?? rcracktutorial.htm
字號:
<td width="100%" colspan="2">configuration #1</td>
</tr>
<tr>
<td width="39%">hash algorithm</td>
<td width="61%"> lm</td>
</tr>
<tr>
<td width="39%">charset</td>
<td width="61%"> alpha-numeric(ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789)</td>
</tr>
<tr>
<td width="39%">plaintext length range</td>
<td width="61%"> 1 - 7</td>
</tr>
<tr>
<td width="39%">key space</td>
<td width="61%"> 36^1 + 36^2 + 36^3 + 36^4 + 36^5 + 36^6 + 36^7 = 80603140212</td>
</tr>
<tr>
<td width="39%">t</td>
<td width="61%">2400</td>
</tr>
<tr>
<td width="39%">m</td>
<td width="61%">40000000</td>
</tr>
<tr>
<td width="39%">l</td>
<td width="61%">5</td>
</tr>
<tr>
<td width="39%">disk usage</td>
<td width="61%">m * 16 * l = 3200000000 B = 3 GB</td>
</tr>
<tr>
<td width="39%">success rate</td>
<td width="61%"> 0.9904</td>
</tr>
<tr>
<td width="39%">mean cryptanalysis time</td>
<td width="61%"> 7.6276 s</td>
</tr>
<tr>
<td width="39%">mean cryptanalysis time on a low memory system (free memory
size much smaller than 610MB)</td>
<td width="61%"> 13.3075 s</td>
</tr>
<tr>
<td width="39%">max cryptanalysis time</td>
<td width="61%"> 40.6780 s</td>
</tr>
<tr>
<td width="39%" valign="top">table precomputation commands</td>
<td width="61%">rtgen lm alpha-numeric 1 7 0 2400 40000000 all<br>
rtgen lm alpha-numeric 1 7 1 2400 40000000 all<br>
rtgen lm alpha-numeric 1 7 2 2400 40000000 all<br>
rtgen lm alpha-numeric 1 7 3 2400 40000000 all<br>
rtgen lm alpha-numeric 1 7 4 2400 40000000 all</td>
</tr>
<tr>
<td width="39%" valign="top">table precomputation time</td>
<td width="61%">15 days 17 hours</td>
</tr>
</table>
<p>Some explanations:<br>
With this configuration, you can crack an alpha-numeric password in 13.3075 seconds
on a 256MB memory system with 99.04% success rate.
</p>
<p>In this tutorial we use "configuration#0". If you want the
second configuration, everything is similar.
</p>
<h2>
<br>
3. Precompute the rainbow tables with rtgen.exe
</h2>
<p>Now the time to generate the rainbow tables.<br>
There is an utility
called "rtgen.exe" (rainbow table generator) in the distribution. Now
open
a command prompt, switch to the directory where the rainbowcrack files are
extracted, make sure there is 128 MB free disk space in place and execute the command:
</p>
<table border="0" width="100%" cellspacing="0" bgcolor="#EBEBEB">
<tr>
<td width="100%">rtgen lm alpha 1 7 0 2100 8000000 all</td>
</tr>
</table>
<p>This will begin the generation of first rainbow table. It takes 13.2 hours to
complete on a 666 MHz CPU.<br>
If you want to generate a rainbow table for md5/sha1 algorithm(used to crack
md5/sha1 hashes), you can use the command like this "rtgen md5 alpha 1 7 0 2100 8000000 all"
or "rtgen sha1 alpha 1 7 0 2100 8000000 all". Here "alpha"
is upper case alpha, you can generate a lower case alpha table like this "rtgen
md5 loweralpha 1 7 0 2100 8000000 all".<br>
<br>
Leave you computer working ...<br>
<br>
You can pause the precomputation any time by pressing Ctrl+C.
Next time you run rtgen.exe with the same parameters the program will pick up
where the precomputation left off and continue the generation of the rainbow
table.
</p>
<p>When the generation of first rainbow table is finished. There will be a file
named "lm_alpha#1-7_0_2100x8000000_all.rt" (128000000 bytes) in the
directory. Don't rename the file because we store some parameters in the file
title.
