Simeon Recently should antian365 team of security research, I am responsible for the system password attack password cracking sub-topics of study, do not study do not know yet, study after in the security field, the more in-depth, the more feel their own understanding of things too small, in the password crack, the usual with the most is the LC5, with regard to the use of LC5 how to crack the password, see the team writing the system password security and audit act, the LC5 to crack a relatively long time, has been we have complacent, and feel myself password crack the regard or good, but through this study, I completely speechless, one not more than 1 4-digit system password is generally not more than 5 minutes, the vast majority need only tens of seconds, which means that when a system is flawed, when, in a very short period of time to control and penetrate the internal network now! Here's my research process and research methods with readers and friends together to share, also welcome the commitment to network security friends to join antian365 research team. # A lookup of information ## 1. Through the Internet search engine to find information In the research process is the most important thing is to find information, to find information primarily through Internet search engine to discover the predecessors to publish the research results. I first by Google in their Search section, enter the“Ophcrack”, then select“Chinese web”, and finally click the“Google search”, as shown in Figure 1 out a 2 9 4 0 0 0 multiple records, it appears that the“Ophcrack”is still relatively popular, powerful seen! ! [](/Article/UploadPic/2008-12/200812271551621.jpg) Figure 1 find Ophcrack information ## 2. Get information about the topic of useful research data In General, through a search engine to find out information on more, of which many are repeated, a better method is to find a breakthrough, and then one by one carried out. From Figure 1, first get the“Ophcrack”software official address ophcrack.sourceforge.net it tells us Ophcrack is a rainbow table to crack a Windows password tool. Next are two articles about the Ophcrack technique Article: a Tory translation of“Security Master weapon awareness of Rainbow hash table crack tool”（[]()[http://tech.ccidnet.com/art/237/20070913/1211093_1.html](), the nickname for the“in search of life the starting point of the”write“using the Rainbow tables and Ophcrack a combination of tools to crack Windows password”in[]()[http://blog.cn-ic.org/?p=62](). the Through the above two articles we learned about Ophcrack requires the use of Rainbow tables and Rainbow table generation, as well as some other information. ### 3. Through the information again to search and organize By viewing others blog and the published articles we analyzed and collated, and ultimately get some of the following information and data: 1. the tool download: [http://sourceforge.net/project/showfiles.php?group_id=133599]() （2）the Ophcrack homepage: [http://ophcrack.sourceforge.net/]() （3）English Vic on Rainbow tables definitions and explanations: a[http://en.wikipedia.org/wiki/Rainbow_table]() （4）domestic Rainbow table research: [http://www.antsight.com/zsl/rainbowcrack/]() （5）At present, the relevant research Ophcrack and Rainbow tables of relevant information. Through the above three steps, I again information classification, software tools to download, and then this process are downloaded the Ophcrack software and source code, as well as Ophcrack available Rainbow table[]()[http://ophcrack.sourceforge.net/tables.php](), and by looking we know that Ophcrack provides three free Rainbow tables: 1. The XP free small (380MB) ID: SSTIC04-10k Crack success rate: 99.9% Alphanumeric table: 123456789abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz In a word the table has uppercase and lowercase letters plus numbers to generate, the size of 388MB, containing all alphanumerical password 9 9. 9%of the LanManager table. These are uppercase and lowercase letters and numbers into the password about 8 0 0 million. Since the LanManager hash table the password is cut into each of the 7 characters of the two parts, we can use the table to crack length in a 1 to 1 between the 4 password. Since the LanManager hash table is case-insensitive, the table of 8 0 0 million a combination is equivalent to 1 2*1 0 the 1 1 th or 2 8 3 th th password, it is also referred to as“alphanumeric table 10K”in. （2）the XP free fast (703MB) ID: SSTIC04-5k Success rate: 99.9% Alphanumeric table: 0123456789abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz Alphanumeric table 5k size is 703MB contains all the letters of the numeric password, 9 9. 9%of the LanManager table. However, since the table becomes 2 times larger, if your computer has 1GB or more of RAM space while it the crack speed is that the first one 4 times. （3）the XP special (7.5 GB) ID: WS-20k Success rate: 9 6% XP special extension table 7.5 GB, and contains the longest 1 of 4 uppercase and lowercase letters, numbers, and the following 3 3 special characters!"