Articles in this section

See more

How to connect Passware Kit Agent to Amazon EC2

Avatar
Yana Gourenko
  • Updated
Follow

Passware Kit Business and Passware Kit Forensic utilize Amazon Elastic Compute Cloud (EC2) – a highly scalable cloud computing platform for accelerated password recovery.

The following instructions will guide you through the process of setting up and connecting the Passware Kit Agent to Amazon EC2.

You will have to follow these instructions for the first set-up of your own Amazon instance. After you have set it up, you will not have to repeat these instructions to launch the instance in the future.

Choose from the instructions below, depending on your operating system:

 

Windows-Based AMI

Launching an Amazon Instance

  1. Create an Amazon Web Services account at: https://aws.amazon.com
  2. Sign in to your AWS account at: https://console.aws.amazon.com. The following start screen appears:
    01._AWS_Console_Welcome_screen.png

NOTE: Your account region affects how many instances of a particular type you may launch simultaneously. Refer to the “Limits” section at the “EC2 Management Console.” Make sure your desired instance is not limited there. The options in the top right corner will allow you to change your region.
07.1._Instances_limit.png

  1. Pick up the “Elastic Compute Cloud” service by either typing “EC2” in the search field or by clicking "All Services -> Compute -> EC2":
    02._Choose_EC2_service.png

  2. The “EC2 Management Console” page appears. Click "Launch Instance":
    03._EC2_Management_Console.png

  3. The “Step 1: Choose AMI” page appears:
    04._AMI_Selection_screen.png
    Choose any Windows-based AMI with GPU support. For example, choose "Microsoft Windows Server 2016 with NVIDIA GRID Driver." Then click "Select":
    05._Search_AMI_with_GPU.png

  4. Read the AMI description and pricing information carefully. Click "Continue":
    06._Prices_for_Selected_AMI.png

  5. The “Step 2: Choose Instance” page appears:07._Instance_Type_Selection_screen.png

Choose the required type of instance by filtering them by “GPU Graphics.” In our example, we choose "g3.4xlarge." (this instance is no longer available in EC2). Refer to Step 2 to check the limitations for this instance, based on your account region.

Click "Next: Configure Instance Details."

  1. The "Step 3: Configure Instance" page appears. Click "Advanced Details" and set up a password (authentication key) for your Passware Kit Agent in the "User Data" field. In our example we type "12345" as a password:
    08._Configure_Instance_screen.png

    Customize other settings if required. Click "Next: Add Storage."
  2. At the "Step 4: Add Storage" page, choose the settings you need or leave the default settings:
    09._Add_Storage_screen.png
    Click "Next: Add Tags."

  3. At the "Step 5: Add Tags" page, choose the settings you need or leave the default settings:
    10._Add_Tags_screen.png
    Click "Next: Configure Security Group."

  4. At the “Step 6: Configure Security Group" page, create a new group as displayed below:
    11._Configure_Security_Group_screen.png

Or, you can choose an existing group, instead. The group should have two rules: “RDP” and “Custom UDP Protocol” with port 10776 (before 2024v1 - 10555).

Click "Review and Launch."

  1. At the “Step 7: Review" page, make sure you have selected the proper instance type, the security group has rules for “RDP” and “UDP/10776,” and the "User Data" field in the “Instance Details” section is not empty. Below is an example of the correct settings:
    12._Review_Instance_Launch_screen.png

Click "Launch."

  1. For security reasons, set up a key pair. You can choose an existing pair or create a new one, as displayed below:
    13._Creating_key_pair.png

After you have created and downloaded the key pair or chosen an existing key pair, click "Launch Instances."

