Installing “John the Ripper” – The Password Cracker

Posted on by admin

“John the Ripper” – is a fast password cracker. Its primary purpose is to detect weak Unix passwords.

Most likely you do not need to install “John the Ripper” system-wide.

Instead, after you extract the distribution archive and possibly compile the source code (see below), you may simply enter the “run” directory and invoke John from there.

Compiling “John the Ripper”

Step 1: Download the latest version of ““John the Ripper”” and its signature

$ wget http://www.openwall.com/john/g/john-1.7.9.tar.bz2
$ wget http://www.openwall.com/john/g/john-1.7.9.tar.bz2.sign
$ wget http://www.openwall.com/signatures/openwall-signatures.asc

Step 2: Confirm the signature

This is a safety measure as we are dealing with dangerous thing.

Install the public key:

$ pgp -ka openwall-signatures.asc

Check the signature:

$ pgp john-1.7.9.tar.bz2.sign john-1.7.9.tar.bz2
gpg: Signature made Wed 23 Nov 2011 01:38:48 PM CAT using RSA key ID 295029F1
gpg: Good signature from "Openwall Project <signatures@openwall.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 0C 29 43 AE 1E CD 24 EA  6E 0C B6 EE F5 84 25 69

You will see the message similar to the above. Ignore the warning as long as it says Good signature from “Openwall Project … “.

The warning is normal, see http://www.kernel.org/signature.html for more details.

Step 3: Uncompress and compile the sources

$ tar xvfj john-1.7.9.tar.bz2
$ cd john-1.7.9/src/
$ make
To build John the Ripper, type:
make clean <system>
where SYSTEM can be one of the following:
linux-x86-64-avx         Linux, x86-64 with AVX (2011+ Intel CPUs)
linux-x86-64-xop         Linux, x86-64 with AVX and XOP (2011+ AMD CPUs)
linux-x86-64             Linux, x86-64 with SSE2 (most common)
***

Note the make target for your system and type:

$ make clean <system>

Where <system> is the appropriate make target. Alternatively, if your system is not listed, use:

$ make clean generic

If everything goes well, this will create the executables for John and its related utilities under “../run/”.

Alternatively, you may copy the entire “run” directory to anywhere you like and use John from there.

Now you can change directory to there and test John, like this:

$ cd ../run/
$ ./john --test
Many salts:	400332 c/s real, 400332 c/s virtual
Only one salt:	383795 c/s real, 391627 c/s virtual
---
Benchmarking: BSDI DES (x725) [32/32 BS]... DONE
Many salts:	13362 c/s real, 13388 c/s virtual
Only one salt:	13299 c/s real, 13299 c/s virtual
---
Benchmarking: FreeBSD MD5 [32/32 X2]... DONE
Raw:	9225 c/s real, 9225 c/s virtual
***

Installing “John the Ripper” on Ubuntu

Execute the next command to install “John the Ripper” on Ubuntu:

$ sudo apt-get install john

Installing “John the Ripper” on CentOS/RHEL

Execute the next command to install “John the Ripper” on CentOS/RHEL:

$ yum install john
11 Comments

HowTo: Identify Hash Type

Posted on by admin

There are two main things, that can help to identify hash type:

  • The length of the hash (each hash function has a specific output length);
  • The alphabet used (are all english letters? numbers 0-9 and A-F so hex? what special characters are there if any?).

There is a cool script, named “Hash Identifier”. The name pretty much describes it.

Step 1: Download a latest version (v1.1 at the moment)

$ wget https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/hash-identifier/Hash_ID_v1.1.py

Step 2: Execute the script and paste the hash

$ python Hash_ID_v1.1.py
   -------------------------------------------------------------------------
 HASH: hccQ.YzR6GuuY
Possible Hashs:
[+]  DES(Unix)
   -------------------------------------------------------------------------
 HASH: LZ55ugFXQpfyw
Possible Hashs:
[+]  DES(Unix)
   -------------------------------------------------------------------------
 HASH:

Step 3: Press Ctrl + C to interrupt

2 Comments

HowTo: Create a Linux Fork Bomb

Posted on by admin

Fork bomb is a form of denial-of-service attack against a computer system which makes use of the fork operation (or equivalent functionality), whereby a running process can create another running process.