#$%& amp;'()*+,-./:;& lt;=>?@ [\\]^_`{|} ~）The composition of the password in 9 6% of the LanManager table. The table has about 7 trillion combinations, 5*1 0 1 Power of 2 or 2 9 2 th password, the table need to spend money to buy. （4）crack Vista Rainbow tables Vista free (461MB) is a free used to crack Vista hash the password, and Vista special (8.0 GB)purchase required. Tip: LM also known as LanManager, it's the Windows ancient and fragile password encryption. Any greater than 7-bit password is divided into 7 units of several parts, and finally the inadequate 7-bit code to 0 to make up 7 digits, and then through the encryption operation, the final combination into a hash. So actually by hack software after the decomposition, the LM password to crack the upper limit is 7 bits, this makes today's PC operation speed in a short period of time to brute force the LM encrypted passwords to become possible is a limit of two weeks, if the use of Rainbow tables, then this time the order may be down to hours. # II for download tool test ## 1. Install Ophcrack software Ophcrack the software installation process is very simple, follow the prompts to install to during the installation process need special attention, do not choose to download the rainbow table, the installation setup will provide three download options are download WinXP （380MB, the Winxp （703MB and Vista 461MB Rainbow table, as shown in Figure 2, The author selected during the installation process it downloaded after a few hours, this table can be in the program after the installation is complete then download. Otherwise install Ophcrack software to a rainbow table after the download is complete to use. ! [](/Article/UploadPic/2008-12/200812271552920.jpg) Figure 2 Installation recommended not to download the rainbow table ## 2. Use Ophcrack software From the program menu directly run the Ophcrack software, as shown in Figure 3, The software has“Load”,“Delete”,“Save”,“Table”, a“Crack”,“Help”and“Exit”the seven main modules, the“Load”is mainly responsible for loading the Hash or sam files.“ Delete”key to remove the cracked entry, the“Save”key to save crack results or crack session,“Table”mainly used to set up the rainbow table, the“Crack”is the beginning of the Executive cracked,“Help”to view the Help file, huh,“Exit”I will not say. ! [](/Article/UploadPic/2008-12/200812271552762.jpg) Figure 3 Ophcrack software main interface ## 3. Download Rainbow table Can to Ophcrack offers Rainbow table download address[]()[http://ophcrack.sourceforge.net/tables.php]() to download, in this case, are the download three free Rainbow tables. ## 4. Set of Rainbow tables In Ophcrack software main interface, click“Table”, and then they will come out as shown in Figure 4 The Table Selection interface, by default, all tables are not installed, through the interface we understand a total of 8 Rainbow table, of which there are three is free. ! [](/Article/UploadPic/2008-12/200812271552251.jpg) Figure 4 Select the rainbow table Then click and select one of the entries, for example, in the present example, select the“Xp free fast”, and then click“Install”button, the system will automatically to the Ophcrack software installation directory, but the present example is the three compressed files solutionPressure to the F disk, as shown in Figure 5, Select the“Tables”button, then once installed the acquisition of the other two Rainbow table. ! [](/Article/UploadPic/2008-12/200812271552297.jpg) Figure 5 choose to install the rainbow table Note: （1）in the Ophcrack software its Rainbow table of the parent directory name must be“tables”, otherwise the rainbow table installation will not be successful. （2）The Rainbow table after successful installation, its entry will turn green, and you can view the total number of a table, as shown in Figure 6. ! [](/Article/UploadPic/2008-12/200812271553690.jpg) Figure 6 Rainbow table installed successfully ## 5. Ready to crack the material Here's the cracked material is mainly refer to through the GetHashes, the Pwdump software acquisition system Hash password value. If not, it is own to think of a way to obtain one. ## 6. Begins to crack （1）loading the sam file Click the“Load”button, choose“PWDUMP file”, as shown in Figure 7, a total of 6 options, the first one is mainly used for a single Hash to crack, and the second is to get the Pwdump file to be cracked, and the third is to encrypt the sam file for cracking, fourth and fifth primarily used to audit or cracked local and remote Hash the password.! [](/Article/UploadPic/2008-12/200812271553884.jpg) Figure 7 Select the hack type （2）review the HASH password value In this example, select the one that has Pwdump file, if pwdump system a hash of the password is not