|Team hashcat has won CMIYC 2015!||
Back to Top
As a part of authorized penetration tests of companies' internal corporate networks and external e-commerce websites, you have captured a large number of password hashes, and some encrypted files of various types. The hashes are from Active Directory, UNIX systems, LDAP servers, various web application and/or forums, routers, etc. As part of your analysis, your client has asked for password complexity statistics, what their users are doing right and/or wrong related to generating passwords, and identification of weak passwords. You only have 48 hours to complete this effort.
Prior to the start of the contest, KoreLogic will disseminate a set of files encrypted with a long random string as direct downloads, torrents, or both. Once the contest starts, KoreLogic will publish the decryption strings to unpack the files. This way, competitors can pre-download the contest files (some of which may be quite large) so that they are ready to go when the contest starts.
These will contain files of hashes of various types, and possibly also various encrypted files (challenges / hints). Hashes will be things like MD5, Salted MD5s, Blowfish, SHA1, SHA256, SSHA, DES, MD5(md5), NTLM, etc. Challenge files could be any kind of encrypted container file, or system OS image that you must figure out how to extract hashes from, etc.
The passwords will range from being "easy" to extremely difficult to crack. They are not simply randomly generated passwords, which would favor only the person or group with the most GPU/CPU bruteforcing horsepower. Instead, the password files contain passwords based on what we believe are challenging real-world patterns. Passwords will be of varying lengths, patterns, and complexity. Creative password cracking techniques, rules, dictionaries, and tools will be needed. The teams who are smart about the methods they use (i.e., teams who can crack more, with less work) will most likely be the most successful.
The goal of the contest is simple: score the most points.
Types of Teams:
You have 2 choices in choosing how you compete:
Points are earned by cracking hashes and submitting plaintexts. Slower, more difficult hash types are worth more points. For example, FreeBSD MD5 crypt hashes are worth more than UNIX DES; bcrypt (blowfish-based) are worth more than FreeBSD MD5. (However, the point-value ratios do not necessarily match the work-factor difference between the hash types.)
The points per hash type will be announced soon after the contest starts.
Teams are encouraged to pre-register. See the registration HOWTO for instructions on generating a PGP keypair and registering a team.
Teams must provide their results directly to KoreLogic at multiple intervals during the 48 hour contest window. See the submission HOWTO for details on how to submit.
For everyone competing, besides following the directions about how to register and submit:
Differences from the 2014 Contest:
Please note the following differences from the 2014 contest:
During the contest, KoreLogic will publish updated scores as often as possible.
After the contest ends, KoreLogic staff will validate each submission and will announce the winning teams on Sunday, (time TBD, but certainly before the DEFCON C&E Awards Ceremony). The eligible team with the highest score will be the winner. If there is a tie in total points, the team that submitted their entry first will place higher.
The teams with the most points will be required to write up their techniques / methodologies, describe the resources/tools used to crack the passwords, and describe any lessons learned, in order to be declared winners.
At the conclusion of the contest, KoreLogic will:
KoreLogic will be giving away the following prizes for first, second, and third place in the "Professional" Devision:
We will be announcing more details soon. In the meantime, please contact firstname.lastname@example.org with any questions.
|Please contact us if you would like more information about our services, tools, or careers with us.|