At some point during a penetration testing engagement, the assessor will gain access to hashes. Hashes are passwords with a one way function performed on the string value of the password. For example, the MD5 value of “password” is 5f4dcc3b5aa765d61d8327deb882cf99. Depending on the rules of engagement for the penetration test, password cracking is warranted and needed in order to gain additional footholds. Over time it was discovered that graphic cards could help perform these task at an accelerated speed due to their ability to do complex math problems with the GPU. When it was discovered that graphic cards could also help mine bitcoin, it became almost impossible to get a graphics card without being over charged. AWS eventually integrated EC2 instances with GPU attached. This now allows a user to perform password cracking on AWS.
Based on current AWS on-demand pricing (3/20/19):
- p3.16xlarge cost Only $24.48 per Hour
This could be an expensive bill, it you forgot it was running.That is where automation and Terraform comes into play. Terraform can quickly automate this process. This project is to help with the process of cracking passwords.
I’ve broken up the project into two parts. Part 1 is if you do not have an S3 bucket already. This will create an S3 bucket, upload your files, create an IAM user and group, and generate a credential to use in the EC2 instance.
Part 2, requires access to the S3 bucket to read in the wordlist for hashcat. The EC2 instance will do all the work and cat out the results.
Well enough talk, here is the repo:
https://github.com/lordsaibat/Cloud_crack
Got improvements? Submit a pull.
Happy password cracking!
