Jump to content


Active Members
  • Posts

  • Joined

  • Last visited

Recent Profile Visitors

The recent visitors block is disabled and is not being shown to other users.

6ftdan's Achievements


Newbie (1/14)

  1. Have a look at ArrayFire for Rust: https://github.com/arrayfire/arrayfire-rust . They have an examples directory there.
  2. Not yet. Currently it shells out work to the `aescrypt` command. To utilize the GPU I'll need to rewrite `aescrypt` in Rust. That is in the agenda but is a ways off for now.
  3. What are the tools you plan on doing this with? Does it need to be a script or would a programming language work? Do you know the length of the pin (in your example you gave it's 4)? If the pin is shorter then you only need to work about changing the end by that much (if I'm not mistaken). What you say about shifting by 3 and the next line doesn't make any sense without reasons for this handicap. For normal brute force character sequences their's a tool called crunch. For what you're asking for it's not that hard to write a little program.
  4. Python is the most adopted in general. It has a huge community and is much easier for beginners to learn. Ruby was made to make programmers happy so it's far more intuitive for writing code that just works. Metasploit uses Ruby so that's a security advantage to learning that. If you want to learn a systems language for writing exploits I'd recommend Rust. It's the lowest level language that won't give you segfaults. It's made to be as fast as C but without the hassle. Only thing is it's not a good “first language” and is very syntax heavy at first. Rust can be integrated with other languages and is probably the first language to have working WebAssembly generated from it. You can write Rust code and compile it to WebAssembly and that works natively in the web browser. Of course that depends on what you mean by exploit. There are systems that try to take advantage of people through the web and most of those are disabled (like Java and Flash) now in browsers, but JavaScript is here to stay. JavaScript is probably the worst language to learn first as there are many wrong things about the way the language works that can baffle the most well seasoned developers. Proof: https://www.destroyallsoftware.com/talks/wat
  5. New features added to my brute force decryption tool Abrute! A resume feature in case of power outages (saves place every 5 minutes). Workload chunk size option Computer cluster support Encrypted zip file support
  6. After 3 months of work I've released version 0.1 of Abrute. Abrute is a Multi-threaded AES brute force file decryption tool. It has much of the same character sequencer support that the crunch tool does. I've spent a good portion of my development time discovering and implementing sequence algorithms to shave off as many wasted CPU cycles as I can and I feel pretty good about it. The beauty of it is that it works. Now the computers I own only have 4 cores so I'm limited in the amount of processing power to get work loads done. I can say that with a finite amount of cores the workload goes up exponentially as the password length goes up. Also true for the longer a character set is to work with. I so want the new AMD Thread-Ripper with all its cores. My journey started with finding some of my old archived encrypted files and discovering I am unable to remember the password correctly. This led me to look for answers on Security/StackExchange. I went from creating a detailed question, as I was unable to find the answers I was looking for, and got a few small tips pointing me towards the tool known as crunch. I have answered my own question on the forum with many helpful ways I've tried to implement a solution to opening my AES encrypted files. That thread is here: https://security.stackexchange.com/questions/161592/how-to-brute-force-a-somewhat-remembered-aescrypt-password On that thread I first developed a likely word list with shuffling sequences, ordering, and generating plenty of output to test against. That didn't open the file for me but that code has already helped one other person open their encrypted file. Next I learned how to do the equivalent of multi-threading with only using Bash and xargs which will let you spin up parallel processes to run across all your cores. And that works well with crunch. But this was a bit crude as I had to let it run many weeks and could only check the progress by peeking into data being passed through Linux pipes. Not to mention a power outage had me lose a good chunk of progress. So yeah, I wanted to have something better. So I wrote Abrute. I ended up rewriting most of the crunch tool into my own sequencer with my algorithm improvements to save CPU cycles. And the attempts for decrypting are all calls to the aescrypt command for now. But the threading work is handled brilliantly (some one elses library) and at the moment I have Standard Out including progress. Over time I plan to write my own code for decrypting AES files and drop the need for the aescrypt executable. I also want to add GPU support for processing with ArrayFire but I first need to look into how feasible this is. Abrute works well on Mac and Linux and is untested on Windows (it shouldn't take too long to try it out on Windows). The commands are fairly straight forward and detailed in the help you get with -h. You can set the range of characters, character set, limit adjacent same characters, and start point. This uses your CPU cores at 100% so you'll likely need to do this work on a secondary system. I'm playing with the idea of divvying out the work to the cloud. You can rent an Amazon multi-core system for around 64 cores @ $3 to $5 an hour. So I can only imagine the performance gains from splitting the work across so many systems and system cores. Benchmarking is next for my project. I plan to have this program be one of those system benchmarks that everyone compares their computer by . I have some numbers from the original bash/crunch/xargs: At two character passwords I got about 35 passwords tried per second, at 3 character passwords I get about 12 passwords tried per second. At 8 characters with 4 cores a month isn't out of the question. So long passwords would be a long term commitment to try to crack unless you own Amazon or the like . I may never get my files open again. I have a tendency towards longer passwords. But this whole journey has been an amazing learning experience for me allowing me to sharpen many skills and develop many new ones. Anyway I hope you all find this tool useful. I'll get back to you with the newer benchmark numbers when I have them. Feel free to contribute to the project in any way. _I have enough details for you to get it running on a Docker image so cloud is already possible._ I'm just excited about it. Enjoy! ~6ftdan
  • Create New...