Crack The Code - That's A Direct Challenge
by Darren Miller
Published on this site: May 27th , 2005 - See
more articles from this month...
I Challenge You To Crack The Code
I had quite an interesting experience recently. I was hired by a
company to perform a vulnerability assessment and penetration test
on their network. During the initial meeting, one of the key technical
staff presented me with a challenge; He handed over the NTLM hash
of the domain Administrator account and challenged me to decipher
it. He explained that the complexity and length of the password
would prevent me from deciphering it during the time allotted for
the project. He was actually quite confident in my impending failure.
In most cases, this individual would have been right on the mark.
On the other hand, I'm not sure he expected to challenge someone
who has close associates with discretionary time on some of the
most powerful computers in the world.
How Does The Average Person Deal With This
I wrote in a previous article how bad a feel for the average person
having to deal with such things. It is increasingly becoming a nightmare
for all to deal with. For the technical among us, it's not as bad
given that we deal with such things on a technical level almost
everyday.
Given this current flood of SPAM I thought I would post an article
I wrote quite some time ago. It's a short article, and may be old
news for some, but I can tell you that many people still don't follow
the basic's when dealing with SPAM.
6 Hours, 2 Servers, 64GB of Memory, and 32 Processors Later
and.....
It took just under six hours to decipher the password. Of course,
my 'associates' were using a program of my choice on servers with
32 processors and 64GB of RAM a piece. It's nice to have friends
with access like this. Especially in my line of work. Needless to
say, my client was shocked when I called him the next day and gave
him the password.
Let's Have Some Fun: A Challenge For You
(In order for you to do this, you need to go to:
http://www.defendingthenet.com/NewsLetters/
CrackTheCode-ThatsADirectChallenge.htm)
Shortly after this experience, I started thinking about writing
an article about it. Then I thought to myself, why write just an
article? Why not come up with a challenge for our readers?
Hidden in this article is information that will ultimately
provide you with a phrase that has been encrypted. You will
need to know a few pieces of general information such as,
where to find the hash in this article, how to extract the
hash from the article, what the password is that will reveal
the hash, and what type of hash is being used! Still with
me on this? You will need to do all this before you can start
cracking the encrypted phrase.
First, you need to find the hashed phrase located in this
article. I'll give you a hint; I recently wrote an article
about hiding messages in files. This article can be found
on the Defending The Net Newsletter Archive. It is also in
the www.CastleCops.com
archive. Oh, and once you find where the hash is you will
need a password to extract it. This one I am going to give
away. The password to extract the hash is 'letmein' (without
the ' ' of course).
Then, you will need a tool that can easily handle deciphering
of the hash once you extract it from this article. There are
quite a few out there that will do the job, however, I highly
recommend using pnva naq noyr i2.69, a publicly available
security tool that no self respecting security engineer should
be without. You will also need to know the type of hashing
algorithm that was used. I decided to use zrffntr qvtrfg svir
because it is relatively well-known. (Try saying that 13 times
real fast!)
So let's get Cracken!!
Conclusion
The first person to successfully unravel this riddle and e-mail
me at [email protected] with the deciphered phrase, along
with a detailed description of how they accomplished the task,
will receive a 512MB, USB2.0 Jump Drive. As soon as we receive
this information we will post it on the main page of www.defendingthenet.com
and www.castlecops.com
Darren Miller is an Information Security Consultant
with over sixteen years experience. He has written many technology
& security articles, some of which have been published
in nationally circulated magazines & periodicals. Darren
is astaff writer for www.defendingthenet.com
andseveral other e-zines. If you would like to contact Darren
you can e-mail him at [email protected]
or [email protected].
If you would like to know more about computer security please
visit us at http://www.defendingthenet.com.
If someone you know has sent you this article, please take
a moment to visit our site and register for the free newsletter
at http://www.defendingthenet.com/subscribe.htm
|
