Author: Joe Testa (@therealjoetesta)
This project produces open-source code to generate rainbow tables as well as use them to look up password hashes. While the current release only supports NTLM, future releases may support MD5, SHA-1, SHA-256, and possibly more. Both Linux and Windows are supported!
For more information, see the project website: https://www.rainbowcrackalack.com/
Most of the speed work here started from bandrel's fork (https://github.com/bandrel/rainbowcrackalack). He's been doing great work on optimizations for this project.
- Table preloading is multi-threaded. Was single threaded with a hardcoded 2 table window, now it's a pool of readers and the window scales with RAM. Roughly 5.5x faster end to end.
- False alarm checks are batched across tables instead of one dispatch per table, and sorted by chain position first so a work group isn't running at the speed of its longest walk. Ported from bandrel.
- Net-NTLMv1 has specialized precompute and false alarm kernels, ported from bandrel. Gated on the standard set (byte, 7-7, 881689) the same way the NTLM8/9 kernels are. Precompute is about 28x faster, false alarm checks about 60x with the batching on top.
- Precompute runs every hash in one dispatch instead of one at a time, split across all GPUs. Output is byte identical to the old path and added a test for it.
- CUDA backend now has CI coverage. tests/cuda_stub fakes the driver so the host side runs without a GPU. Added a 64 table lookup suite and a check that batched and unbatched precompute produce identical cache files.
- New options:
-fa-batch,-precompute-batch,-precompute-gws, plusRCRACK_LOAD_THREADSandMAX_PRELOAD_NUMenv vars. - The precalc cache is read from the current directory, not the table directory, and a hash's precalc gets deleted once it cracks.
NTLM 8-character tables (93% effective) are available for free download via Bittorrent.
NTLM 9-character tables (50% effective) are available for free download via Bittorrent.
For convenience, the tables may also be purchased on a USB 3.0 external hard drive.
The following command shows how to generate a standard 9-character NTLM table:
# ./crackalack_gen ntlm ascii-32-95 9 9 0 803000 67108864 0
The arguments are designed to be comparable to those of the original (and now closed-source) rainbow crack tools. In order, they mean:
| Argument | Meaning |
|---|---|
| ntlm | The hash algorithm to use. Currently only "ntlm" is supported. |
| ascii-32-95 | The character set to use. This effectively means "all available characters on the US keyboard". |
| 9 | The minimum plaintext character length. |
| 9 | The maximum plaintext character length. |
| 0 | The reduction index. Not used under standard conditions. |
| 803000 | The chain length for a single rainbow chain. |
| 67108864 | The number of chains per table (= 64M) |
| 0 | The table part index. Keep all other args the same, and increment this field to generate a single set of tables. |
The following command shows how to look up a file of NTLM hashes (one per line) against the NTLM 8-character tables:
# ./crackalack_lookup /export/ntlm8_tables/ /home/user/hashes.txt
The NVIDIA GTX & RTX lines of GPU hardware has been well-tested with the Rainbow Crackalack software, and offer an excellent price/performance ratio. Specifically, the GTX 1660 Ti or RTX 2060 are the best choices for building a new cracking machine. This document contains the raw data that backs this recommendation.
However, other modern equipment can work just fine, so you don't necessarily need to purchase something new. The NVIDIA GTX and AMD Vega product lines are still quite useful for cracking!
A 64-bit Windows build can be achieved on an Ubuntu host machine by installing the following prerequisites:
# apt install mingw-w64 opencl-headers libgcrypt-mingw-w64-dev
RAR-compressed rainbow table support is disabled on Windows builds, since Ubuntu has no MinGW build of libunrar. Reading a .rar table then reports a clear error; every other feature is unaffected. If you cross-compile libunrar yourself, enable it with make windows UNRAR=1.
Then starting the build with:
# make clean; make windows
However, if you prefer to build a complete package (which is useful for testing on other Windows machines), run:
# 7z a windows-build.7z *.exe *.dll CL shared.h
A 64-bit build can be achieved on an Ubuntu host machine by installing the following prerequisites:
# apt install opencl-c-headers libgcrypt20-dev
For RAR-compressed rainbow table support (on by default):
# apt install libunrar-dev
To build without it, use make linux UNRAR=0.
Then starting the build with:
# make clean; make linux
- Improved speed of NTLM9 precomputation by 9.5x and false alarm checks by 4.5x!
- Fixed lookup on AMD ROCm.
- Added support for pwdump-formatted hash files.
- Added time estimates for precomputation phase.
- Disable Intel GPUs when found on systems with AMD or NVIDIA GPUs.
- Fixed bug in counting tables during lookup.
- Fixed bug where lookups would continue even though all hashes were cracked.
- Fixed cache lookup when a single hash in uppercase was provided.
- Added lookup colors.
- Lookup tables are now pre-loaded in parallel to binary searching & false alarm checking, resulting in 30-40% speed improvement (!).
- Massive speed improvements (credit Steve Thomas).
- Finalization of NTLM9 spec.
- Various bugfixes.
- Initial revision.