Hackers Beware

User Mary password #57adm7#

User Sue password sue

User Lucy password 12345

User Pat no password

User Tim password password

User Cathy password 55555

User Frank abcde

User Tom password mnopqr

User Karen password bbbbbbbb

Crack was run against this file on a 500Mhz Pentium with 128MB of RAM with the default options. It ran for approximately 150 seconds and cracked the following passwords:

---- passwords cracked as of Tue Aug 17 10:41:00 EDT 1999 ---

User Eric password eric - CRACKED

User John password john1234

User Mike password 5369421

User Mary password #57adm7#

User Sue password sue - CRACKED

User Lucy password 12345 - CRACKED

User Pat no password - CRACKED

User Tim password password - CRACKED

User Cathy password 55555 - CRACKED

User Frank abcde - CRACKED

User Tom password mnopqr

User Karen password bbbbbbbb – CRACKED

As you can see, Crack guessed eight of the passwords. All of the passwords that were guessed were simple words, repetitive characters, or strings of characters or numbers. It is interesting that abcde was cracked but mnopqr was not. Both are strings, but one started in the beginning of the alphabet and the other started in the middle. Also, john1234 was not cracked, which is a simple combination of two strings.

This is not a negative aspect of Crack, however it is important to understand the limitations of a program whenever you use it. Just because Crack didn’t guess a password does not mean that an attacker might not or that a given password is strong.

Also, it is important to note that these results are based on the standard configuration of Crack. Crack can be configured to guess additional passwords. One key characteristic of password crackers that use dictionary attacks is the quality of the dictionary they use. The old saying, “Garbage in, garbage out,” holds true, and a dictionary cracker is only as good as the dictionary that it uses. There are several sites on the Internet that contain dictionaries and you also can create your own. Also, depending on where your company is located, there are dictionaries that contain foreign words.

John the Ripper (John)

John the Ripper (John) is a UNIX password cracker, but can be run from either a UNIX or a Windows platform. It is available from http://www.openwall.com/john/. There are different versions that can be downloaded for each operating system. Both versions come with the source code, which is a nice feature. On the UNIX machine, the source code has to be compiled; but on Windows systems, John gives both the source files and the compiled binary. John is powerful and fast and has a lot of built-in features that are easy to use. These include dictionary and brute force attacks, which were covered in detail in Chapter 8, “Password Security.”

Latest Version of John

According to the documentation that came with John, the following are some of the new features included in the latest version, 1.6:

•Everything is re-coded to be more extendable, more portable (no GNU C extensions used, unless __GNUC__ is defined), and more readable.

•Support for running two hashes simultaneously.

•Bit slice DES routines: Up to three times faster on RISC.

•Initial attempt at vectorization support for bit slicing.

•BSDI’s extended DES-based ciphertext format support.

•OpenBSD’s Blowfish-based ciphertext format support.

•Special assembly DES routines for x86 with MMX: more than 30 percent on a Pentium II.

•Improved MD5 routines (both C and x86 assembly), 10 to 50 percent faster.

•Smarter length switching in incremental mode.

•Wordlist rules are now expanded while cracking, not at startup.

•New options -session and -groups.

•Simplified the syntax of -users, -shells, and -salts.

•Replaced -noname and -nohash with -savemem.

•Replaced -des and -md5 with -format.

•Removed some obsolete options to keep the thing simple.

•Added continue, break, return to the built-in compiler.

•Allows C comments in external mode definitions.

•Better default rule sets: variable length limit, less redundancy.

•System support for BSD and Linux distributions.

•Tested and make files for more versions of UNIX like Linux/PowerPC, FreeBSD/Alpha, and SCO.

•Many internal algorithm improvements.

•Fixed most of the bugs and portability issues.

John Requirements

John has versions that can run on either a UNIX or Windows platform, so each will be covered separately.

Using John with UNIX

The latest version has been tested on the following versions of UNIX:

•Linux x86/Alpha/Sparc

•FreeBSD x86

•OpenBSD x86

•Solaris 2.x Sparc/x86

•Digital UNIX

With UNIX, you only download the source code, so the following are the requirements that are needed to get it up and running:

•UNIX-like operating system.

•C compiler.

•Moderate amount of disk space (10MB).

•Lots of CPU time.

•Permission from the system administrator. You should always get permission and authorization before running these programs.

•Root privileges (if using shadow files).

•Uncompression program like gzip and tar.

John is not as large and computation intensive as Crack, but because it is cracking passwords, it can still use up a considerable amount of resources, depending on the size and difficulty of the passwords and the options that are used when running the program. Therefore, before you install John, make sure you have enough resources to compile and run it. If other departments are using the UNIX machine, please check with them prior to

running it. Otherwise, it could cause unnecessary issues if they are running critical applications.

Always get permission from the administrator and your supervisor before running this tool or any similar tool. I know I am repeating myself, but this point cannot be overemphasized. Especially if you do not own the machine, always make sure you check with the appropriate people prior to running it. With UNIX, you download a compressed tar file. To do so, follow these steps:

1.Download the John file.