  1. The “Instance Launch Status” page appears:
    14.1._Instance_launch_result.png
    The result of the instance launch is displayed below:
    14._Instance_launch_process.png

  2. Go to "EC2 Management Console" and click “Instances.” Right-click on the running instance, select "Get Windows Password":
    15._Get_Windows_Password.png

Locate your Key Pair file:15.1._Choose_key.png


Click "Decrypt Password." Save the displayed fields: “Public DNS,” “User Name,” and “Password” for future reference:
15.2._Remember_password.png

 

Setting up the Passware Kit Agent on the Amazon Instance

  1. Using Remote Desktop Connection (RDP), connect to the running instance. Use “Public DNS,” displayed at the previous step, as a computer name:
    16._Connect_via_rdp.png
  2. Apply a GPU driver timeout patch as instructed at:
    https://support.passware.com/hc/en-us/articles/115013622267-GPU-driver-timeout-patch/
  3. Download a Windows version of Passware Kit Agent from:
    https://www.passware.com/distributed/free
  4. Install the Passware Kit Agent on the remote computer. Make sure to enable option "Start Passware Kit Agent when Windows starts," as displayed below:
    17._Install_PK_Agent.png

  5. Set a new system variable. Right-click on the Start menu, choose “System,” click “Advanced system settings | Environment Variables….” Below the “System variables” section, click
    “New…” and set “1” for variable “PASSWARE_AGENT_AMAZON_MODE,” as displayed below:
    18._Environment_variable.png

  6. Set an auto-login option. Right-click on the Start menu, choose “Run,” type "netplwiz," then click “OK.” The following window appears:19._User_Accounts.png
    At the "Users" tab, uncheck option "Users must enter a user name and password to use this computer," then click “OK.”

    At the "Automatically sign in" window, type the corresponding user account password:
    19.1._Provide_auto-login_credentials.png

 

  1. Shut down Windows and close the RDP connection.
  2. Go to "EC2 Management Console" and click “Instances.” Choose the stopped instance and start it by right-clicking the instance and choosing “Instance State | Start”:
    20._Launch_configured_instance.png
    Save "Public DNS (IPv4)" and "IPv4 Public IP" values from the “Description” tab below for future reference.

 

Running Passware Kit Forensic

  1. Run Passware Kit Forensic. At “Tools | Options | Hardware” enable option "Network and Amazon Cloud Units," then click "+ Amazon Unit." In the "Public IP" field, type the "Public DNS (IPv4)" or "IPv4 Public IP" value from the previous step. In the "Аuthentication Key" field, type the password from Step 8 of these instructions:
    21._Configure_Amazon_EC2_in_PK__new_design_.png
    Click "Add Unit," then “Save.”

NOTE: To avoid typing a new Amazon Agent IP each time you run an Amazon instance, you have the option to purchase a static IP address.

 

  1. Launch a password recovery process with Passware Kit. The Amazon Agent is displayed at the “Resources” tab:
    22._Connected_agent_in_resources.png
    The “Log” tab also displays the status of the Amazon Agent:
    22.1._Connected_agent_in_logs.png

  2. If you need to change the password for your Amazon instance, go to "EC2 Management Console," right-click on the required instance, stop it, then click "View/Change User Data":
    23.1._Change_user_data.png

Change the password and click “Save”:
23._Change_user_data.png

NOTE: After the instance is launched, you will be charged by Amazon. Make sure to stop the instance after the password is recovered or when you no longer need to run the Amazon Agent.

Linux-Based AMI

Launching an Amazon Instance

  1. Create an Amazon Web Services account at: https://aws.amazon.com
  2. Sign in to your AWS account at: https://console.aws.amazon.com. The following start screen appears:
    24.__AWS_Console_Welcome_screen.png

NOTE: Your account region affects how many instances of a particular type you may launch simultaneously. Refer to the “Limits” section at the “EC2 Management Console.” Make sure your desired instance is not limited there. The options in the top right corner will allow you to change your region.
30.1._Instances_limit.png

  1. Pick up the “Elastic Compute Cloud” service, either by typing “EC2” in the search field, or by clicking "All Services -> Compute -> EC2":25._Choose_EC2_service.png

  2. The “EC2 Management Console” page appears. Click "Launch Instance":26._EC2_Management_Console.png

  3. The “Step 1: Choose AMI” page appears:
    27._AMI_Selection_screen.png
    Choose any Linux-based AMI. For example, choose "Ubuntu 18.04 LTS – Bionic," then click "Select":
    28._Search_AMI_with_GPU.png

  4. Read the AMI description and pricing information carefully. Click "Continue":
    29._Prices_for_Selected_AMI.png

  5. The “Step 2: Choose Instance” page appears:30._Instance_Type_Selection_screen.png

Choose the required type of instance by filtering them by “GPU Graphics.” In our example, we choose "g3.4xlarge." (this instance is no longer available in EC2). Refer to Step 2 to check the limitations for this instance based on your account region.

