1. Password Cracking
Lesson 10

2. Why crack passwords?

3. Where are the passwords stored?
In the security database in NT. Sometimes referred to as the SAM (security account manager).
In \Windows-directory\system32\config\SAM
File is usually world readable, however it is not accessible when the system is running because it is locked by the system kernel.
Copy of it may usually be found in Windows-directory\repair\SAM._
(rdisk run with /s argument)
then expand it
expand sam._ sam
For UNIX/Linux, passwords stored in /etc/passwd or /etc/shadow.
Passwords should always be stored in encrypted format, why?
What are the steps then in validating a correct password?

4. NT Password cracking
SAM file has two separately hashed versions of the password -- the LanMan version and the NT version.
LanMan is the weak method and can easily be cracked. It separates the password into two 7 character parts. Thus you really only have to crack two separate 7 character passwords instead of a 14 character password.
It also converts lower case characters to upper case.
Because of poor hashing technique, for NT, a 10 character password is actually potentially less secure than a 7 character
the second half (last 3 characters) will quickly be cracked and then may provide clue for first part, ex: *******890

5. So what’s the problem with splitting it in two?
Let’s assume lower case characters and numbers only (thus 36 possibilities). If the password can be only 7 characters then
(36 Characters) 7 characters in length = 7.8X1010 choices
If we instead had 14 character passwords
(36 Characters) 14 characters in length = 6.1X1021 choices
Or, if split in two 2* (7.8X1010)=1.56X1011 choices

6. (cont) If I can try 1,000,000,000 passwords per day:
With two 7 character passwords it would take 156 days to crack any password
With one 14 character password it would take 6.1X1012 days or 1.67X1010 years to crack any password.

7. Salts
Another issue with NT passwords is the fact that “salts” are not used.
A salt is a random string that is combined with a password before it is encrypted.
Used because two people who have the same password would normally have them encrypted to the same value.
When the user enters a new password, the system first combines the password with the salt and then computes the hashed value.
The system stores both the hash and the salt with the ID
When a user attempts to authenticate, the system looks up the salt, combines it with the password entered, hashes it, then compares it with the stored value.
Without a salt, the hacker only has to compute the hash once for any given password and then compare it with the stored values.

8. Programs to crack NT passwords
L0phtcrack
NTSweep
NTCrack

9. UNIX password cracking
Generally harder than NT to crack.
3-step process used by cracking programs
create file of possible passwords (dictionary file)
Encrypt file of possible passwords
Compare results with encrypted form of passwords
Obvious why it is harder to guess if you don’t use simple words. Dictionary created must include combinations of words with various connectors
There are different dictionaries for different environments/countries.

10. UNIX Password Encryption
UNIX uses an encryption algorithm called crypt to encrypt passwords.
Crypt is a hash algorithm that performs a one-way transformation.
There is thus no way to decrypt a password that has been encrypted with crypt
Each encrypted password is 11 characters and is combined with a 2-character salt.

11. UNIX Password Crackers
John the Ripper
XIT
Slurpie

12. Comparison of NT crackers

13. Comparison of UNIX crackers

14. Passwords Cracked

15. Success based on… Password cracker’s ability Dictionary chosen
Rules selected

16. Where can I go to get a cracker?

17. Protecting against Cracking
Have a good password policy
Change them on regular basis (how regular?)
Lock account after 3 failed attempts
Password should contain 1 alpha, 1 number, and one special character.
Don’t allow users to reuse previous (5?) passwords.
Password should not be word found in a dictionary. -Consider using pass-phrase.
Consider use of one-time passwords (most common form is smart-card).

18. Password Cracking Lab
Two password files, one for Windows NT, one for Unix.
Linux shadow file
Windows NT Sam file
Needed to locate, choose, and download password crackers
Needed to install programs and let them run
You will probably did not get all of the passwords cracked.