0

I have a USB stick encrypted with LUKS + Ext4. I have forgotten the password...

However, I know which words will be included in the password and have a list of all permutations of those words. About 10,000 permutations.

Instead of me trying each and every permutation 1 by 1 manually (which will be a long, slow, and painfully tedious process), is it possible to automate this process? I know this sounds like some sort of malicious brute force attack, but it's not. If I wanted something like that, I could have easily downloaded some dodgy software from the internet.

Instead, I want to use something which is safe on my computer, a script (or any safe solution) which is custom built for me specifically.

Is this possible?

  • 3
    you just have to pipe it to cryptsetup luksOpen with the right syntax and note that (as written many times in the manual) when it's automated from stdin, you musn't include a trailing LF. – A.B Jan 21 at 19:30
2
+100

Well, in the most naive case you can roughly do something like

for a in 'fo' 'foo' 'fooo'
do
    for b in 'ba' 'bar' 'baar'
    do
        for c in 'bz' 'baz' 'bazz'
        do
            echo -n "$a$b$c" | cryptsetup open /dev/luks luks \
            && echo "'$a$b$c' is the winner!" \
            && break 3
        done
    done
done

and it goes through all the puzzle pieces ... foobarbz foobarbaz foobarbazz ... etc. in order. (If you have optional pieces, add '' empty string. If your pieces are in random order, well, think about it yourself).

To optimize performance, you can:

  • patch cryptsetup to keep reading passphrases from stdin (lukscrackplus on github for one such example but it's dated)
  • generate the complete list of words, split it into separate files, and run multiple such loops (one per core, perhaps even across multiple machines)
  • compile cryptsetup with a different/faster crypto backend (e.g. nettle instead of gcrypt), difference was huge last time I benchmarked it
  • find a different implementation meant to bruteforce LUKS

But it's probably pointless to optimize if you have either too little (can go through in a day w/o optimizing) or way too many possibilities (no amount of optimizing will be successful).

At the same time, check:

  • are you using the wrong keyboard layout?
  • is the LUKS header intact?

(with LUKS1 there is no way to know for sure, but if you hexdump -C it and there is no random data where it should be, no need to waste time then)

There's also a similar question here: https://security.stackexchange.com/q/128539

But if you're really able to narrow it down by a lot, the naive approach works too.

  • hexdump -C /dev/sdd returns a lot of data. Not sure where I am supposed to look for random data. – oshirowanen Jan 23 at 21:16
  • 1
    for reference, truncate -s 8M foobar.img; cryptsetup luksFormat foobar.img; hexdump -C foobar.img would show you what an intact header looks like (with nothing else on it). Where this has random data, your sdd would also have random data at the same address – frostschutz Jan 23 at 21:18
  • 1
    @frostschutz, thank you very much for your suggestions. Actually helped me find my passphrase! Added bounty just to say thank you, but unable to give it just yet, will have to wait 24 hours. – oshirowanen Jan 25 at 23:19
4

The most efficient way to perform this attack is to use John the Ripper's luks2john to extract the hash, and then attack it with John ('LUKS' hash format) or hashcat (hash mode 14600).

This has the advantage of scaling up to the number of cores (with either John CPU support or hashcat OpenCL CPU support) or the number of GPUs (with hashcat OpenCL GPU support) that you have.

It also takes advantage of any attack-side cryptographic efficiencies that are faster than using the native interface. These efficiencies can sometimes be dramatically faster than simply trying a normal unlock over and over again.

This also gives you the full suite of attack modes that those tools support (wordlist, rules, mask, hybrid, etc.).

1

Yes. I had almost this exact problem. I wrote a script that looped through all the possibilities until one worked. Mine was a truecrypt volume though. The only problem would be if there was some rate limiting but that would only be the case if you were passing off the check to a website or the like. With the volume in your possession it is relatively easy to do this.

But also this is very much brute forcing. You have just narrowed the choices to a small number so it won't be difficult to do.

  • Could you script be adapted to work with LUKS encrypted drives? Yes, I have the USB stick in my possession. – oshirowanen Jan 21 at 19:22
  • I'm not sure I even have the script anymore. But all you need to do is have the list of words, capitalization, order, whatever else you are changing and make a nested loop to run through them. Then you just need to be able to call the decryption command with the password. You should be able to do this with any scripting language: I used perl but python or bash would also probably be pretty easy. – user1794469 Jan 21 at 19:25
1

Yes, as previous answers, the hashcat is one of the best options. As the LUKS doesn't storage any hashes, we need to get an encrypted data sample (header) from your USB drive. We going to work on that sample only.

sudo dd if=/dev/{USB_LUKS_partition} of=/tmp/data_sample.luks bs=512 count=4079

Hashcat has many options to cracking a password, from straight bruteforcing to dictionary attacks, rule based attacks and mask attacks. In this scenario, we have password_candidates.txt:

hashcat -m 14600 -a 0 -w 3 /tmp/data_sample.luks password_candidates.txt

This should give you your password within seconds. G/L

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.