Fork bombs typically do not spread as worms or viruses, but it works by creating a large number of processes very quickly in order to saturate the available space in the list of processes kept by the operating system.

If the process table becomes saturated, no new programs can start.

Once this code is executed, within seconds your system will freeze and then you have to hard boot the system.

A bash shell fork bomb may look like this:

:(){:|:&};:

The above can be explained as:

Function Description
🙁 ) define a function ‘:’ — so whenever we say ‘:’, execute this function
{ beginning of what to do when we say ‘:’
: load another copy of the ‘:’ function into memory…
| …and pipe its output to…
: …another copy of ‘:’ function, which has to be loaded into memory (therefore, ‘:|:’ simply gets two copies of ‘:’ loaded whenever ‘:’ is called)
& disown the functions — if the first ‘:’ is killed, all of the functions that it has started should NOT be auto-killed
} end of what to do when we say ‘:’
; Having defined ‘:’, we should now…
: …call ‘:’, initiating a chain-reaction: each ‘:’ will start two more

A more simple form, can be written as:

forkbomb() { forkbomb | forkbomb & } ; forkbomb
4 Comments

What is my Public IP address?

Posted on by admin

Use one of the following commands to check your public IP address from the Linux command line.

Get the Public IP address from the Linux Command Line

0. Easy to Remember Services

Get your external IP address using the curl command:

$ curl ifconfig.me
$ curl ip.appspot.com
$ curl icanhazip.com

Get your external IP address using the wget command:

$ wget -q -O - ifconfig.me
$ wget -q -O - ip.appspot.com
$ wget -q -O - icanhazip.com

Get the External IP address using DynDNS.org

1. Using the wget command:

$ wget -q -O - checkip.dyndns.org | sed -e 's/.*Current IP Address: //' -e 's/<.*$//'

2. Using the curl command:

$ curl -s checkip.dyndns.org | sed -e 's/.*Current IP Address: //' -e 's/<.*$//'

3. Using the lynx command:

$ lynx -dump checkip.dyndns.org | sed -e 's/.*Current IP Address: //' -e 's/<.*$//' | sed '/^$/d'
2 Comments

HowTo: Kill TCP Connections in CLOSE_WAIT State

Posted on by admin

If you are seeing a large number of connections persisting in a CLOSE_WAIT state, it is probably an issue with the application itself.

Restarting it will clear the connections temporarily, but to find the real cause of the issue you would have to do the investigation.

If restarting of application is undesirable, you can manually kill all connections that are in the CLOSE_WAIT state.

Kill CLOSE_WAIT connections

Kill CLOSE_WAIT connections by IP

Kill TCP connections in CLOSE_WAIT state, established with the foreign IP address 192.168.0.100:

$ netstat -anp |\
  grep 192.168.0.100 |\
  grep CLOSE_WAIT |\
  awk \'{print $7}\' |\
  cut -d \/ -f1 |\
  grep -oE \"[[:digit:]]{1,}\" |\
  xargs kill

The same command in one line :

$ netstat -anp | grep 192.168.0.100 | grep CLOSE_WAIT | awk \'{print $7}\' | cut -d \/ -f1 | grep -oE \"[[:digit:]]{1,}\" | xargs kill

Kill CLOSE_WAIT connections by Port

Kill TCP connections in CLOSE_WAIT state on port 80:

$ netstat -anp |\
  grep \':80 \' |\
  grep CLOSE_WAIT |\
  awk \'{print $7}\' |\
  cut -d \/ -f1 |\
  grep -oE \"[[:digit:]]{1,}\" |\
  xargs kill

The same command in one line:

$ netstat -anp | grep \':80 \' | grep CLOSE_WAIT | awk \'{print $7}\' | cut -d \/ -f1 | grep -oE \"[[:digit:]]{1,}\" | xargs kill

Kill CLOSE_WAIT connections by IP & Port

Kill TCP connections in CLOSE_WAIT, state established with foreign IP address 192.168.0.100 on port 80:

