[转载]Uncrackable Win2k/NT4 Passwords
<P><FONT face=Arial size=2>信息来源：<A href="http://www.sysopt.com/">[url]http://www.sysopt.com/[/url]</A></FONT></P><P><FONT face=Arial size=2>文章作者：<A href="http://www.sysopt.com/feedback.php/http://www.sysopt.com/tutorials/article.php/12034_3532756_1">Joel Kleppinger</A></FONT> </FONT></P>
<P><FONT face=Arial size=2></FONT></P>
<P><FONT face=Arial size=2>On the first Christmas when the angels proclaimed "Peace on earth, good will to all," they must not have included the NT family in that proclamation. You are likely already familiar with the password (in)security in Windows NT 4.0. However, you might be less familiar with the changes Microsoft did and didn't make in Windows 2000. This article is an overview of those items, how Windows 2000 passwords can be cracked, and how to make it impossible for current password crackers to crack NT4 or 2000 passwords. Yes, it really can be done. </FONT></P>
<P></P>
<P>Before launching into the topic, however, there are a few bits of information that are pertinent to understanding the subject matter, as well as my own perspective, interests, and understandings. First, the information in the uncrackable password section was discovered by Scott Crawford, a Network Administrator for Evangel University. The zip file, which is available for <A href="http://www.sysopt.com/img/legacy/Alt-Chars1.zip">download</A>, is entirely his work and effort. Second, as for myself, I have always had an ear to the ground regarding OS security as it has interested me since my mid high school years. Since I am not much of a programmer, there is much I do not understand when it comes to the exact algorithms of the way things work, so I can only offer some semi-educated speculation in those respects. Still, I do understand quite well the user and wannabe hacker or lame hacker perspectives and can offer interesting analysis from those points of view. This isn't the be-all/end-all of Windows 2000 security, but is a simple tip of the way things are as I see them.</P>
<P><FONT size=+1><B>Windows 2000 and NT4 Passwords</B></FONT></P>
<P>It has long been known that the algorithm used in the LAN Manager password scheme is particularly weak. Considering that LAN Manager is Windows for Workgroups era technology, in the Windows 2000 era, we wonder why we need to care. Unfortunately, this is an issue of backward compatibility and since all Windows are designed for out-of-the-box intuitiveness and compatibility (for the "Just work, [expletive]!" crowd), Windows 2000 and NT4 both enable LAN Manager compatibility by default.</P>
<P>The problem with LAN Manager compatibility is that Microsoft chose to store passwords on an NT/2000 machine in both NTLM and LM hash forms. Because of this, anyone who has access to one has access to the other. Obviously, crackers are going to take the easier route, so they'll just grab the LM hash and try to crack it. It is, after all, the same password.</P>
<P>The vulnerability of the LM hash is that it can be broken into seven character password halves. So instead of having a 14 character password that might take a full 100 years of current computer time to crack, you end up with two seven-character passwords, which each take about a month to crack (and L0phtCrack would check them both simultaneously, making the crack time a month total). The cracker can also significantly cut down on the number of keys that have to be checked if it can be determined that only letters and numbers, or just letters were used in the password. For the weakest non-dictionary-word passwords, it could take as little as three hours to exhaust the keyspace for even a 14 character LAN Manager password.</P>
<P><FONT size=+1><B>How Windows 2000 Differs</B></FONT></P>
<P>It used to be that any lamer (second-rate hacker) could just run L0phtCrack against an NT4 domain server and get the entire username and password hash list and start cracking away. With Windows 2000, however, it's quite a bit more difficult. No longer can they just install L0phtCrack and get the hashes from the registry of any local or networked Windows 2000 machine. Although Windows 2000 returns values that L0phtCrack will accept, the hashes are not true NTLM or LM hashes and thus are worthless, at least to L0phtCrack 2.5.</P>
<P>The way most crackers will try to get in is by making the <A href="http://www.webspan.net/~tas/pwdump2/" target=_new>pwdump2</A> program run on the domain controller. (It must run locally on the controller, as there is no way to run it on a workstation to attack another computer). Speculatively, the only way to get the correct hashes remotely is to copy the file to the domain controller, get an administrator (or be an administrator and use telnet) to run pwdump2 on the domain controller, and then get the results in some form that can then be used by L0phtCrack.</P>
<P>Windows 2000 also differs from NT by using Kerberos password authentication. Kerberos works by considering the password a private key and then gets a bit of information from the server, which is encrypted with the key and returned to the server. The server then checks the encyrpted information, and if it can decrypt it with the password, the user is authenticated. Thus, there is no way to get login information by sniffing for passwords and hashes over the network. Unfortunately, this works <B>only</B> with other Windows 2000 systems and within a Windows 2000-only environment. Unix has had Kerberos authentication capabilities for years, but some sections of the protocol that Microsoft used weren't in the specifications, which made their implementation incompatible with all other Kerberos-capable systems.</P>
<P>Windows 2000 is almost the same as NT4 simply because it still stores the same hashes. It merely makes it hard to get to them. This is especially important in the next section, since both operating systems treat hashes in the same way, making a password that is uncrackable on one uncrackable on the other.</P>
