+------------------------------------------------------+ | | | KILLER CRACKER: Portable Un*x Password Cracker | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | Version 2.00, Dated 12/01/91 | | | | Written By Doctor Dissector | | Converted -2- Amiga by Professor Falken | | | +------------------------------------------------------+ Disclaimer ---------- This program was written and released just to prove that Un*x accounts can be effectively cracked utilizing modified DES password encryption (crypt) routines and proper programming skills. I, Doctor Dissector, the author of Killer Cracker, and Professor Falken, the transmogrifier, do not endorse any type of illegal appropriation of computer accounts using programs such as this; the goal is only to prove that the Un*x operating system's greatest weakness in security lies in the /etc/passwd file. Doctor Dissector & Professor Falken will not be held responsible for the actions of anyone who may misuse this program since he cannot control the actions of the people who might become exposed to this program's use for illegal means. File Listing & Description -------------------------- KCReadNow -- You should have read this already, if not don't worry. kc.doc -- This document file kc1 -- 68000 Executable Specific Version - AmigaDOS 2.0 & 1.3 kc2 -- 68030 Executable Specific Version - AmigaDOS 2.0 & 1.3 kc3 -- 68040 Executable Specific Version - AmigaDOS 2.0 & 1.3 Goodword -- Small collection of words from various sources (60k+) Bigword -- Large collection of words from dictionary (200k+) Transf0rm -- 680x0 Executable to convert textfiles to KC wordlists Transf0rm.Doc -- Documentation for Transf0rm Description ----------- Killer Cracker (KC) is a program which effectively, and quickly, encrypts a sequence of guesses (words) utilizing a modified form of the DES Un*x password encryption alogrithm. These encrypted guesses are then compared to the fields in any typical /etc/passwd file; any matches are recorded for future reference. Guesses to KC are read from several sources. The primary source of guesses to encrypt come from a textfile (ASCII) of words separated by CR/LF pairs or LFs (depending on operating system). Other guesses are taken from each individual account in any /etc/passwd file; the login name and two respective GECOS field entries. In addition, single characters (a-z, A-Z, 0-9) and "funny" characters (^A-^Z, ESC, SPACE) can be tested as guesses as well. KC also has the ability to make several combinations for several guesses from one guess (i.e. test the guess in normal case, uppercase, lowercase, and backwards) and the option to pre-pend or append any number of characters to the beginning or end of any guessed word. Execution --------- Killer Cracker can be invoked using various methods from the command line. Normally, KC will be called directly from the command line; thus, usage from the command line will be discussed first. In order to obtain a brief summary of KC's options from the command line, KC can be invoked with the '-?' or '/?' flag. Incidentally, all flags to KC must be either preceded by a '-' or a '/' character. The following info will discuss KC's command line flags and offer detailed descriptions for each. Usage: kc -?bcfglostu -<1|2>[:] -[:] Parms: -1 prefix chars -p /etc/passwd file -v valid account file -2 suffix chars -w word file Flags: -? explain usage -b test backwards -c test up/low cases -f test funny chars -g test GECOS fields -l test login names -o suppress output -s single char test -t TEST crypt result -u user based crack Brief Summary Of Flags ---------------------- -? KC will print a brief summary of the available command line flags as shown above. Description Of Flags -------------------- -p[:] Filename/path+filename of the /etc/passwd file to be cracked. The ':' character is optional (can be used to clarify the command line). If no filename is specified, KC will prompt you for one. -w[:] Filename/path+filename of the wordfile where all password guesses are stored. Format of the words inside this wordfile must be one word per line, no blank lines are allowed. The ':' character is optional (can be used to clarify the command line). If no filename is specified, KC will prompt you for one. -v[:] Filename/path+filename of the output file, where all valid account/password combinations will be saved. The ':' character is optional (can be used to clarify the command line). If no filename is specified, KC will prompt you for one. -1[:] The characters KC will be instructed to pre-pend to the front of each word tested, one single character at a time. For example, if you used the flag "-1:abc", each test would test each word as "aWORD", "bWORD", and "cWORD". -2[:] The characters KC will be instructed to append to the end of each word tested, one single character at a time. For example, if you used the flag "-1:abc", each test would test each word as "WORDa", "WORDb", and "WORDc". -b KC will be instructed to create a word combination from the available guesses as the reverse (backwards) from of the original guess. KC is intelligent and will not repeat testing of guesses which are the same foreward and backward (i.e. "MOM" backwards is "MOM", KC