$ netstat -anp |\
  grep 192.168.0.100 |\
  grep \':80 \' |\
  grep CLOSE_WAIT |\
  awk \'{print $7}\' |\
  cut -d \/ -f1 |\
  grep -oE \"[[:digit:]]{1,}\" |\
  xargs kill

The same command in one line:

$ netstat -anp | grep 192.168.0.100 | grep \':80 \' | grep CLOSE_WAIT | awk \'{print $7}\' | cut -d \/ -f1 | grep -oE \"[[:digit:]]{1,}\" | xargs kill

Explanation

$ netstat -anp |\  # print network connections
  grep 192.168.0.100 |\  # established with IP 192.168.0.100
  grep \':80 \' |\  # established on port 80
  grep CLOSE_WAIT |\  # connections in CLOSE_WAIT state
  awk \'{print $7}\' |\  # print the 7th column
  cut -d \/ -f1 |\  # extract PIDs
  grep -oE \"[[:digit:]]{1,}\" |\  # extract PIDs
  xargs kill  # kill PIDs
8 Comments

Moving SSL Certificate from IIS to Apache

Posted on by admin

This procedure will help you to move or copy your SSL certificate, installed on an IIS server to an Apache server.

Step 1: Export IIS certificate into a .PFX file

  • Run mmc.exe
  • Click the ‘Console’ menu and then click ‘Add/Remove Snap-in’.
  • Click the ‘Add’ button and then choose the ‘certificates’ snap-in and click on ‘Add’.
  • Select ‘Computer Account’ then click ‘Next’.
  • Select ‘Local Computer’ and then click ‘OK’.
  • Click ‘Close’ and then click ‘OK’.
  • Expand the menu for ‘Certificates’ and click on the ‘Personal’ folder.
  • Right click on the certificate that you want to export and select ‘All tasks’ -> ‘Export’.
  • A wizard will appear. Make sure you check the box to include the private key and continue through with this wizard until you have a .PFX file.

Step 2: Extract the private key

Export the private key file from the .PFX file.

$ openssl pkcs12 -in filename.pfx -nocerts -out key.pem

Step 3: Extract the certificate file

Export the certificate file from the .PFX file.

$ openssl pkcs12 -in filename.pfx -clcerts -nokeys -out cert.pem

Step 4: Remove the passphrase

This command removes the passphrase from the private key so Apache won’t prompt you for your passphase when it starts.

$ openssl rsa -in key.pem -out server.key

Extra Steps

Make sure that the following lines are present in your apache virtual host configuration file and they are correct:

SSLEngine on
SSLOptions +StrictRequire
SSLCertificateFile /path/to/certificate/cert.pem
SSLCertificateKeyFile /patch/to/key/server.key

Don’t forget to restart apache at the end.

3 Comments

HowTo: Retrieve Email from a POP3 Server using the Command Line

Posted on by admin

The POP3 (Post Office Protocol Version 3) is an application-layer Internet standard protocol used by local Email clients to retrieve Email from a remote server over a TCP/IP connection.

This tutorial shows how to connect to POP3 mail server and manage incoming Email using the ‘telnet’ command.

Step 1: Open a connection from your computer to a POP3 mail server

$ telnet pop.domain.ext 110
Trying ???.???.???.???...
Connected to pop.domain.ext.
Escape character is '^]'.
+OK ready
  • pop.domain.ext – Your mail server;
  • 110 – Default port for POP3.

Step 2: Type your Login

> USER username
+OK Password required for UserName.

Step 3: Type your Password

> PASS password
+OK username has ? visible messages (? hidden) in ????? octets.

POP3 Commands with Description

Here are the basic POP3 commands, that you can use to manage your incoming Email.

