Obtaining and Cracking a UNIX Password File (Part 1)
Introductory Information
If you want to be a REAL hacker, you must understand
how the system you are hacking works. Any idiot can follow a few instructions,
but it takes a smart person to know what exactly he/she is doing, and you
will have to know what you are doing in harder systems. First you must understand
how a login process works.
1) Username and password are entered
2) Password file is opened and proper login is found
3) Entered password is encrypted and checked against the (already encrypted)
password in the file.
Let's take a look at a fake example. Here's the
system's password file at 'stupid.org':
-------------------------------------------
root:N03xwkfmdY/tX:0:0:Superuser:/root
web:bXnSqjfIUfhds:1:0:WebMaster:/web
ftp:pZa7t920jfoNX:2:0:ftp:/usr/ftp
-------------------------------------------
This is a very basic password file. Every
password file has the 'root' account. Root basically controls the system.
Since this is a website, it needs a webmaster account, and then there
is the ftp account which is used for, you guessed it, public ftp. Now
let's examine what all that stuff means. All pieces of information are
separated by colons (:).
1) The username/login
2) The encrypted form of the password
3) The group number the user is in*
4) The member number of the group the user has*
5) The description of the account
6) The home directory of the user
*I may be wrong about the ordering of 3 + 4.
It might be vice-versa.
Now say 'Mr.Hacker' connects to stupid.org and logs
in as root. He then enters the password 'toor' (root backwards). The password
file is opened and the account 'root' is found. Then the password Mr.Hacker
entered is encrypted and compared to the encrypted password in the password
file. Since the admin of this system can't remember a complex password,
he thought he could fool a hacker by choosing his password by reversing
his login name. Well, now Mr.Hacker has control of the system. This time
the hacker got root as a lucky guess, but no sysop would really make a password
that easy to guess. It's almost always a combination of lowercase and uppercase
letters (UNIX is case-sensitive), numbers, and sometimes even unusual ASCII
characters.
Note: Linux, FreeBSD, RedHat, Slackware, etc.
- these are all variations of UNIX.
Obtaining the Password File
We'll come back to the login process later, but now
you need to know how to get the coveted password file. You have two very
easy methods that will work on very low-security systems - usually .org
(non-profit organization) or .jp (Japanese) sites.
FTP Method
The first method requires a little carelessness on the sysop's part. Run
'ftp.exe' (if you're using Win95). Type 'open' and then the address of the
site you want to hack. Login as 'anonymous'. If this is allowed then either
it's a public FTP or the sysop is very careless. Now type 'get /etc/passwd'.
If that works, don't get too excited yet. Ctrl+Break out of FTP then type
'type passwd' in your Windows folder. If you see little *'s where the encrypted
password should be, that's called shadowing the password file. Now, nothing
can interpret the *'s, so that means there is another, real, password file
hidden somewhere. First try 'get /etc/shadow' and 'get /etc/shadowed'.
PHF Exploit
If that doesn't work, it's time to move on to the PHF exploit. PHF is a
program that usually comes pre-installed on every UNIX machine. It allows
you to download ANY file from the server, including the password file. Unfortunately,
this flaw is already fixed on at least 95% of all Internet servers. But,
if you are trying to hack a .org site (the ones without donations through
credit card via the Web, that is) (or a .jp site, or so I'm told) you have
a pretty good chance of the PHF exploit working. All you have to do is open
your web browser and enter the following address, replacing webpage_goes_here
with the site you're trying to hack.
http://webpage_goes_here/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd
WARNING: IF YOU TRY THIS ON SOME SERVERS, YOU CAN GO TO JAIL
Portscan Method
Neither of these methods worked? The third method requires a good deal of
creativity. First download a decent util called Haktek.
It contains an excellent port scanner as well as a bunch of lamer tools.
Install and run Haktek. Change the target to the desired address. Now run
a port scan. Haktek will appear to lock up but just wait, it will finish
eventually. If you're really serious about hacking this particular site,
do a scan on 0-9999 instead of 0-1000. Telnet to every single one of these
ports. Windows Telnet will do the job. This is where your creativity comes
in. I can't help you now. A very good thing to do is obtain an account with
the site you're trying to hack (this is why hacking your college is so popular).
Search for exploits at Rootshell.
You're pretty much on your own now since I have no experience using C-code
exploits. These exploits will only work if you have Linux installed on your
computer or you have a shell account with compiler access. That's all on
obtaining the file for now.
Cracking the Password File
Cracking a password is the longest, most boring part
of hacking. Believe me, wordlists/dictionary files are totally useless,
unless you can find a program that generates a 2 gig+ dictionary file. No
one makes their password a word in any language anymore. For cracking the
password, you'll need the best UNIX password cracker around: John
the Ripper. Get the DOS version (unless of course you have Linux). I
have experienced some crashes with the Win32 one. Here's what a password
cracker does: it simulates a normal UNIX login by taking passwords from
a word list (don't use them) or by incrementally trying combinations of
ASCII characters, encrypting them, and comparing it to the encrypted password
in the password file. There is NO WAY to unencrypt a UNIX password, since
unencryption is never used during the login process. For a more detailed
explanation, ÅçìÐMêì§TéR
has a great doc on it at his site.
Enough about how everything works, you need to know how to use John the
Ripper. Copy the password file you have into the directory you installed
John the Ripper in. Now type 'john -incremental:all passwd', where passwd
is the filename of your password file. At any time you can hit Ctrl+Break:
this will stop the attempts and save it's exact status in a file named 'restore'.
To start where you left off, type 'john -restore'. This can take 24hrs on
a Pentium for ONE 8-character password. It's a good idea to take one password
line from your file and copy it into another file and crack only that account.
Leave your computer on 'john -restore' any time you can. At night, while
you're at work - whenever. Eventually, the password will be cracked and
the results written to a file called 'john.pot'. That's about it for this
issue. I intend to work on an C article as well as the second part of this
article for the next magazine. Good luck, and be careful!
Bibliography: Text files that can be found at Active
Matrix's Hideaway and Neworder
Thanks: Carolyn Meinel for the GTMHH.
The Mentor for inspiration, ethics, and text files.
SectorX (aka Ido Lion) for teaching
me so much.
Back
To Index
|
|