Click "Next: Configure Instance Details."

  1. The "Step 3: Configure Instance" page appears. Click "Advanced Details" and set up a password (authentication key) for your Passware Kit Agent in the "User Data" field. In our example, we type "12345" as a password:
    31._Configure_Instance_screen.png
    Customize other settings if required. Click "Next: Add Storage."
  2. At the "Step 4: Add Storage" page, choose the settings you need or leave the default settings:
    32._Add_Storage_screen.pngClick "Next: Add Tags."

  3. At the "Step 5: Add Tags" page, choose the settings you need or leave the default settings:
    33._Add_Tags_screen.pngClick "Next: Configure Security Group."

  4. At the “Step 6: Configure Security Group" page, create a new group, as displayed below:
    34._Configure_Security_Group_screen.png

Or, you can choose an existing group, instead. The group should have two rules: “SSH” and “Custom UDP Protocol” with port 10776 (before 2024v1 - 10555).

Click "Review and Launch."

  1. At the “Step 7: Review" page, make sure you have selected the proper instance type, the security group has rules for “SSH” and “UDP/10776,” and the "User Data" field in the “Instance Details” section is not empty. Below is an example of the correct settings:
    35._Review_Instance_Launch_screen.png

Click "Launch."

  1. For security reasons, set up a key pair. You can choose an existing pair or create a new one, as displayed below:
    36._Choosing_existing_key_pair.png

After you have created and downloaded the key pair or chosen an existing key pair, click "Launch Instances."

  1. The “Instance Launch Status” page appears:
    37._Instance_launch_process.png
    The result of the instance launch is displayed below:
    37.1._Instance_launch_result.png

  2. Go to "EC2 Management Console" and click “Instances.” Right-click on the running instance, then select "Connect":
    38._Connect_to_instance.png

You can choose to connect with a Java SSH client directly from your browser, as displayed below:
38.1._Using_Java_SSH_Client.png
However, the following instructions refer to option “Standalone SSH Client” (Putty):
38.2._Using_Putty.png

Connecting to the Amazon Instance

  1. Download Putty from https://www.putty.org/ and install it on your computer.
  2. Run “puttygen.exe” from the Putty folder. Click “File | Load Private Key” and load the saved key from Step 13:
    39._Putty_key_generator.png
    Click “Save Private Key” in order to save the key in Putty format:
    39.1._Load_private_key_to_Putty_key_generator.png
  3. Run “pageant.exe” from the Putty folder. Add the key generated at the previous step:
    40.1._Add_key_to_Pagent.png
  4. Run “putty.exe” from the Putty folder. Type the Host Name from step 15:
    41._Connect_via_Putty.png

Click “Open.”

  1. Log into the system as "ubuntu":
    41.2._Login_as_ubuntu.png

NOTE: These instructions refer to Ubuntu commands. If you run a different Linux distributive, use the corresponding system-specific commands.


Setting up the Passware Kit Agent on the Amazon Instance

  1. Install GPU drivers by running the following commands:
     
    $ sudo apt-get update
    $ sudo apt install ubuntu-drivers-common ocl-icd-opencl-dev
    $ sudo ubuntu-drivers autoinstall
    $ sudo reboot
    After the system restarts, login again with SSH, as in Step 20.
  2. Download a Linux version of Passware Kit Agent from:
    https://www.passware.com/distributed/free/

The archive can be transferred to the instance by using the “pscp.exe” tool from the Putty folder. On the host computer, run the command:

$ pscp.exe passware-kit-agent-64bit.tar.gz ubuntu@<amazon_instance_public_ip>:/home/ubuntu/

Or, you can download the archive directly, instead. Run the following command:

$ wget https://demo.passware.com/files/passware-kit-agent-64bit.tar.gz

42._Download_agent.png

Extract the archive by running the command:

