Web-based NT & Win2k password cracker !

Thought I would take a sec and drop a note here.

My buddy Morlock just finished up something that ya'll might be really interested in.

An NT and Win2k password cracking app that is 1,000's faster than l0phtcrack.

There will be a press-release sometime today (Monday), if not then definately Tuesday. The technology behind this is quite amazing and is something that he has been working on for quite a while. The concept / technology is quite dynamic and we can port it to almost all encryption / hash technology.

Preliminary testing shows that it retrieves over 1,000 passwords in less than 30 seconds.. That doesn't mean that it ONLY checks for 1,000 passwords... That means it actually is RETRIEVING over 1,000 passwords in under 30 seconds... Some modifications over the next week should decrease this time by 30%.

There is nothing like it. - A little Wizardy is what Morlock calls it. ;-)

You can check it out here. www.sec33.com/modules.php?name=IPC

Take a look and let us know how it works out for ya.

Kelvin:// - [email protected]

1000 times faster than l0phtcrack? Erm..... On equivalent equipment?
On what hardware is this running? Is this seemingly-too-good-to-be-true process based on software or hardware? It just seems a bit grandiose to be real.

Hardware is standard. The technology IS software based and that is about the extent that Morlock wants me to say (It's his baby).

Optimization is definately a factor here. And believe it or not, it is just blistering fast.

Kelvin:// - If you happen to have 1,000 lines of MS hashes, or as many as you can throw together. Give it a shot.

We have limited the capabilities of the application for security reasons... We want to demonstrate the lack of time for brute-force now, not to destroy passwords that were intended to be strong. We will be thinking of a way to release the app to its full extent soon.

Kelvin://

hmm.. i would rather think if this app shouldnt go out in the open.. i mean.. if it is what u said it is.. then its a big security risk..

i'd say, make the access of this app "exclusive"...

Seems like a anti-security program to me... Only real good place I can think of here is a admin locked him/herself out... otherwise... those with legitimate need to access the account know the password or can get it reset by the admin......
Just a thought.

Avenger

Quote:

---

Originally posted here by Kelvin@Sec33
Thought I would take a sec and drop a note here.

My buddy Morlock just finished up something that ya'll might be really interested in.

An NT and Win2k password cracking app that is 1,000's faster than l0phtcrack.

There will be a press-release sometime today (Monday), if not then definately Tuesday. The technology behind this is quite amazing and is something that he has been working on for quite a while. The concept / technology is quite dynamic and we can port it to almost all encryption / hash technology.

Preliminary testing shows that it retrieves over 1,000 passwords in less than 30 seconds.. That doesn't mean that it ONLY checks for 1,000 passwords... That means it actually is RETRIEVING over 1,000 passwords in under 30 seconds... Some modifications over the next week should decrease this time by 30%.

There is nothing like it. - A little Wizardy is what Morlock calls it. ;-)

You can check it out here. www.sec33.com/modules.php?name=IPC

Take a look and let us know how it works out for ya.

Kelvin:// - [email protected]

---

Yes, we are quite aware that someone has leaked the algorithm used by Microsoft to encrypt their password, so it would seem pretty fast to crack them when you know how they were made in the first place :p

This program IS a serious security risk...... Ill post more on what I mean later, but for now... I must go :)

I have a W2k professional problem, I have locked myself out and I do not know the password. Is there anything I could do go get into my system without losing anything. I am not sure if it was configured with NTFS or FAT32 and it is not encrypted. I am getting desperate and I need some help. I was not able to get into the system with W98 disk. So I am assuming that it is NTFS. What would be my next step. Thank you.

Quote:

---

Originally posted here by ebangor
I have a W2k professional problem, I have locked myself out and I do not know the password. Is there anything I could do go get into my system without losing anything. I am not sure if it was configured with NTFS or FAT32 and it is not encrypted. I am getting desperate and I need some help. Thank you.

---

Find out what file system is being used first.
Try a windows98 boot disk, if you can access the drive in dos then it's FAT16 or FAT32, if it's NTFS you will need to use the recovery console that comes with windows 2k.
I'll explain more later when you find out what file system is in use.

The more I think about this program, the more it scares me. I mean, it isn't anything for a website to check your ip address. Ok, so I go to the website, and give it my NT server password hash files...Hummm. Now, the site has not only my IP address, but also my account names, and many of the passwords. This just really seams kinda crazy to me. I am not saying that sec33 is going to be trying anything like this, because they are to well known, but it just seems kinda sketchy to me....

It does not even work. I just created a couple of dummy users and took their hashes. Guess what nothing happened its the same like L0pht could not crack my password.
Its a scam where people throw the hashes that contain passwords and these guys crack them at their own time. Pretty pathetic if you ask me.