2.Unzip the file using gzip:

3.

gunzip john-1_5_tar.gz

4. Untar the file:

5.

tar -xvf john-1_5_tar

6.Read the README and INSTALL documents.

7.If necessary, edit the source code.

8.Compile the program:

9.

10. cd src make

SYSTEM (where SYSTEM is the system type you will be compiling it on)

If everything works, the executable version will appear in the run directory.

Windows

The latest version of John can run on Windows NT/95/98 and DOS. With the Windows version, you download a zip file that contains the source code and the precompiled binaries. Based on this, the only system requirements are an uncompression program and enough disk space. Also, because this program is used to crack UNIX passwords, there must be some way that you can acquire the UNIX password file and transfer it to the Windows machine.

With Windows, after the program is downloaded and uncompressed, you cd to the run directory and you are ready to go, because the Windows version comes with a precompiled binary. If the user chooses to recompile or make any changes, the source code is in the src directory. To do this, the user needs a C compiler for the operating system he is working on.

Running John

Running John is straightforward. You just type john, followed by any options, followed by the password file. The following are some of the options that can be used with John:

•single. Cracks a single password file. This is the simplest and most straightforward method.

•wordlist:file. Enables John to use a dictionary file to crack the passwords.

•rules. Enables rules to be used that allow John to make changes in the dictionary words it uses to crack the passwords.

•incremental. Enables the incremental or brute force mode based on the parameters that are specified in the john.ini file.

•restore:file. Continues an interrupted session.

•session:file. Allows you to specify a filename where the session information is saved to.

•show. Shows the cracked passwords for the last session that was run.

•test. Performs some benchmark tests to make sure the system is working properly.

•users:[-]LOGIN|UID[,..]. Loads only a specific group of users or accounts. This allows you to filter out and only crack a few accounts. This is helpful if you have a couple of very sensitive accounts that you want to check more frequently.

•groups:[-]GID[,..]. Loads only specified groups into the system.

•salts:[-] count. Allows you to set a password per salt limit, which will achieve better performance.

John also comes with the following two utilities that are useful in some environments:

•unshadow PASSWORD-FILE SHADOW-FILE >output file. Used to combine the passwd and shadow files together for systems that use the shadow file. These files must be combined prior to running John.

•Mailer password-file. A script that sends email to all users who have weak passwords.

I recommend running John in the following order. First, run the following to see what passwords you crack:

john –single password-file john –show

Next, run a dictionary attack:

john –w:wordfile password-file john –show

If the passwords have still not been cracked, run a brute force attack:

edit john.ini file john –i password-file john –show

There are several other parameters you can use, but these are the most basic.

Results from Running John

When you run John, the results are displayed on the screen, but you can also type john –show to see the results again or save them to a file. To compare the accuracy of the results, let’s use the same password file we used for Crack. These results are based on running on a 500Mhz Pentium with 128MB of RAM.

After running john –single passfile, it completed in 10 seconds and cracked 2 passwords. The following is the output:

John the Ripper Version 1.5 Copyright (c) 1996-98 by Solar Designer

eric:eric:1001:10::/usr/eric:/bin/sh

sue:sue:1005:10::/usr/sue:/bin/sh

2 passwords cracked, 10 left

When running John with a dictionary file, by issuing the command john w:wordlist passfile, it ran in 120 seconds and cracked 5 passwords. The following is the output:

John the Ripper Version 1.5 Copyright (c) 1996-98 by Solar Designer

eric:eric:1001:10::/usr/eric:/bin/sh

sue:sue:1005:10::/usr/sue:/bin/sh

lucy:12345:1006:10::/usr/lucy:/bin/sh

tim:password:1009:10::/usr/tim:/bin/sh

frank:abcde:1011:10::/usr/frank:/bin/sh

5 passwords cracked, 7 left

With the -i option, which causes John to perform a brute force attack, John ran for several weeks and of course cracked all of the passwords, because that is what a brute force attack does.

XIT

XIT is a password cracker for UNIX that performs a dictionary attack and is available from http://neworder.box.sk/. It is a small but fast program. It does have limited functionality because it only can perform a dictionary attack, but in some environments you need a quick program that can check passwords. It runs in a DOS window on most Window platforms. It comes with the C source code, so if you want a better understanding of how cracking works or if you want to build your own password-cracking tool, this might be a good start. The source code is very well commented and fairly easy to port and recompile. I was able to get it compiled in a short period of time.

Latest Version of XIT

In this version, there are a couple of new enhancements:

•New SPACEBAR option to display status line. When the program is running, you can press the spacebar and it displays status information of how far along the program is.

•Can optimize the code for better performance.

•Full C documented source code of the main executable file.

As I stated earlier, this is not meant as a replacement for Crack, but I know in some environments, where a company wants to periodically check to make sure users are not using certain words as their passwords, this program is a good solution. If that is the case, this might be the right tool because it has less features and therefore is easier to use and uses less resources to run.