<P><FONT size=+1><B>Uncrackable NT4/Windows 2000 Passwords: They Exist</B></FONT></P>
<P>Most passwords are built on the notion of time. Users don't deny that a password is uncrackable; they merely say that it would take so long to crack them that it isn't even worth trying. Through a bit of ingenuity, curiosity, and a stroke of luck, Scott Crawford managed to come across passwords that couldn't be cracked, at least not by today's tools.</P>
<P>The method is so simple, it's beautiful. It's based on the fact that L0phtCrack only offers to crack up to 68 of the 256 possible characters in the ASCII character set. So he wondered, what about the other characters? His research discovered that there are 187 characters of 308 (some extra Windows characters are also allowed in passwords) that could not be cracked by L0phtCrack 2.5. All of these characters are ones that are only accessed only by pressing ALT plus a three or four digit number on the numeric keypad.</P>
<CENTER><IMG height=360 alt="Table of Uncrackable Alt-Characters" src="http://www.sysopt.com/img/legacy/table.gif" width=477> </CENTER>
<P>
<P>The way to test the crackability of these passwords is simple. Create 308 users, one for each character, each with the character both as the user name and as the password. Then, use a custom character set of all possible characters or run the list of characters through a dictionary file, creating the identical characters in the file. In effect, every password exists both in the user name and in the dictionary file. L0phtCrack actually checks both for the password (if you have a user name that is also the password, L0phtCrack will determine that instantly). After running the dictionary file through, we discovered there were many that weren't cracked by L0phtCrack.</P>
<P>After several runs on multiple machines, both Windows NT4 and 2000, we determined that these 187 characters were, in effect, uncrackable.</P>
<P><FONT size=+1><B>What This Means</B></FONT></P>
<P>Incorporating any one of these 187 characters into your password instantly makes it uncrackable to L0phtCrack. It doesn't matter how long the password, since the use of just one of these characters automatically means that it can't be cracked.</P>
<P>Now this isn't to say that at some time in the future, there might be a tool that could check for these characters and resolve hashes for them. In fact, that tool may already exist, but we just haven't been made aware of it yet. As far as we know, this writing is the first publicity this research has received anywhere. Scott Crawford has emailed the creators of L0phtCrack repeatedly regarding this information, but has never received a reply.</P>
<P>So you might be thinking, "Oh, well this is not really anything special. Tomorrow there will be a tool that can check for these characters as well and this will make this whole article moot and worthless." Well, not exactly. You see, doubling the number of characters in the character set that must be searched also doubles the length of time it will take. If my math is correct, this doesn't just double the total length of time, but instead doubles the amount of time it takes per character. This means that if you have a 7 character password, it will take 2<FONT size=1><SUP>7</SUP></FONT> or 128 times longer to crack. So even if there is a tool out there that can crack these characters, it must be configured to crack them, meaning it must search through all 380 possible characters.</P>
<P>That's why most crackers, especially the lamers and wannabes, limit their password cracking to dictionary attacks, letters and possible letters plus numbers (36 total characters). Nearly all of the time, if you make it past those cracking waves, they will either find an easier target or some other way in.</P>
<P>This brings us to the final reason that it's important to consider this, even if a capable tool exists. Most of the crackers out there are posers and wannabes, just messing around for kicks. There is a reason that so many system administrators feared L0phtCrack. It made life for the kiddie hackers incredibly easy. Just as with any other application (take Windows, for example), people typically gravitate toward the easiest way to do a task, even if it isn't necessarily the best method. The vast majority of the cracking population will tend to use L0phtCrack even if a more capable alternative exists, simply because it is quite fast and simple to use.</P>
<P>Keep in mind that this covers only one small element of overall system and network security. Keystroke loggers and fast eyes can still spy on the keystrokes to get the password, and of course, if someone has physical access to a given machine, you must consider it compromised. So, incorporate strong ALT-character password use along with your other network security standards to have the best possible security.</P>
<P>Network Administrators need fear L0phtCrack and the script kiddies no more.</P>
<P>
<BLOCKQUOTE><I>For more information, see the following:</I></BLOCKQUOTE>
<UL>
<LI><A href="http://www.l0pht.com/l0phtcrack/" target=_new>[url]http://www.l0pht.com/l0phtcrack/[/url]</A>
<LI><A href="http://www.windowsitsecurity.com/Articles/Index.cfm?ArticleID=9186" target=_new>[url]http://www.windowsitsecurity.com/Articles/Index.cfm?ArticleID=9186[/url]</A>
<LI><A href="http://www.win2000mag.net/Channels/Windows2000/TopicResults.cfm?TopicID=75" target=_new>[url]http://www.win2000mag.net/Channels/Windows2000/TopicResults.cfm?TopicID=75[/url]</A>
<LI><A href="http://www.lanw.com/training/interop/securityurls.htm" target=_new>[url]http://www.lanw.com/training/interop/securityurls.htm[/url]</A> </LI></UL>
<BLOCKQUOTE>You may download <A href="http://www.sysopt.com/tutorials/article.php/Alt-Chars.txt">this file</A> to see a list of the ALT codes with each of the associated characters</BLOCKQUOTE>
页:
[1]