rcracktutorial.htm

彩虹表 crack－hash 破解密码 。。。。。

    <td width="100%" colspan="2">configuration #1</td>       
  </tr>
  <tr>
    <td width="39%">hash algorithm</td> 
    <td width="61%">					lm</td>
  </tr>
  <tr>
    <td width="39%">charset</td> 
    <td width="61%">					alpha-numeric(ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789)</td>
  </tr>
  <tr>
    <td width="39%">plaintext length range</td>
    <td width="61%"> 1 - 7</td> 
  </tr>
  <tr>
    <td width="39%">key space</td>
    <td width="61%"> 36^1 + 36^2 + 36^3 + 36^4 + 36^5 + 36^6 + 36^7 = 80603140212</td>  
  </tr>
  <tr>
    <td width="39%">t</td>
    <td width="61%">2400</td>
  </tr>
  <tr>
    <td width="39%">m</td>
    <td width="61%">40000000</td>
  </tr>
  <tr>
    <td width="39%">l</td>
    <td width="61%">5</td>
  </tr>
  <tr>
    <td width="39%">disk usage</td>
    <td width="61%">m * 16 * l = 3200000000 B = 3 GB</td>
  </tr>
  <tr>
    <td width="39%">success rate</td>
    <td width="61%"> 0.9904</td>
  </tr>
  <tr>
    <td width="39%">mean cryptanalysis time</td>
    <td width="61%"> 7.6276 s</td>
  </tr>
  <tr>
    <td width="39%">mean cryptanalysis time on a low memory system (free memory  
      size much smaller than 610MB)</td>
    <td width="61%"> 13.3075 s</td>
  </tr>
  <tr>
    <td width="39%">max cryptanalysis time</td>
    <td width="61%">   40.6780 s</td>
  </tr>
  <tr>
    <td width="39%" valign="top">table precomputation commands</td>
    <td width="61%">rtgen lm alpha-numeric 1 7 0 2400 40000000 all<br>
      rtgen lm alpha-numeric 1 7 1 2400 40000000 all<br>
      rtgen lm alpha-numeric 1 7 2 2400 40000000 all<br>
      rtgen lm alpha-numeric 1 7 3 2400 40000000 all<br>
      rtgen lm alpha-numeric 1 7 4 2400 40000000 all</td>  
  </tr>
  <tr>
    <td width="39%" valign="top">table precomputation time</td>
    <td width="61%">15 days 17 hours</td> 
  </tr>
</table>
<p>Some explanations:<br> 
With this configuration, you can crack an alpha-numeric password in 13.3075 seconds  
on a 256MB memory system with 99.04% success rate.&nbsp; 
</p>

<p>In this tutorial we use &quot;configuration#0&quot;. If you want the 
second configuration, everything is similar.
</p>

<h2> 
<br>
3. Precompute the rainbow tables with rtgen.exe 
</h2>

<p>Now the time to generate the rainbow tables.<br>  
 There is an utility   
called &quot;rtgen.exe&quot; (rainbow table generator) in the distribution. Now 
open   
a command prompt, switch to the directory where the rainbowcrack files are   
extracted, make sure there is 128 MB free disk space in place and execute the command:  
</p>

<table border="0" width="100%" cellspacing="0" bgcolor="#EBEBEB">
  <tr>
    <td width="100%">rtgen lm alpha 1 7 0 2100 8000000 all</td> 
  </tr>
</table>
<p>This will begin the generation of first rainbow table. It takes 13.2 hours to       
complete on a 666 MHz CPU.<br>
If you want to generate a rainbow table for md5/sha1 algorithm(used to crack
md5/sha1 hashes), you can use the command like this &quot;rtgen md5 alpha 1 7 0 2100 8000000 all&quot;
or &quot;rtgen sha1 alpha 1 7 0 2100 8000000 all&quot;. Here &quot;alpha&quot;
is upper case alpha, you can generate a lower case alpha table like this &quot;rtgen
md5 loweralpha 1 7 0 2100 8000000 all&quot;.<br>
<br>      
Leave you computer working ...<br>      
<br>
You can pause the precomputation any time by pressing Ctrl+C.         
Next time you run rtgen.exe with the same parameters the program will pick up         
where the precomputation left off and continue the generation of the rainbow         
table.&nbsp;
</p>

<p>When the generation of first rainbow table is finished. There will be a file      
named &quot;lm_alpha#1-7_0_2100x8000000_all.rt&quot; (128000000 bytes) in the      
directory. Don't rename the file because we store some parameters in the file      
title.&nbsp;
</p>