XIT Requirements

The requirements to run this program are very simple—all you need is a Windows machine and enough hard drive space to run the program. When the program runs, it expands some files, so it could have some difficulty running on a floppy, but if you have at least 5MB of disk space you should be fine. The only requirements you need are a dictionary file and a UNIX password file (with the encrypted passwords if you are using a shadow file). It does not have a utility to merge the passwd and shadow files together, so you either have to write one or use the one from John the Ripper or Crack.

Configuring XIT

To configure the program, you download the file xit2.zip and uncompress the 11 files into a directory. The following are the files that are contained in the zip file:

•XIT.BAT. Main batch file used to run the program.

•CRYPT.C. Module containing the crypt() and related functions.

•XIT.C. Main C module.

•PWD.H. Include file needed to compile the source.

•XIT.TXT. File containing general information on how the program works.

•X-PWD.EXE. Extracts encrypted passwords from passwd file.

•X-SORT.EXE. Sorts file generated by X-PWD.

•X-REP.EXE. Reports results generated by XIT*.EXE.

•XIT2.EXE. Main executable. All the encryption takes place in this module.

•XIT3.EXE. 386 version.

•FILES.TXT. A listing of the 11 files contained in the zip file.

Running XIT

To run the program, you call xit.bat, which is a bat file that calls the necessary files. The format is as follows:

xit passwordfile dictionary file

Remember that the password file has to contain the account information and the encrypted passwords. If your system uses a shadow file, it must be merged with the passwd file prior to running this system. The dictionary file is a text file that contains dictionary words. There are hundreds of dictionary files that can be downloaded off of the Internet.

The batch file performs the following steps:

1.Extracts all of the encrypted passwords from the input password files and saves them in a temporary file.

2.The temporary file is sorted to increase the cracking process. XIT does this by putting passwords that use the same salt next to each other.

3.Runs the cracker program xit.exe.

4.Creates a file called status that contains the statistics on the password cracking session. It also creates a file called report that shows which passwords were cracked and the plain text password.

Results from Running XIT

When you run XIT, the results are displayed on the screen, but they are also saved to two separate files: status and reports. To compare the

accuracy of the results, let’s use the same password file we used for Crack. These results are based on running XIT on a 500Mhz Pentium with 128MB of RAM.

When I ran XIT on this password file, it ran in 136 seconds and cracked 6 passwords. The following is the status file:

'CFWow5IYPyEHU' deCrypts as '12345' 'bY5CQKumRmv2g' deCrypts as 'abcde' 'T9ZsVMlmal6eA' deCrypts as 'eric' 'sXu5NbSPLNEAI' deCrypts as 'password' 'sXu5NbSPLNEAI' deCrypts as 'password' 'T9ZsVMlmal6eA' deCrypts as 'eric' 'XEsB/Eo9JCf6.' deCrypts as 'sue'

Total number of ecryptions made in this session : 481897 Total time elapsed : 136 seconds

Encryptions/second : 3543

Total number of passwords found: 7

The following are the results from the report file:

--------------------------------------------------------------

------------

When looking at the results, XIT only cracked five of the passwords. For some reason, it listed the Tim and Eric password twice. As you can see, XIT cracked dictionary words and strings of numbers. Anything that was in the dictionary file I gave it, XIT would have found. To make these results reproducible, I used the dictionary words-english that comes with the

L0phtcrack program. L0phtcrack is a password-cracking program for NT and words-english is just a listing of dictionary words.

Slurpie

Slurpie is a password cracker for UNIX that runs on a UNIX machine and can be downloaded from http://neworder.box.sk/. It can perform a dictionary attack and a customized brute force attack. With a customized brute force attack, you stipulate the number of characters and the type of characters you want it to use. For example, you can have Slurpie launch an attack that attempts to conduct a brute force attack on words that are between seven and eight characters in length and only uses lowercase letters.

The big advantage Slurpie has over John and Crack is that it can run in distributed mode. This means that if you have several machines that you want to use to crack passwords, Slurpie can coordinate between all of the machines to crack the passwords in less time than if one machine was used. It lets you use several computers to create a distributed virtual machine that can accomplish the tasks of cracking passwords in a much shorter period of time. For example, if you have four high-end computers, you could run Slurpie in distributed mode across the computers and have the power of a quad processor machine.

To do this, you set up a daemon on each of the machines and tell the main Slurpie program what machines they are on. It then connects to those machines and distributes the work between all of the machines to crack the passwords. Slurpie can also run on just one machine, but then you lose some of the benefits of the program. Running the daemon and the main program on the same machine is useful if you have want to use Slurpie, but you are not taking advantage of the distributed power of the program.

Latest Version of Slurpie

As of the writing of this book, the current version of Slurpie is version 2.0b, and in terms of functionality, it fits somewhere between XIT and John the Ripper. In terms of the distributed nature of how it works, it stands alone, because none of the other programs have this feature by default when the program is installed. In most environments, you have several machines that are idle or have minimal usage at night. Slurpie gives you an easy way to tap into these machines to get additional processing power.

Crack, the first program that we covered in this section, also can run in distributed mode, but it is not as easy or straightforward to configure as Slurpie. Crack uses a master system to remotely start clients, and