BitCracker First Open Source Password Cracking Tool For BitLocker

BitCracker First Open Source Password Cracking Tool For BitLocker

BitCracker is the first open source password cracking tool for memory units encrypted with BitLocker (using the password authentication method).

BitLocker (formerly BitLocker Drive Encryption) is a full-disk encryption feature available in recent Windows versions (Ultimate and Enterprise editions of Windows Vista and Windows 7, the Pro and Enterprise editions of Windows 8, 8.1 and 10). BitCracker is a mono-GPU (OpenCL and CUDA) password cracking tool for memory units encrypted with the password authentication method of BitLocker.



The tool has been tested on several memory units encrypted with BitLocker running on Windows 7, Window 8.1, Windows 10 (compatible and no-compatible mode) and BitLocker To Go.

Requirements

Minimum requirements for CUDA implementation:

• CUDA 7.5
• NVIDIA GPU with CC 3.5 or later
• NVIDIA GPU with Kepler architecture or later

How To

Use the build.sh script to build 3 executables:

• Hash extractor
• BitCracker CUDA version
• BitCracker OpenCL version

Before starting the attack, you need to run bitcracker_hash to extract the hash describing the encrypted memory unit. It also verifies if the input memory unit satisfies BitCracker's requirements.

> ./build/bitcracker_hash -h

Usage: 

./build/bitcracker_hash -i <Encrypted memory unit> -o <output file>

Options:

  -h, --helpShow this help
  -i, --imagePath of memory unit encrypted with BitLocker
  -o, --outfileOutput file

The extracted hash is fully compatible with the John The Ripper format (see next Section).

Then you can use the output hash file to run the BitCracker attack.

> ./build/bitcracker_cuda -h

Usage: 

./build/bitcracker_cuda -f <hash_file> -d <dictionary_file>

Options:

  -h, --help  Show this help
  -f, --hashfile Path to your input hash file (HashExtractor output)
  -s, --strictStrict check (use only in case of false positives)
  -d, --dictionary Path to dictionary or alphabet file
  -g, --gpu    GPU device number
  -t, --passthread Set the number of password per thread threads
  -b, --blocks   Set the number of blocks

Note: In case of false positives you can use the -s option, that is a more restrictive check on the correctness of the final result. Altough this check is empirically verified and it works with all the encrypted images in this repo, we can't guarantee that it doesn't lead to false negatives.

Use -s option only if BitCracker returns several false positives.

In the the run_test.sh script there are several attack examples using the encrypted images provided in this repo:

• imgWin7: memory unit encrypted with BitLocker using Windows 7 Enteprise edition OS
• imgWin8: memory unit encrypted with BitLocker using Windows 8 Enteprise edition OS
• imgWin10Compatible.vhd: memory unit encrypted with BitLocker (compatible mode) using Windows 10 Enteprise edition OS,
• imgWin10NotCompatible.vhd: memory unit encrypted with BitLocker (not compatible mode) using Windows 10 Enteprise edition OS,
• imgWin10NotCompatibleLong27.vhd: memory unit encrypted with BitLocker (not compatible mode) using Windows 10 Enteprise edition OS with the longest possible password (27 characters)

BitCracker doesn't provide any mask attack, cache mechanism or smart dictionary creation; therefore you need to provide your own input dictionary.

Download