BySimon ~ Th, 2008.Filed under:Linux desktop applications, Windows applications.
5,896Views
This article is looking for the starting point of life (http://blog.cn-ic.org) original, if you need to reprint, please indicate the source, and retain the original link.
From the previous two articles (obtain valid methods for Windows XP administrator permissions, John/bkhive/samdump, and crack the Sam password in Linux)
It can be seen that I am interested in Windows system permissions. As the current oppression has not been overturned, the resistance continues. This article discusses how to use rainbow.
Another brute-force cracking mechanism combining table and ophcrack. The assumption here is that you have obtained encrypted hash. If you have no way to get the hash, please refer to the two mentioned above
Article.
To be honest, there are not many instructions on rainbow tables on Google. I believe that the most comprehensive explanation can be learned through this link. However, wiki is in English, unless there is a special need I have not planned to study carefully before. However, as far as I know, I want to explain the following:
Rainbow
Tables is a table that can be a combination of specified characters and a comparison table encrypted by MD5, lm, NTLM, and other encryption means. As you can imagine, these tables are quite large.
. When you get these tables, cracking the hash password is actually equivalent to dictionary cracking, and the speed of brute-force cracking is much higher than normal. Let me tell you the famous rainbow-based
How big is the table described in the help document of tables's open-source cracking software ophcrack:
Rainbow tables for LM passwords:
1. A table with a combination of all letters and numbers (1-7 digits) is divided into two alphanumeric
SSTIC04-10k (388 MB) And Alphanumeric
SSTIC04-5k (720 MB), I found that the two tables are consistent in the number of password combinations. But alphanumeric
SSTIC04-5k files more than doubled, if there is more than 1 GB of memory, the cracking speed 4 times faster (Why is there such a strange difference, not found ). They contain 80 billion hash entries,
Lm encryption is case-insensitive, so it can crack 2 ^ 83 1-14-bit lm passwords.
: Http://lasecwww.epfl.ch /~ Oechslin/projects/ophcrack/
2. lm extension table, containing all letters + numbers + 33 special characters (!" # $ % & '() * +,-./:; <=>? @ [\] ^ _ '{| }~) The 96%-1-7 combination of 7 trillion contains hash characters, which can crack 2 ^ 92 lm passwords. Size 7.5 GB
Get: no official download, you can buy a DVD through the ophcrack website, price $240, address: http://www.objectif-securite.ch/en/products.php
In addition, I found freerainbowtables.com BT download, known as bigger, 33.8g (http://www.freerainbowtables.com/tables/lm.php), or download the software generated by yourself (the generation method is described below ).
Rainbow tables for NTLM passwords:
1. NT hash table: A combination of 1-6 letters, numbers, 33 special characters, a combination of 7 letters, numbers, 8 lowercase letters, and characters. It contains 7 trillion hash characters, it can crack 7 trillion passwords. Size 8.5 GB
Get: there is no official download, you can buy a DVD through the ophcrack website, the size is described above 8.5g, price $240, address: http://www.objectif-securite.ch/en/products.php
You can also look at freerainbowtables.com (Address: http://www.freerainbowtables.com/tables/ntlm.php), there are a lot of options, the maximum of 1-9 lowercase letters + number combination has 123 GB, be careful with your disk.
From the above content, we can see that rainbow
Tables is huge. In fact, these things are just dictionary files in a sense. Of course, it is different from the traditional dictionary. It is a huge character encryption hash and character addition.
In the pre-Password comparison table, the corresponding cracking tool is used for comparison during the cracking process, saving the process of encrypting and calculating characters, thus greatly saving time.
If the obtained rainbow tables mentioned above is difficult or is not satisfied with their combination method, you can also generate it by yourself. Here is an open-source tool:
Rainbowcrack: http://www.antsight.com/zsl/rainbowcrack/the Author can be a lei Shuang Chinese.
Latest Version: rainbowcrack-1.2
Windowsbinary code (rainbowcrack-1.2-win.zip) and can be used on all platforms (source code for Windows/Linux/unix)((rainbowcrack-1.2-src.zip)
Provides custom composite characters,
Provides LM, MD5, sha1, and custom combination encryption methods. If a patch (algorithm patch for rainbowcrack 1.2) is added, it also provides NTLM, md2, md4 and ripemd160 encryption.Algorithm
If you want to use a tool to generate a large table, you need to be prepared and require strong CPU and large available disk space, and a large amount of time (using a single PC in years ). Therefore, some tables are available for download on the tool's homepage.
After talking about these tables for a long time, we only mentioned various rainbow tables. We also need a tool to use these tables. We recommend the well-known ophcrack here:
Home: http://ophcrack.sourceforge.net/
Latest Version: ophcrack-2.4.1,20.windowsbinary file package (ophcrack-win32-installer-2.4.1.exe) and source code (ophcrack-2.4.1.tar.gz) available for all platforms (such as Windows, Linux, and unix)
Using the software to crack requires two conditions
1. You need to provide rainbow tables.
2. requires that the hash of the password has been obtained, the method can refer to John/bkhive/samdump, in Linux to crack the Sam password, so the home page also provides a bkhive-1.1.1.tar.gz and samdump2-1.1.1.tar.gz.
In addition, ophcrack also provides a live CD, the latest version 1.2.2,: ophcrack-livecd-1.2.2.iso
Ophcrack-livecd is based on a small Linux system called slax6. The entire system includes slax6, ophcrack for Linux, and rainbow tables with small letters and numbers. Size 477 m
Therefore, you can start the attack without installing the CD.
Lm encryption and NTLM encryption for Windows passwords:
Lm is also called lanmanage. It is an ancient and fragile password encryption method for Windows. Any password with more than 7 characters is divided into seven parts, and the last password with less than 7 characters is
Use 0 to make up 7 digits, and then combine them into a hash through encryption. In fact, after cracking software decomposition, the LM password cracking limit is 7 bits, which makes today's PC computing speed shorter.
It is possible to crack the LM encrypted password (up to two weeks). If you use rainbow tables,
The time may be dropped to an hour. This fragile encryption method is still in use in Windows2003. Of course, we can also disable lm Encryption By setting registry parameters, replacing it
NTLM encryption (LM and NTLM encryption hash are generated by default). The method is as follows:
1. Open the Registry Editor;
2. Locate HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ LSA;
3. Select "edit" and "add value" from the menu ";
4. Enter lmcompatibilitylevel in the Value Name and the value type is DWORD. Click OK;
5. Double-click the new data and set the following values as needed:
0-Send LM and NTLM responses;
1-Send LM and NTLM responses;
2-only send NTLM response;
3-only send NTLMv2 response; (effective for Windows 2000)
4-only send NTLMv2 response and reject lm; (Windows 2000 is valid)
5-only send NTLMv2 response, deny LM and NTLM; (valid for Windows 2000)
6. Close the Registry Editor;
7. Restart the machine
The introduction of NTLM encryption in Windows NT SP3 and the gradual introduction of NTLM 2.0 encryption after Windows solve this problem, making it a luck to crack a password with a length of more than 8 characters in a short term. However, lm encryption is enabled by default, unless it is disabled by the above method.
Look for the starting point of life https://www.doorcome.com, If You Need To reprint please indicate the source
Tags:Linux, ophcrack, rainbow tables, Sam, Windows
Related Articles
Maximum access
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