<p>Now the time to generate the remaining rainbow tables, make sure you have     
enough free disk space (128000000 bytes for each table):    
</p>

<table border="0" width="100%" cellspacing="0" bgcolor="#EBEBEB">
  <tr>
    <td width="100%"> 
      rtgen lm alpha 1 7 1 2100 8000000 all<br>
      rtgen lm alpha 1 7 2 2100 8000000 all<br>
      rtgen lm alpha 1 7 3 2100 8000000 all<br>
      rtgen lm alpha 1 7 4 2100 8000000 all</td> 
  </tr>
</table>
<p>Replace &quot;lm&quot; with &quot;md5&quot; or &quot;sha1&quot; if you want.      
</p>

<p>Leave you computer working ...<br>      
......<br>
......<br>
<br>
<br>
When the precomputation is complete, make sure the following files are in place:<br>      
128,000,000 bytes&nbsp;&nbsp;&nbsp; lm_alpha#1-7_0_2100x8000000_all.rt<br>      
128,000,000 bytes&nbsp;&nbsp;&nbsp; lm_alpha#1-7_1_2100x8000000_all.rt<br>      
128,000,000 bytes&nbsp;&nbsp;&nbsp; lm_alpha#1-7_2_2100x8000000_all.rt<br>      
128,000,000 bytes&nbsp;&nbsp;&nbsp; lm_alpha#1-7_3_2100x8000000_all.rt<br>      
128,000,000 bytes&nbsp;&nbsp;&nbsp; lm_alpha#1-7_4_2100x8000000_all.rt      
</p>

<p>If everything goes well, backup all files (recommended) and proceed to the 
next section of the tutorial.
</p>

<h2>4. Sort rainbow tables with rtsort.exe  
</h2>

<p>To speed up the search of rainbow table, we should sort the rainbow table 
with &quot;rtsort.exe&quot; in advance.<br>
In fact &quot;rcrack.exe&quot; only accept sorted rainbow tables.<br>
<br>
Use these commands: 
</p>

<table border="0" width="100%" cellspacing="0" bgcolor="#EBEBEB">
  <tr>
    <td width="100%">rtsort lm_alpha#1-7_0_2100x8000000_all.rt<br> 
      rtsort lm_alpha#1-7_1_2100x8000000_all.rt<br> 
      rtsort lm_alpha#1-7_2_2100x8000000_all.rt<br> 
      rtsort lm_alpha#1-7_3_2100x8000000_all.rt<br> 
      rtsort lm_alpha#1-7_4_2100x8000000_all.rt</td> 
  </tr>
</table>
<p>Each command will take several minutes to complete. The 
&quot;rtsort.exe&quot; utility will sort the file and write back to the original 
file.<br>
<br>
Notice: If free memory size is smaller than the file size, we can't load the 
file into memory at a time. In which case extra free disk space as large as the 
file to be sorted is required to apply an external sort. 
</p>

<p>If everything goes well, proceed to the next section. 
</p>

<h2>5. Crack the hash with rcrack.exe and the sorted rainbow    
tables 
</h2>

<p>Finally you have everything ready. Now the time to play with    
&quot;rcrack.exe&quot;.<br>
Notice the file &quot;random_lm_alpha#1-7.hash&quot; in the distribution. It
contain 10 randomly generated lanmanager hashes(charset alpha, length 1-7). We
will use this file as a test vector.<br>
<br>
Launch the program by issuing the command:</p>  
<table border="0" width="100%" cellspacing="0" bgcolor="#EBEBEB">
  <tr>
    <td width="100%">rcrack c:\rainbowcrack\*.rt -l random_lm_alpha#1-7.hash</td> 
  </tr>
</table>

<p>You should replace &quot;c:\rainbowcrack\&quot; with where you place the
sorted rainbow tables. It seems that you will find the plaintext of all 10
lanmanager hashes. Now open the file &quot;random_lm_alpha#1-7.plain&quot; and
validate the result of rcrack.exe. If they match, that is ok.</p>  

<p>To crack some windows password, the syntax is similar:</p>  
<table border="0" width="100%" cellspacing="0" bgcolor="#EBEBEB">
  <tr>
    <td width="100%">pwdump2 > pwfile.txt<br>
      rcrack c:\rainbowcrack\*.rt -f pwfile.txt</td> 
  </tr>
</table>

<p>The pwdump2 utility is used to dump the lanmanager hashes of windows system.
If your password consists of letters only, rcrack will be able to crack it with
the success rate 99.9%.<br>
<br>
Have fun!<br>
<br>
Create date: 2003/9/9<br>
Revised: 2003/11/21</p>

</body>

</html>