Hey, it's me. I read some of the replies here and a few of them made me chuckle.

I thought I would post a few comments here:

1) No, it's not a scam. It probably could be a very good one though.. Except we went to a lot of trouble to develop some new technology that benefits us more by being legit... darn!

2) It is COMPLETELY different from l0phtcrack. l0phtcrack takes hours / days / weeks and longer to crack passwords depending on the complexity of their character set and structure. IPC$ cracks ANY password in under 1 second. Actual time is around 100 - 200 ms. The idea that MS hash algorythm is available is not the issue. Speed is the issue. We have destroyed the concept of cracking on-way hashes... No more than 1 second is required now.

3) We did not release the full capabilities (full character set) because we wanted to demonstrate how we have affected the process of brute-force on one-way hashes. We may release it fully in the near future, but have not yet decided the app's future. This explains some passwords not being retrieved.

4) It would be naive of anyone to think that their IP is not publicly available when using public services. Any public service such as a web server is logging users for security, audit and functionality purposes. Sec33 is a legit organization that is NOT matching IP addresses to those who use our tools. We don't have that much time on our hands anyway. ** Actually, as I write this. I am at a client site doing real-life work.

5) It is also naive of me to think that everyone in this world *thinks* before they post comments. But, I still can only hope. (this is for those who made bogus remaks) Please, next time you post.. Take a little time to investigate before making foolish remarks. Thanks. ;-)

If any of you should have any questions, or do not understand the concept of cracking one-way hashes in under 1 second. Please let me know. If you understand how many million guesses are required and the process behind brute-force, then you will find this quite amazing. If you don't, well then.. you just won't see the power of the app.

... its been a rough day.

Thanks,

Kelvin://

Hey Kelvin,
I hope I'm not adding to your rough day. But I'm wondering, how will this be a security tool? Will it be available to just anyone? Are people supposed to use it to test the strength of their passwords? :confused:

Quote:

---

Originally posted here by Kelvin@Sec33
[...]The idea that MS hash algorythm is available is not the issue. Speed is the issue. We have destroyed the concept of cracking on-way hashes... No more than 1 second is required now.

---

Does anyone else have problems parsing the above? Or rather, that it's completely non-sensical? If I had to hazard a guess, it'd be that it is so speedy simply because it uses the leaked algorithm.

Quote:

---

3) We did not release the full capabilities (full character set) because we wanted to demonstrate how we have affected the process of brute-force on one-way hashes. We may release it fully in the near future, but have not yet decided the app's future. This explains some passwords not being retrieved.

---

Well, given the crippled state of release, it would seem easy for you to put up a disclaimer on the passwords that fall outside of the "guessing parameters," indicating that you had noticed it was an unqualified password, etc. Might lend a little more credibility to your claims, at least
(and, if anyone submits a password that falls within your criteria, and your tool still complains, it would be easy to further demonstrate this as nonsense).

Quote:

---

5) It is also naive of me to think that everyone in this world *thinks* before they post comments. But, I still can only hope. (this is for those who made bogus remaks) Please, next time you post.. Take a little time to investigate before making foolish remarks. Thanks. ;-)

---

...much like some vendors don't necessarily "think" (or spell check) before posting their ads.

Quote:

---

... its been a rough day.

---

Yes it has... :D

Quote:

---

Does anyone else have problems parsing the above? Or rather, that it's completely non-sensical? If I had to hazard a guess, it'd be that it is so speedy simply because it uses the leaked algorithm.

---

Okay, let me explain one-way hashes.

The algorythm used to create a one-way hash is known as a polynomial algorythm. Polynomial meaning that it cannot be reversed with the current amount of technology available at this point in time. Our math system is not perfect, there are situations where calculations can make use of 'trap doors'. The trap doors, are calculations that can be performed in only one direction. So, simply running a calculation in the opposite direction does NOT result in the original factors.

--
polynomial

1. <mathematics> An arithmetic expression composed by summing multiples of powers of some variable.

P(x) = sum a_i x^i for i = 0 .. N

The multipliers, a_i, are known as "coefficients" and N, the highest power of x with a non-zero coefficient, is known as the "degree" of the polynomial. If N=0 then P(x) is constant, if N=1, P(x) is linear in x. N=2 gives a "quadratic" and N=3, a "cubic".

2. <complexity> polynomial-time.
---


Thus, a brute force attack on a one-way hash is done by running the algorythm on every possible combination of characters and comparing the hash output with the stored hash output of the password. If they do not match, then it goes to the next combination and attempts again. If they do match, then you know what the original input to the algorythm is, and of course you now have the password.

