No announcement yet.

Announcing KoreLogic's "Crack Me If You Can" Contest (Details Here)

  • Filter
  • Time
  • Show
Clear All
new posts

  • Announcing KoreLogic's "Crack Me If You Can" Contest (Details Here)

    The Basics:

    What: A password cracking contest sponsored by KoreLogic. (
    Where: DEFCON 2010 at the Riviera Casino in Las Vegas.
    When: Contest takes place July 29-31 and will last 48 hours. Exact start date/time to be announced.
    Who: Teams with at least one team member attending the conference.
    Why: To help push the envelope of password cracking techniques / methodologies and win a prize while you are at it. Prizes will be awarded for first, second, and third place.
    Contest URL: and

    The Details:


    As a part of an authorized penetration test of a large corporate network, you have captured a large number of passwords hashes. The hashes are from Active Directory, UNIX systems, LDAP servers, routers, etc. As part of your analysis, your client has asked for password complexity statistics, what their users are doing right and/or wrong related to generating passwords, and identification of weak passwords. You only have 48 hours to complete this effort.


    On Thursday, at a specified time, KoreLogic will release a file containing 53,000 password hashes. The file will contain passwords of varying types (such as SHA, SSHA, MD5, DES, Lanman, NTLM, etc.) and will range from being "easy" to extremely difficult to crack. The password file is not simply 53,000 randomly generated passwords which would favor the person or group with the most GPU/CPU bruteforcing horsepower. Instead, the password file contains passwords based on what we believe are challenging patterns. Passwords will be of varying lengths, patterns, and complexity. Creative password cracking techniques, rules, dictionaries, and tools will be needed. The teams who are smart about the methods they use (i.e., teams who can crack more, with less work) will most likely be the most successful.

    The goal of the contest is two-fold:

    1. To crack as many passwords as possible.
    2. To crack all the "administrative/root" passwords.

    The contest will be judged on a point system where:

    1. Each user password cracked earns 1 point.
    2. Each administrative password cracked earns 100 points.

    Teams must provide their results directly to KoreLogic prior to 11:59 PM (PDT), Saturday, July 31. (Details on how to submit TBD, but probably PGP-encrypted emails.)


    * You MAY use as many systems/cores/CPUs as you wish.
    * You MAY use systems NOT located at DEFCON.
    * You MAY work with other team members not attending DEFCON, as long as at least one team member is physically attending.
    * You MUST ONLY use systems that you are authorized to use.
    * You MUST NOT attempt to gain unauthorized access to any system used by KoreLogic or another team.
    * You MUST NOT attempt to interfere with the efforts of another team.
    * You MUST NOT attempt to steal passwords from or techniques/methods used by another team.
    * To be eligible for a prize, you MUST agree to share your techniques / methodologies and describe the resources/tools used to crack the passwords.
    * KoreLogic staff are not eligible for the contest.
    * The file containing the password hashes will not be released until the start of the contest.

    Any violation of the rules will result in immediate disqualification from the contest. Any illegal activity will be reported.


    KoreLogic staff will validate each submission and will announce the winning teams on Sunday, (time TBD). The team with the highest score will be the winner. If there is a tie in total points, the team that submitted their entry first will place higher.

    KoreLogic will present the winning team's results, which will include what passwords were cracked and what passwords were not. The winning team will be required to present their techniques/methodologies, describe the resources/tools used to crack the passwords, and describe any lessons learned (arrangements can be made for the camera-shy).

    At the conclusion of the contest, KoreLogic will:

    * Announce the winners and award the prizes.
    * Release the entire password list.
    * Provide statistics on which types of passwords were totally missed by all teams.
    * Provide statistics on which types of word lists were totally missed by all teams.
    * Release a number of word lists and John the Ripper rules under an open-source license. Taken together, these rules and word lists will be able to crack a majority of the 53,000 passwords.


    KoreLogic will be giving away the following prizes for first, second, and third place:

    * First Place: $600 (or equivalent item)
    * Second Place: $300 (or equivalent item)
    * Third Place: $100 (or equivalent item)

    Good luck!

    We will be announcing more details closer to the event. In the meantime, please contact with any questions
    Last edited by minga; June 17, 2010, 21:29.