wrong, it will in Ophcrack software the main interface displayed correctly, as shown in Figure 8, in the main interface are displayed“User”,“LM Hash”and“NT Hash”and“LM Pwd1”, the“LM Pwd2”and the“NT pwd”and other information. ! [](/Article/UploadPic/2008-12/200812271553881.jpg) Figure 8 displays the acquired Hash the password value （3）clean the useless Hash value In the present embodiment“IUSR_XFFZD-R1”,“TWWM_XFZD-SER1”and“TsInternetUser”these three users is the system itself, in the password crack, the basic no use, unless someone on the account were cloned, so you can select the need to delete the account, and then click on the main interface of the“Delete”button, to remove these three useless account and I added“king$”the account, leaving only the and crack the admin account, clean up after completion as shown in Figure 9. ! [](/Article/UploadPic/2008-12/200812271553195.jpg) Figure 9 clean up the unwanted user Hash password value （4）to perform the hack Click“Crack”the case began to crack, soon to crack out the password for the“www119”,“LM Pwd1”value with the“NT pwd”are the same, crack the Code of the time just“37s”in. ! [](/Article/UploadPic/2008-12/200812271553826.jpg) Figure 1 0 crack the system password successfully （5）view crack statistics In the main interface, click“statistics”, you can view information about the crack hash password value of ordinary and more information, as shown in Figure 1 1 shown in Fig. ! [](/Article/UploadPic/2008-12/200812271554950.jpg) Figure 1 1 viewing the crack the Code of the relevant statistical information （6）the crack parameter set Click“Preferences”to open the crack parameter setting window, as shown in Figure 1 2 shows, you can set the hack thread, the hack way, whether to hide user names, etc. ! [](/Article/UploadPic/2008-12/200812271554689.jpg) Figure 1 2 setup crack parameters # Three Rainbow table to crack password prevention strategies Through a rainbow table to crack a password so that intruders can easily get the system password, so a“normal”login system that allows the administrator or computer owner is not too easy to find. Through research, it can be found in two ways to strengthen the system password security. ## 1. By setting more than a certain number of bits of the password to reinforce password security Using a rainbow table to crack 1 4 bit following the password is relatively easy, for the average intruder to say there are only three free tables, so crack strength is relatively weak some, so you can increase the password set the number of bits to reinforce the system password security. The author recommended to set more than 3 2-bit password to the reinforcement system of password security. On the password setting tips a lot, in our study the topics mentioned, in order to take care of new friends, you can then provide the password once set of skills: By word to set a password, for example,“2 0 0 8-8 month our country hosted the Olympic Games, I went to the Beijing Bird's Nest to watch the game, feeling very cool!”to. It can be set to“2 0 0 8-8ywgjblayh,wqbjlcgklbs,gjhs!”, the About time full take, and punctuation all take, other characters take the first letter of the password length of 3 3-bit, if you think a little longer can also increase. Its essence is to choose the words or poetry of a certain period to set up, easy to remember, and the security strength is high. ## 2\. The use of NTLM encryption methods LM such a vulnerable encryption methods in Windows 2003 still in use, by changing the encryption mode to NTLM, thereby improving the system password security, the author in many cases it has been found that by pwdump and GetHashes software to obtain a hash value, but the LC5 and the Ophcrack software can not be cracked. You can set the registry parameter to disable LM encryption, instead of NTLM-way encryption method is as follows: （1）Open the Registry Editor; （2）locate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa; and （3）Select the menu“Edit”,“Add Value”; and （4）The value name Enter: LMCompatibilityLevel, numeric types: DWORD, click OK; （5）double-click the new data, and according to the specific situation set the following values: 0 - send LM and NTLM response; 1 - send LM and NTLM response; 2 - only send NTLM response; 3 - only send NTLMv2 response; (Windows 2 0 0 0 effective) 4 - only send NTLMv2 response, refuse LM; and(Windows 2 0 0 0 effective) 5 - only send NTLMv2 response, refuse LM and NTLM; and(Windows 2 0 0 0 effective) （6）close the Registry Editor; （7）to restart the machine In Windows NT SP3 introduced the NTLM encryption, in Windows 2 0 0 0 after the gradual introduction of NTLM 2.0 encryption. But LM encryption way by default or turned on, unless by the above method deliberately turn it off. Finally for antian365. com play an ad, haha, welcome to the hobby security friends to come together to discuss and learn about safety technology!

Query Builder