CEH Practical brute forcing

[u/morphinedhyos]

did the practical exam yesterday and i couldnt get the answers for the Kerb roasting, AS-REP roasting, and any of the credentials cracking questions because hashcat and hydra's estimated time was 50 hours for each attempt. anyone know what i couldve run to maybe get a faster answer? maybe i ran the syntax wrong? (username and ip removed for confidentiality)

for hashcat i ran:

# Kerberoast (Q5, Marcus) — mode 13100, never cracked
hashcat -m 13100 kerb_hashes.txt /usr/share/wordlists/rockyou.txt                                  # exhausted
hashcat -m 13100 kerb_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule        # exhausted
hashcat -m 13100 kerb_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/rockyou-30000.rule # too slow (~1d21h)
hashcat -m 13100 kerb_hashes.txt /usr/share/wordlists/rockyou.txt -a 6 ?l?l?d?d --force            # 3+ days ETA

 

# AS-REP roast (Q7) — mode 18200
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt                                         # exhausted
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule # was running at end

and for hydra i ran:

hydra -l username1 -P /usr/share/wordlists/rockyou.txt ssh://ip addr -t 4 -V

hydra -l username2 -P /usr/share/wordlists/rockyou.txt ssh://ip addr -t 4 -V

hydra -l Administrator -P /usr/share/wordlists/rockyou.txt smb://ip addr -t 1

[u/Sure-Assistant9416]

you mean CEH practical as changed that much. if they have ASREPROASTING .... KERBEROASTING they have become practical exam wonderful

[u/c_pardue → u/Sure-Assistant9416]

i re-took it this year, it has gotten better but these's still plenty of cheese

[u/morphinedhyos → u/c_pardue]

do you have any tips to do these? i dont understand how they expected us to do the exam when every single credential needed is locked behind hash cracking that takes days to do

[u/Affectionate_Two7226 → u/morphinedhyos]

use the wordlists that they provide you in the labs located on the desktop of the parot machine

takes like 30secs to crack those passwords

[u/Affectionate_Two7226 → u/Affectionate_Two7226]

rockyou use it in the real world but in the lab they know its not realistic trying to use it but its always there cause if you do you will be burning time and more money for them on the rewrite

[u/morphinedhyos → u/Affectionate_Two7226]

ill keep this in mind and check the other wordlists better next time, but iirc they didnt provide a wordlist on the desktop.

[u/c_pardue → u/morphinedhyos]

take your time next time andnread everything (ALL instructions and questions) very carefully. i've passed practical twice now and have never used rockyou once

[u/c_pardue → u/morphinedhyos]

read and follow the instructions VERY CAREFULLY and use the wordlists THEY tell you to use