L0phtcrack can run in upwards of 2.1 million guesses per second. And this is still slow.

Here are some stats on brute-forcing a password:

A 6 character password utilizing a-z (lower-case only) has 308,915,776 possible combinations. So at 2.1 million guesses per second that would only take around 147 seconds. Thats not too bad...

But, an 8 character password utilizing the full character set on your keyboard has 6,634,204,312,890,625 possible combinations. It would take about 3,159,144,910 seconds or 52,652,415 minutes or 877,540 hours or 36,564 days or last but not least around 100 years to run through all possible combinations at 2.1 million guesses per second.

Understand? It's not as simple as you think. A refresher in encryption might be a good idea.

... and, usually when someone knocks someone for bad spelling... they just don't have anything else good to say. ;-) - Face it, the majority of the population isn't perfect when typing. And I am a member of the majority.

The day is getting longer.

Kelvin://

Another small question Kevin, does this program seek to crack the Admin password..LOL what if the password for the Admin account is not called Administrator, Admin etc..to crack a password first ya gotta match a name with an account. I'd say this can do that you had better go back to the drawing board. Sorry Administrator does not have an account with me..yer gonna crunch numbers a long time! LOL oldest trick in the book default Administrator quick tip never call the admin account Admin or Administrator..LOL..wait default dir is not WinNT..go figure!

Kelvin I do not elicit myself as being any type of math guru(or speller). It never was any subject that I really liked.

But all you did was explain how one-way hashes work, and I saw the same web page that you cut an pasted it from. -- http://wombat.doc.ic.ac.uk/foldoc/foldoc.cgi?polynomial ---

This is what I think....


1) you got the leaked algorithm from MS.

or

2) you have a bunch of already cracked passwords from l0pht(and I mean a bunch) and you are using them to check everybodys password against....now, why would you do this....well I would do this to save the hashes and the ip address they came from and crack them with l0pht and try to gain access into the site.

my 2 cents...of course there may be other reasons..or I am completely wrong....

Quote:

---

does this program seek to crack the Admin password..LOL what if the password for the Admin account is not called Administrator,

---

The account does not matter as it does not affect the hash at all, you could place any name in the first field of the hash. I recommend doing this actually since the page is not configured to use any type of encryption.

Quote:

---

But all you did was explain how one-way hashes work, and I saw the same web page that you cut an pasted it from. -- http://wombat.doc.ic.ac.uk/foldoc/foldoc.cgi?polynomial ---

---

I did a little more than explain how one-way hashes work. I also explained how brute-forcing one-way hashes works.

The text I PASTED in was from dictionary.com and was meant to be a defintion. Did you miss that somehow? I guess I should have been more clear. The rest of the post was from my little brain - which is sadly affected by jet-lag right now.

You could make the same statements about any other password crackers. Right? Except, why do you use password crackers? Crack for malitious intent, crack for profesional use, admin loses passwords, auditors testing the strength of passwords, admin's ensuring password policies are being enforced and followed. The list goes on.

If you don't want to use the application, you are not forced to. It was not designed to spawn conversations about script kiddies trying to fool users into sending their passwords to odd places on the Internet.

If you don't want to use 'live' password hashes, just do the following and then delete the account when done.

At a windows NT / 2000 command prompt:

net user newaccountname password /add

Then download and run pwdump2

This will display the hashes... Just submit the new account, and do the following to delete it

net user newaccountname /del

Simple.

Grrrrrr... Going to bed.

Kelvin://

No need to become defensive, Kelvin. I am sorry if I forgot to mention about you also explaining about using brute force to crack one way hashes. I hate to type and I too am tired, so I figured that people would get the gist and all that intuitive stuff I keep on hearing about.


Hey man don't get all up in arms trying to defend your program...whenever or if you release the source, then we can see if the algorithm that is being used is the same. I am sure that lots of people have already snarfed it up and somebody will try to compare it.

But for now, if you say that it is not the leaked algorithm from MS and you are not some evil empire *the Brain* trying to take over the world every night, then relax.....

But you have to take this, because boasting 1000x faster than l0pht...doing 1000 hashes in seconds.....do you see what I mean? That is quite a jump.....

You are too right..

I have been responding to emails all evening with this topic...

Thanks for *slappin'* me back to reality.

Kelvin://

No prob. Been there too many times.....

Just want you to know that until I see the source(as maybe for others too), or some proof of this theory, I will still believe that it is something other than what you say it is. Like I said before..1000 hashes in seconds...quite the feat.

If you are right, then they might say Linus who? If it goes sour......they would say anything but nice, you can bet..