</p>
<p>Now the time to generate the remaining rainbow tables, make sure you have
enough free disk space (128000000 bytes for each table):
</p>
<table border="0" width="100%" cellspacing="0" bgcolor="#EBEBEB">
<tr>
<td width="100%">
rtgen lm alpha 1 7 1 2100 8000000 all<br>
rtgen lm alpha 1 7 2 2100 8000000 all<br>
rtgen lm alpha 1 7 3 2100 8000000 all<br>
rtgen lm alpha 1 7 4 2100 8000000 all</td>
</tr>
</table>
<p>Replace "lm" with "md5" or "sha1" if you want.
</p>
<p>Leave you computer working ...<br>
......<br>
......<br>
<br>
<br>
When the precomputation is complete, make sure the following files are in place:<br>
128,000,000 bytes lm_alpha#1-7_0_2100x8000000_all.rt<br>
128,000,000 bytes lm_alpha#1-7_1_2100x8000000_all.rt<br>
128,000,000 bytes lm_alpha#1-7_2_2100x8000000_all.rt<br>
128,000,000 bytes lm_alpha#1-7_3_2100x8000000_all.rt<br>
128,000,000 bytes lm_alpha#1-7_4_2100x8000000_all.rt
</p>
<p>If everything goes well, backup all files (recommended) and proceed to the
next section of the tutorial.
</p>
<h2>4. Sort rainbow tables with rtsort.exe
</h2>
<p>To speed up the search of rainbow table, we should sort the rainbow table
with "rtsort.exe" in advance.<br>
In fact "rcrack.exe" only accept sorted rainbow tables.<br>
<br>
Use these commands:
</p>
<table border="0" width="100%" cellspacing="0" bgcolor="#EBEBEB">
<tr>
<td width="100%">rtsort lm_alpha#1-7_0_2100x8000000_all.rt<br>
rtsort lm_alpha#1-7_1_2100x8000000_all.rt<br>
rtsort lm_alpha#1-7_2_2100x8000000_all.rt<br>
rtsort lm_alpha#1-7_3_2100x8000000_all.rt<br>
rtsort lm_alpha#1-7_4_2100x8000000_all.rt</td>
</tr>
</table>
<p>Each command will take several minutes to complete. The
"rtsort.exe" utility will sort the file and write back to the original
file.<br>
<br>
Notice: If free memory size is smaller than the file size, we can't load the
file into memory at a time. In which case extra free disk space as large as the
file to be sorted is required to apply an external sort.
</p>
<p>If everything goes well, proceed to the next section.
</p>
<h2>5. Crack the hash with rcrack.exe and the sorted rainbow
tables
</h2>
<p>Finally you have everything ready. Now the time to play with
"rcrack.exe".<br>
Notice the file "random_lm_alpha#1-7.hash" in the distribution. It
contain 10 randomly generated lanmanager hashes(charset alpha, length 1-7). We
will use this file as a test vector.<br>
<br>
Launch the program by issuing the command:</p>
<table border="0" width="100%" cellspacing="0" bgcolor="#EBEBEB">
<tr>
<td width="100%">rcrack c:\rainbowcrack\*.rt -l random_lm_alpha#1-7.hash</td>
</tr>
</table>
<p>You should replace "c:\rainbowcrack\" with where you place the
sorted rainbow tables. It seems that you will find the plaintext of all 10
lanmanager hashes. Now open the file "random_lm_alpha#1-7.plain" and
validate the result of rcrack.exe. If they match, that is ok.</p>
<p>To crack some windows password, the syntax is similar:</p>
<table border="0" width="100%" cellspacing="0" bgcolor="#EBEBEB">
<tr>
<td width="100%">pwdump2 > pwfile.txt<br>
rcrack c:\rainbowcrack\*.rt -f pwfile.txt</td>
</tr>
</table>
<p>The pwdump2 utility is used to dump the lanmanager hashes of windows system.
If your password consists of letters only, rcrack will be able to crack it with
the success rate 99.9%.<br>
<br>
Have fun!<br>
<br>
Create date: 2003/9/9<br>
Revised: 2003/11/21</p>
</body>
</html>
?? 快捷鍵說明
復制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -