2KKUU7ita

Chapter 7: Passwords
this password policy information, you can configure your cracking programs
with more well-defined cracking parameters, which often generate faster
results.
Rainbow attacks
A rainbow password attack uses rainbow cracking (see the earlier sidebar, “A
case study in Windows password vulnerabilities with Dr. Philippe Oechslin”)
to crack various password hashes for LM, NTLM, Cisco PIX, and MD5 much
more quickly and with extremely high success rates (near 100 percent).
Password-cracking speed is increased in a rainbow attack because the
hashes are precalculated and thus don’t have to be generated individually on
the fly as they are with dictionary and brute-force cracking methods.
Unlike dictionary and brute-force attacks, rainbow attacks cannot be used to
crack password hashes of unlimited length. The current maximum length for
Microsoft LM hashes is 14 characters, and the maximum is up to 16 characters
(dictionary-based) for Windows Vista and 7 hashes (also known as NT
hashes). The rainbow tables are available for purchase and download via the
ophcrack site at http://ophcrack.sourceforge.net. There’s a length
limitation because it takes significant time to generate these rainbow tables.
Given enough time, a sufficient number of tables will be created. Of course, by
then, computers and applications likely have different authentication mechanisms
and hashing standards — including a new set of vulnerabilities — to
contend with. Job security for ethical hacking never ceases to grow.
If you have a good set of rainbow tables, such as those offered via the ophcrack
site and Project RainbowCrack (http://project-rainbowcrack.
com), you can crack passwords in seconds, minutes, or hours versus the
days, weeks, or even years required by dictionary and brute-force methods.
Cracking Windows passwords with pwdump3 and John the Ripper
The following steps use two of my favorite utilities to test the security of current
passwords on Windows systems:
✓ pwdump3 (to extract password hashes from the Windows SAM database)
✓ John the Ripper (to crack the hashes of Windows and Linux/UNIX
passwords)
The following test requires administrative access to either your Windows
standalone workstation or the server:
1. Create a new directory called passwords from the root of your
Windows C: drive.
2. Download and install a decompression tool if you don’t already have
one.
105