On the other hand, it would be nice to finally show MS that the security they have needs to be updated.

Anyway, just remember that nobody here means any disrespect, just people keeping you on your toes....

I few tests I did :)
No offense, but it doesn't seem to be anymore than a database of already cracked hashes. I look forward to the one that allow a more full range of password cracking to see if these old ones (or similar just in case) will be cracked in mere seconds as the site claims.


==============================
(password: 1234567890)
test1:1015:aad3b435b51404eeaad3b435b51404ee:c8fa091edf90b125cc7f800a260ae9b5:::

(password: someone)
test2:1016:2a3097d038762d85aad3b435b51404ee:87205ced7393f67d463985ecab1df49c:::

(password: die83jf)
test3:1017:020de3c40868eb88aad3b435b51404ee:fa7e4983b11df92abca640bb2141b09c:::

Response from website:

Encrypted hash: test1:1015:aad3b435b51404eeaad3b435b51404ee:c8fa091edf90b125cc7f800a260ae9b5:::
Decrypted hash: BLANK PASSWORD

--------------------------------------------------------------------------------

Encrypted hash: test2:1016:2a3097d038762d85aad3b435b51404ee:87205ced7393f67d463985ecab1df49c:::
Decrypted hash: SOMEONE

--------------------------------------------------------------------------------

Encrypted hash: test3:1017:020de3c40868eb88aad3b435b51404ee:fa7e4983b11df92abca640bb2141b09c:::
Decrypted hash: ???????
======================================

Some More tests:

(password: 654321)
test1:1018:23b3efcaa559d0dbaad3b435b51404ee:4057b60b514c5402dde3d29a1845c366:::

(password: zzztop)
test2:1019:6d0a23e97d9f7bd1aad3b435b51404ee:6088474f5ecad2e9d580793d032a373f:::

(password: abcdefg)
test3:1020:e0c510199cc66abdaad3b435b51404ee:352dfe551d62459b20349b78a21a2f37:::

Response from site:
Encrypted hash: test1:1018:23b3efcaa559d0dbaad3b435b51404ee:4057b60b514c5402dde3d29a1845c366:::
Decrypted hash: ???????

--------------------------------------------------------------------------------

Encrypted hash: test2:1019:6d0a23e97d9f7bd1aad3b435b51404ee:6088474f5ecad2e9d580793d032a373f:::
Decrypted hash: ???????

--------------------------------------------------------------------------------

Encrypted hash: test3:1020:e0c510199cc66abdaad3b435b51404ee:352dfe551d62459b20349b78a21a2f37:::
Decrypted hash: ABCDEFG

=============================================

Some more test using a more complicated password:

(password: h8trman)
test1:1024:f0583384108943dfaad3b435b51404ee:a009a5820c022a6286b31e5115fc8497:::

(password: d00dl8r)
test2:1025:0136a51a527760cbaad3b435b51404ee:99f4c3cb2f795af8e62e0baa2fc3bdd5:::

(password: zython)
test3:1026:fe6e47837384ee2faad3b435b51404ee:483d96266da6d1018d1bd8139d99ebdb:::

Web site response:
Encrypted hash: test1:1024:f0583384108943dfaad3b435b51404ee:a009a5820c022a6286b31e5115fc8497:::
Decrypted hash: ???????

--------------------------------------------------------------------------------

Encrypted hash: test2:1025:0136a51a527760cbaad3b435b51404ee:99f4c3cb2f795af8e62e0baa2fc3bdd5:::
Decrypted hash: ???????

--------------------------------------------------------------------------------

Encrypted hash: test3:1026:fe6e47837384ee2faad3b435b51404ee:483d96266da6d1018d1bd8139d99ebdb:::
Decrypted hash: ???????

Quote:

---

Originally posted here by Kelvin@Sec33
Okay, let me explain one-way hashes.

---

*sigh*

I wasn't questioning one-way hashes, I was questioning the fact why you were contrasting the idea of the MS password encryption algorithm availability to the speed of your system - it just didn't parse right in my mind and, to me, was comparing apples to oranges. At the very least, it could have been better phrased to be more understandable, I think.

Quote:

---

But, an 8 character password utilizing the full character set on your keyboard has 6,634,204,312,890,625 possible combinations. It would take about 3,159,144,910 seconds or 52,652,415 minutes or 877,540 hours or 36,564 days or last but not least around 100 years to run through all possible combinations at 2.1 million guesses per second.

---

Actually, by my (admitedly quick) calculations, it's more like 13,685,690,504,052,736 possible combinations, which is a little over 206 years (closer to 206 and two-thirds, not counting leap years, of course)

Quote:

---

Understand? It's not as simple as you think. A refresher in encryption might be a good idea.