will not test this guess in reverse). Refer to "Examples Of Guesses" for more information. -c KC will be instructed to create word combinations from the available guesses in all uppercase and all lowercase. KC is intelligent and guesses which are the same in all uppercase or all lowercase will be skipped from testing in the respective combination. See "Examples Of Guesses" for more information. -f KC will be instructed to test the "funny" control characters ^A-^Z, ESC, and SPACE as guesses before testing guesses from the wordfile. -g KC will be instructed to test two words from the /etc/passwd GECOS field of each individual account as guesses for that particular account. KC will skip over entries in the GECOS field who's second character is the '.' period character to avoid testing initials. -l KC will be instructed to test the login name from the /etc/passwd GECOS field of each individual account as a guess for that particular account. -o KC will be instructed to suppress all output from printing to the local console/monitor. Normally, information about the current session is printed to the standard output; however, if you wish run the program in the background, and suppress the output to the screen, this will effectively, make the process that much faster. -s KC will be instructed to test the single characters, a-z, A-Z, and 0-9 as guesses before testing guesses from the wordfile. -t KC will be instructed to test the result of a single, pre-installed, encrypt/comparison using the default encryption routines. If you get an encryption error, then your system WILL NOT effectively crack passwords. -u KC will be instructed to compare every word from the wordfile avainst an account before moging to the next account. When cracking by WORDS, KC will enable same-word-memory which increses speed over cracking by users up to 40%. Normally, KC will crack for passwords in the following format: Default Format -------------- word #1: test account #1's password test account #2's password... word #2: test account #1's password test account #2's password... word #3: test account #1's password test account #2's password... (etc.) This flag will instruct KC to follow the following format: Optional Format --------------- user #1's password: test word #1 test word #2 test word #3... user #2's password: test word #1 test word #2 test word #3... user #3's password: test word #1 test word #2 test word #3... (etc.) Usage Examples -------------- kc -c -p:passwd.212 -w:dict.txt -v:valid.212 The above command will instruct KC to read encrypted passwords from the file passwd.212 (/etc/passwd format), read guesses from the file dict.txt, and write any valid account/password combinations to the file valid.212. All guesses will be tested in normal, upper, and lowercase. Output will be verbose to the console. kc -cbo -ppwfile.txt -wwords.txt -vresults.txt The above command will instruct Killer Cracker to read encrypted passwords from the file pwfile.txt, read guesses from words.txt, and write all valid account/password combinations into results.txt. All guesses will be tested in normal, upper, lowercase and reverse-normal, reverse-upper, and reverse- lowercase. All output will be suppressed. kc -glu -ppasswd.txt -wwords.txt -vvalid.txt The above command will instruct Killer Cracker to read encrypted passwords from passwd.txt, read guesses from words.txt, and write valid account/password combinations to valid.txt. In addition, the account/login names will be tested as passwords for each account, and the GECOS field strings will be tested as passwords for each account. When cracking begins, KC will crack passwords using the optional format. Output will be verbose to the standard output. kc -c -p:passwd.txt The above command will instruct KC to read encrypted passwords from passwd.txt, interactively request the filenames for the wordfile and the validfile, and test guesses in normal, upper, and lowercase. Examples Of Guesses ------------------- Killer Cracker can test words as normal, uppercase, lowercase, reversed, and with numerical suffixes. The following table displays the guesses for the words "Guess", "password", "PW", and 'MOM'. The '$' fields are areas which are skipped because the guess would be a repeat and the 'X' fields are areas which are never accessed. +-----------------------------------------------------------------------+ | Flags | Normal | Upcase |Lowcase |Reverse |Ureverse|Lreverse| Suffix | |--------+--------+--------+--------+--------+--------+--------+--------| | "c" |Guess |GUESS |guess |XXXXXXXX|XXXXXXXX|XXXXXXXX|XXXXXXXX| | |password|PASSWORD|$$$$$$$$|XXXXXXXX|XXXXXXXX|XXXXXXXX|XXXXXXXX| | |PW |$$$$$$$$|pw |XXXXXXXX|XXXXXXXX|XXXXXXXX|XXXXXXXX| | |MOM |$$$$$$$$|mom |XXXXXXXX|XXXXXXXX|XXXXXXXX|XXXXXXXX| |--------+--------+--------+--------+--------+--------+--------+--------| | "r" |Guess |XXXXXXXX|XXXXXXXX|sseuG |XXXXXXXX|XXXXXXXX|XXXXXXXX| | |password|XXXXXXXX|XXXXXXXX|drowssap|XXXXXXXX|XXXXXXXX|XXXXXXXX| | |PW |XXXXXXXX|XXXXXXXX|WP |XXXXXXXX|XXXXXXXX|XXXXXXXX| | |MOM |XXXXXXXX|XXXXXXXX|$$$$$$$$|XXXXXXXX|XXXXXXXX|XXXXXXXX| |--------+--------+--------+--------+--------+--------+--------+--------| | "rc" |Guess |GUESS |guess |sseuG |SSEUG |sseug |XXXXXXXX| | |password|PASSWORD|$$$$$$$$|drowssap|DROWSSAP|$$$$$$$$|XXXXXXXX| | |PW |$$$$$$$$|pw |WP |$$$$$$$$|wp |XXXXXXXX| | |MOM |$$$$$$$$|mom |$$$$$$$$|$$$$$$$$|$$$$$$$$|XXXXXXXX| +-----------------------------------------------------------------------+ Killer Cracker's Symbols ------------------------ When Killer Cracker is cracking passwords and output is allowed to the standard output, KC will print one of three symbols to the console for each comparison done. "-" This symbol is printed to the standard output when KC has completed one encryption/comparison. "+" This symbol is printed to the standard output when KC has already cracked the account in question or if the account had been flagged as "inactive." KC will skip the encryption/ comparison as a result. "*" This symbol is printed to the standard output when KC is skipping the particular encryption/comparision because the guess tested would repeat a previous comparision using the same word in a different configuration. See "Examples Of Guesses" for information. Quitting Killer Cracker ----------------------- Normally, Killer Cracker will continue cracking until it has completed the last word (in the default format) or the last account (in the optional format). If cracking must be aborted in the middle of a job, go ahead, but as of THIS version, it will NOT save where you left off. So you will have to start all over again. Word to the wise: " DONT ABORT A 'KC' CRACKING SESSION " Notes ----- 1. When using the default format for cracking, Killer Cracker will skip accounts which already have been cracked in the following hypothetical format: Default Format, Hypothetical Situation: 10 words, 10 users. Word #1, Users Tested: 1,2,3,4,5,6,7,8,9,10 Word #2, Users Tested: 1,2,3,4,5,6,7,8,9,10 Word #3, Users Tested: 1,2,3,4,5,6,7,8,9,10 (Valid For User #3) Word #4, Users Tested: 1,2,4,5,6,7,8,9,10 Word #5, Users Tested: 1,2,4,5,6,7,8,9,10 Word #6, Users Tested: 1,2,4,5,6,7,8,9,10 (Valid For User #9) Word #7, Users Tested: 1,2,4,5,6,7,8,10 (Valid For User #5) Word #8, Users Tested: 1,2,4,6,7,8,10 Word #9, Users Tested: 1,2,4,6,7,8,10 Word #10, Users Tested: 1,2,4,6,7,8,10 When using the [u] option, Killer Cracker will jump to the next account when (if) a valid password is cracked for the current user. 2. When cracking accounts using Killer Cracking in "by-word" format, encryption/comparisions take place up to 100% (2x) faster than when cracking by users. This is due to an optimization in the encryption algorithm which allows KC to remember the mask of the current word being cracked and the calculation does not have to be re-done for all other comparisions with that same word. Note: these optimizations will not be as apparent when cracking a small amount of users and/or when cracking the login/gecos fields, as each user is tested against a different guess anyway. Notes On Getting MAXIMUM Crypts Per Second ------------------------------------------ Sucking the last particle of electron processing power out of your machine has been a favortie pastime of mine. Because of this, I think I have MY machine booting along at the MAXIMUM speed it can attain. Because Killer Cracker is SO dependent upon processing speed, these next few ideas may help you to squeeze 3-5 crypts per second more out of killer cracker. 1) DO NOT do anything in the background while Killer Cracker is running. In fact close all windows other than the one KC is running in. 2) DO NOT run KC from WORKBENCH (Possible in 2.0 not 1.3), WB munches the processor like Cookie Monster eats cookies. 3) DO NOT have any programs 'RESIDENT' such as VIRUS Checkers or other resident programs. However, AmigaDOS commands, such as DIR,LIST,etc. can be resident, it doesn't matter. 4) Once KC is running fine, RE-SIZE the window KC is in to the SMALLEST possible size. 5) Make sure you choose the KC version which is specific to your system. 68030 users, USE the 68030 version. Each version is SPECIALLY tailored for THAT particular processor. 6) Copy all necessary KC files into RAM: this will speed execution time because no HD access will be needed. Make sure you also RUN KC from RAM: (duh!). 7) Pour Liquid Nitrogen upon your motherboard to institute superconducting effects. Greetings: ---------- Greetings go out to Wintermute for helping me BETA this beast. Many thanks go out to Doctor Dissector for without him this program could not exist. Quick greets to: Anarchy, Max Lumens, Madman, Laviathon, Relayer, FANTASY, AGILE, and QUARTEX! And all the other people who think they should be in there too. If needed, I can be reached for comment on the following system: *SMASH* Palace (409)762-0839 - Professor Falken Releases to date: ----------------- CNA Inquiry v1.00 - Fantasy Distribution (10/91) TCK-Tear v1.00 - Independent Distribution (11/91) Transf0rm v1.00 - Alpha Flight Distribution (11/91) Killer Cracker v2.00 - PARADISE Distribution (11/91) MORE COMING... -------------------------------------------------------------------------- Thanx to Razor, So76, Scooter, PLAGUE, VIz, and all others who aided in the research and development of this password cracker. 1991-----------------------------------------------------------------EOF-