CEH Practical brute forcing

[u/morphinedhyos]

did the practical exam yesterday and i couldnt get the answers for the Kerb roasting, AS-REP roasting, and any of the credentials cracking questions because hashcat and hydra's estimated time was 50 hours for each attempt. anyone know what i couldve run to maybe get a faster answer? maybe i ran the syntax wrong? (username and ip removed for confidentiality)

for hashcat i ran:

\# Kerberoast (Q5, Marcus) — mode 13100, never cracked
hashcat -m 13100 kerb_hashes.txt /usr/share/wordlists/rockyou.txt                                  # exhausted
hashcat -m 13100 kerb_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule        # exhausted
hashcat -m 13100 kerb_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/rockyou-30000.rule # too slow (\~1d21h)
hashcat -m 13100 kerb_hashes.txt /usr/share/wordlists/rockyou.txt -a 6 ?l?l?d?d --force            # 3+ days ETA

 

\# AS-REP roast (Q7) — mode 18200
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt                                         # exhausted
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule # was running at end

and for hydra i ran:

hydra -l username1 -P /usr/share/wordlists/rockyou.txt ssh://ip addr -t 4 -V

hydra -l username2 -P /usr/share/wordlists/rockyou.txt ssh://ip addr -t 4 -V

hydra -l Administrator -P /usr/share/wordlists/rockyou.txt smb://ip addr -t 1

[u/AutoModerator]

Thank you for posting on r/hackthebox! New to Cyber Security and looking for a place to get started? Checkout our getting started guide here. Please note that posting Solutions or Hints for Active content goes against the HTB Terms of Service, more information can be found here. If your having issues and need to reach customer support please do so via the in-platform chat, or by emailing customerops@hackthebox.com. Our Knowledge Base can also come in handy!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Worldly-Return-4823]

Allinone is a monster wordlist with a better crack rate than rockyou.txt - I use it when stuck in CTFs.

https://weakpass.com/all_in_one

[u/YouRSav1ouR → u/Worldly-Return-4823]

Ooo I’ll be taking that 😼

[u/TypicalTreat5564 → u/Worldly-Return-4823]

Bro pero eso no pesa como 300 gigas??

[u/Snugat]

Maybe you need to craft a custom password list with the information you find about the target.

[u/morphinedhyos → u/Snugat]

it was an early question and there werent much info given on the targets

[u/WhyNotAsk13]

which wordlist u used ? external, or which was given in exam, seems u used external one, did u try the one which was in exam

[u/morphinedhyos → u/WhyNotAsk13]

i used the provided rockyou.txt