Command Description Example
USER [username] 1st login command USER Stan
+OK Please enter a password
PASS [password] 2nd login command PASS SeCrEt
+OK valid logon
QUIT Logs out and saves any changes QUIT
+OK Bye-bye.
STAT Returns total number of messages and total size STAT
+OK 2 320
LIST Lists all messages LIST
+OK 2 messages (320 octets)
1 120
2 200
…
LIST 2
+OK 2 200
RETR [message] Retrieves the whole message RETR 1
+OK 120 octets follow.
***
DELE [message] Deletes the specified message DELE 2
+OK message deleted
NOOP The POP3 server does nothing, it merely replies with a positive response. NOOP
+OK
RSET Undelete the message if any marked for deletion RSET
+OK maildrop has 2 messages (320 octets)
TOP [message] [number] Returns the headers and number of lines from the message TOP 1 10
+OK
***
3 Comments

HowTo: Decode CSR

Posted on by admin

A Certificate Authority will use a CSR to create your SSL certificate.

What is a CSR? A CSR or ‘Certificate Signing Request’ is a block of encrypted text, that is generated on the server that the certificate will be used on.

It contains information that will be included in your certificate, such as your organization name, common name (domain name), locality, and country. It also contains the public key that will be included in your certificate.

Run these OpenSSL commands, to decode your Certificate Signing Request, and verify that it contains the correct information.

Extract information from the CSR

$ openssl req -in shellhacks.com.csr -text -noout

Verify the signature

$ openssl req -in shellhacks.com.csr -noout -verify

Whom the certificate will be issued to?

$ openssl req -in shellhacks.com.csr -noout -subject

Show the public key

$ openssl req -in shellhacks.com.csr -noout -pubkey
2 Comments

HowTo: Send Email from an SMTP Server using the Command Line

Posted on by admin

The SMTP (Simple Mail Transfer Protocol) is an Internet standard for electronic mail (Email) transmission across Internet Protocol (IP) networks.

This tutorial shows how to connect to SMTP mail server and send an Email using the ‘telnet’ command.

Step 1: Open a connection from your computer to an SMTP mail server

$ telnet smtp.domain.ext 25
220 smtp.domain.ext ESMTP Sendmail ?version-number?; ?date+time+gmtoffset?
  • smtp.domain.ext – Your mail server;
  • 25 – Default port for SMTP.

Step 2: Declare your domain name or IP-address

You can set local.domain.name or anything you want in ‘HELO’, because the server doesn’t check its authenticity, that is one of the drawbacks of this protocol.

> HELO local.domain.name
250 smtp.domain.ext Hello local.domain.name [xxx.xxx.xxx.xxx], pleased to meet you

Step 3: Set sender’s email

> MAIL FROM: sender@adress.ext
250 2.1.0 sender@adress.ext... Sender ok

Step 4: Set recipient’s email

> RCPT TO: recipient@adress.ext
250 2.1.5 recipient@adress.ext... Recipient ok

Step 5: To write the message, type DATA and press ‘Enter’

> DATA
354 Enter mail, end with "." on a line by itself

Step 6: On the first line type ‘SUBJECT: Your Subject’ and press ‘Enter’ twice

> SUBJECT: Test message

Step 7: Continue typing your message

Hello,
this is a TEST message, 
please don't reply.
Thank you.

Step 8: Put a single period (.) on a line by itself and press ‘Enter’ to send your message.

> .
250 2.0.0 ???????? Message accepted for delivery

Step 9: Close the connection

> QUIT
221 2.0.0 server.com closing connection
5 Comments

HowTo: Decode SSL Certificate

Posted on by admin

Waht is an SSL Certificate? SSL Certificate provides security for your website by encrypting communications between the server and the person visiting the website.

It contains information about your Organization and Certificate Authority. It also contains the public key.

Run these OpenSSL commands, to decode your SSL Certificate, and verify that it contains the correct information.

Extract information from the SSL Certificate

$ openssl x509 -in shellhacks.com.crt  -text

Who issued the cert?

$ openssl x509 -in shellhacks.com.crt -noout  -issuer

To whom was it issued?

$ openssl x509 -in shellhacks.com.crt -noout -subject

For what dates is it valid?

$ openssl x509 -in shellhacks.com.crt -noout -dates

The above, all at once

$ openssl x509 -in shellhacks.com.crt -issuer -noout -subject -dates

What is its hash value?

$ openssl x509 -in shellhacks.com.crt -noout -hash

What is its MD5 fingerprint?

$ openssl x509 -in shellhacks.com.crt  -noout  -fingerprint
2 Comments