---

Yes, Schneier's books are quite good - nice guy, too.

Quote:

---

... and, usually when someone knocks someone for bad spelling... they just don't have anything else good to say. ;-) - Face it, the majority of the population isn't perfect when typing. And I am a member of the majority.

---

My (personal) issues weren't with your spelling, but your grammar, logic and overall attitude (in your obviously eager/rushed posts).

Quote:

---

The day is getting longer.

---

Aye... quite...


Though so far, from what I've seen, however, this just seems to be yet another dictionary attack (or, if it's really as quick and "versatile" as you claim, I'd guess you've boosted the MS source). I'll sit and wait, however, until some more conclusive proof is demonstrated.

Apologies to all if I sound like a skeptical ass, but I guess it's a not-too-uncommon trait for security folk... Probably doesn't help I'm in a not-too-wonderful mood, either. *shrug* (sick, plus my s/o has decided to move a long way away (work reasons))


Like I said, I'd welcome some further, more-conclusive demonstrations...

Quote:

---

Its a scam where people throw the hashes that contain passwords and these guys crack them at their own time. Pretty pathetic if you ask me.

---

Well i didn't try it but i'm going to sec33.com sometimes and judging by the serious of his site
and time he puts in it i think the guy is actually pretty serious about this and i don't think it's a scam. Why would he put his reputation and the reputation of his site to get ashes from a couple of dummy account???

Quote:

---

3) We did not release the full capabilities (full character set) because we wanted to demonstrate how we have affected the process of brute-force on one-way hashes. We may release it fully in the near future, but have not yet decided the app's future. This explains some passwords not being retrieved.

---

I think i choose to believe that because if i would release a tool like that in the open, i would try to make it less effective then it really is but effective enough to prove a point...
Wouldn't we all?

Last comment...
Kelvin, you've prove your point so i think it would be best for everybody to send the source to microsoft and forget about the whole think!
my 2 cents! :)

well kelvin.. you are scaring the sh** out of me!

what's M$ response ??

Quote:

---

Originally posted here by draziw
Though so far, from what I've seen, however, this just seems to be yet another dictionary attack (or, if it's really as quick and "versatile" as you claim, I'd guess you've boosted the MS source). I'll sit and wait, however, until some more conclusive proof is demonstrated.

---

dictionary attack...maybe, but you miss the point about the source. having the hashing source code does NOTHING to speed your attack. it works in one and only one way. it cannot be reversed. no matter what, if you are going to do the standard brute force attack you have to go charecter by charecter and run it through the hashing algorythm. if i had to venture a guess as to what they did i'd say they probably had the computer do nothing but hash possibilities for a very long time then store the encoded and un-encoded versions. then a simple comparison is all it takes. by limiting the charecters it can use you signifigantly reduce the possible hashes. if you get enough computers together and have them just hash like crazy for a while you can compile a list of all the possible hashes.

once that is done you just sort them by hash and stick them in seperate files/HDD's/computers/whatever. now that you have a list of hashes and plain-text passwords you just do something like:
if(hash > storage1start && hash < storage1end)
search(storage1);
if(hash > storage2start && hash < storage2end)
search(storage2);
ect...

throw in a binary search within the file(cause its sorted) and *poof* you have just removed a TON of processing.

I dont care what anyone says Lopht Crack is a useing a program to crack the Sam is lame

Kelvin@Sec33: When will we get to see the source code?

I dont care what anyone says cracking the sam is a lame way of breaking a password do it the old fastion way and crack it your self

Didn't know this was going on for a while. I put a bunch of replies up on sec33.

Forums -> IPC$

http://www.sec33.com/modules.php?op=...rum&forum=16&1

Thanks for the feedback, guys.

--morlock

Hmm, not tried it, going to however, as was stated before to log IP's and passwords seem to be a real insecure thing...however if it really works it would help me greatly...I am an admin in the military with 120 users all from different units and countries there are some people who don't know how to save things to floppy so when I tell them I need the Admin pass they look at me wierd however I will try it.....

Quote:

---

Hmm, not tried it, going to however, as was stated before to log IP's and passwords seem to be a real insecure thing...however if it really works it would help me greatly...I am an admin in the military with 120 users all from different units and countries there are some people who don't know how to save things to floppy so when I tell them I need the Admin pass they look at me wierd however I will try it.....

---

As mentioned before. Remove the user names, we strip out the field anyway. If you
don't trust us use a proxy.

Following these two rules we only have one piece of information from you:
That somebody, somewhere on this planet has the password "yodeling123".

Hope that helps.

--morlock