$ tar -xvzf passware-kit-agent-64bit.tar.gz

43._Unpack_downloaded_agent.png

  1. Copy the following files to “folder /home/user”:
     
    $ sudo mkdir -p /home/user
    $ sudo cp passware-kit-agent-64bit/passware-kit-agent /home/user/passware-kit-agent
    $ sudo cp passware-kit-agent-64bit/agent.conf /home/user/agent.conf
    $ sudo cp passware-kit-agent-64bit/agentwrapper.sh /home/user/agentwrapper.sh
    $ sudo /home/user/passware-kit-agent -l

Make sure Passware Kit Agent detects the GPU by running the following command:
"passware-kit-agent -l":

44._Check_GPU_support.png

If no GPU cards are listed, refer to Step 21 and make sure the drivers are installed correctly.

  1. Set up the Passware Kit Agent as a daemon:
$ sudo cp passware-kit-agent-64bit/init-debian.sh /etc/init.d/passware-kit-agent
$ sudo update-rc.d passware-kit-agent defaults

45._Copy_daemon_script.png

Set up the firewall rules (port before 2024v1 -10555):

$ sudo ufw enable
$ sudo ufw allow ssh
$ sudo ufw allow 10776/udp
$ sudo ufw status

46._Configure_firewall.png

 

  1. Set up the environment variable. Open file “/etc/environment” for editing:
     
    $ sudo vim /etc/environment

47._Configure_environment.png

Add record “PASSWARE_AGENT_AMAZON_MODE=1” as displayed below:
47.1._Set_amazon_mode.png

  1. Set up the core dump generation:
$ echo "core.%t.%e.%p" | sudo tee /proc/sys/kernel/core_pattern

47.1._Set_core_pattern.png

 

  1. If necessary, edit the configuration file of the Passware Kit Agent. Below are the instructions to create the simplest configuration file:
$ sudo mkdir -p /home/user/passware/settings
$ sudo mkdir -p /home/user/passware/tmp
$ sudo mkdir -p /home/user/passware/update
$ sudo vim /home/user/agent.conf

48._Configure_agent.png

In Vim Editor, replace the contents of the “agent.conf” file with the following text:

[General]
AgentSettingsFolder = ./passware/settings
LogsFolder = ./passware/tmp
UpdatesFolder = ./passware/update

[Network]
ConnectionMode = auto

48.1._Minimal_working_config.png

  1. Reboot the instance, either by running the SSH command "sudo reboot", or by going to "EC2 Management Console," clicking “Instances,” right-clicking the instance, and selecting “Instance State | Reboot”:
    49._Restart_instance.png

 

  1. Go to "EC2 Management Console" and  click “Instances.” Choose the stopped instance and start it by right-clicking the instance and choosing “Instance State | Start”:
    50._Instance_launched.png
    Save "Public DNS (IPv4)" and "IPv4 Public IP" values from the “Description” tab below for future reference.

 

Running Passware Kit Forensic

  1. Run Passware Kit Forensic. At “Tools | Options | Hardware” enable option "Network and Amazon Cloud Units" and click "+ Amazon Unit." In the "Public IP" field, type the "Public DNS (IPv4)" or "IPv4 Public IP" value from the previous step. In the "Аuthentication Key" field, type the password from Step 8 of these instructions:
    51._Configure_Amazon_EC2_in_PK__new_design_.png
    Click "Add Unit," then “Save.”

NOTE: To avoid typing a new Amazon Agent IP each time you run an Amazon instance, you have the option to purchase a static IP address.

  1. Launch a password recovery process with Passware Kit. The Amazon Agent is displayed at the “Resources” tab:
    52._Connected_agent_in_resources.png
    The “Log” tab also displays the status of the Amazon Agent.

  2. If you need to change the password for your Amazon instance, go to "EC2 Management Console," right-click the required instance, stop it, then click "View/Change User Data":
    53._Change_user_data.png

Change the password and click “Save”:
53.1._Change_user_data.png

NOTE: After the instance is launched, you will be charged by Amazon. Make sure to stop the instance after the password is recovered or when you no longer need to run the Amazon Agent.

Related articles

Comments

0 comments

Please sign in to leave a comment.