Skip to main content

Password Cracking: RainbowCrack table generation, sorting and usage

I had to do this demo after one of my students asked for my assistance regarding how to use this tool. Usually, I just assign different tools to them individually depending on the aspect of penetration testing we are covering (session hijacking, vulnerability scanning, etc) and then tell them to submit a report and a video demo of how the tool is used.

Anyway, after a brief one-to-one discussion I realized the student had actually done the research on how rainbow tables operate (above and beyond the material in the lecture slides) so I figured that if he was here asking for assistance, he genuinely needed it.

The tool is available at the RainbowCrack site.  A detailed description of this nifty tool can also be found here.

So, firstly I had to generate the rainbow tables. The command line syntax is:

rtgen hash_algorithm charset plaintext_len_min plaintext_len_max table_index chain_len chain_num part_index

where:

hash_algorithm 
Rainbow table is hash algorithm specific. Rainbow table for a certain hash algorithm only helps to crack hashes of that type.

charset
The charset includes all possible characters for the plaintext. Loweralpha-numeric" stands for "abcdefghijklmnopqrstuvwxyz0123456789", which is defined in configuration file charset.txt.

plaintext_len_min and plaintext_len_max
These two parameters limit the plaintext length range of the rainbow table. In the example above, the plaintext length range is 1 to 4. So plaintexts like "a" and "1234" are likely contained in the rainbow table generated. But plaintext "12345" with length 8 will not be contained.

table_index
The table_index parameter selects the reduction function. Rainbow table with different table_index parameter uses different reduction function.

chain_len
This is the rainbow chain length. Longer rainbow chain stores more plaintexts and requires longer time to generate.

chain_num
Number of rainbow chains to generate. Rainbow table is simply an array of rainbow chains. Size of each rainbow chain is 16 bytes.

part_index
To store a large rainbow table in many smaller files, use different number in this parameter for each part and keep all other parameters identical.

For simplicity, I chose to create a rainbow table for MD5 hashes where the maximum length of the number of characters is set to 4.

You can also use tables that have already been generated and which can be found here.

After table generation, the next step is sorting which uses the tool rtsort.exe and the only argument needed when using it in this case was the name of the table we generated (MD5xx.rt).

I then also decided to use the hash for 0000 so I could get my results more quickly (since this is a simple demo) and so I used this site to do that.

I then loaded the GUI version of the Rainbowcrack (rtgui), loaded the hash for 0000, selected the Rainbow table I had created and hey presto! quick results.

A few points to note, there are 2 other GUI based applications that are in the same folder. These are to be used if and only if you're aware of the kind of GPU processor your device has and if not, just stick to the one without any suffix (rtgui.exe). If you get an error that a .cl program cannot load, just reload the rtgui.exe and try again after you have successfully generated and sorted your tables.


Comments

Post a Comment

Popular posts from this blog

Part 4 - Static and Dynamic analysis of a Remote Access Trojan

Now we delve into the world of Malware analysis, This can be either Basic static, basic dynamic, advanced static or advanced dynamic malware analysis. By static we just mean we do not execute the malicious program but simply analyse it by looking at the headers, the linked libraries it calls, its resources, etc. When it is advanced, this would mean breaking it down and analysing it with tools such as IDA Pro. Dynamic means we run it in a safe environment and see what it does. Basic tools include Regshot which simply takes a snapshot of the registry before and after the malware was executed. It then returns only the changes made in between those two points in time. Advanced would involve the use of a sandbox that monitors all the calls the malware makes as well as the connection attempts it tries to make to outside terminals or C&C servers. The video below illustrates Basic Static and Dynamic malware analysis.
Post a Comment
Read more

Malware Analysis: A Python Malware on campus 1

So a few weeks back after a class I'd taken with them,  a number of my students told me of a particular malware that was affecting students' computers, in particular, computers running Windows OS. According to them, if you tried to open a folder that was residing on the USB stick with the malware, the malware would delete some of your files and convert folders into executable files. Granted, the likelihood of a random folder miraculously transforming into a single executable file was kinda "out there" but I figured I'd check it out and use that as a teaching moment for those interested in venturing into malware analysis. So I tasked them to bring me a sample of the malware so I could take a look at it and maybe figure it out. I advised one of them to download DumpIt  and then extract the memory dump from an infected computer using a clean flash disk and then bring it to me. How do you do this exactly? here's how: Download DumpIt . It's a portable...
Post a Comment
Read more