLM passwords, whereas the Rainbow Crackalack software (with the NTLM-8 tables) achieves a 93% success rate in an hour and a half!
The following graph shows the cracking times for 9-character NTLM hashes:
The source code for table generation and lookup is available on Github. Pre-compiled executables for Windows are available as well.
NTLM 8-character tables can be downloaded for free via BitTorrent. These are 93% effective and are 486 GB in size.
NTLM 9-character tables can also be downloaded for free via BitTorrent. These are 50% effective and are 6.7 TB in size.
It's also interesting during the cracking process passing the hashes through OPHCrack.
Generate: LM:NT => LOAD
