Hey There,
A post ago, we took a look at using od on Linux or Unix. Hopefully, it made the use of that cryptic command somewhat more accessible.
Today, I thought we'd take a look at using the "od" command for a less practical purpose. Much like crypt (and a much older post we did on using simple encryption and decryption using Perl's pack and unpack functions), the quick-and-dirty Perl script we're putting out today is a pretty good way to keep people who don't know what they're reading from rifling through your stuff ;)
The script is simple enough, and only takes two arguments. You can either instruct it to convert a file from ASCII to octal, like so:
host # ./octala.pl -o shell.pl
or the opposite ( octal to ASCII conversion ):
host # ./octala.pl -a shell.pl.od <--- Assuming you're just running this script and accepting the default extension we popped on the end (BTW, by default, this line of code will add an ".as" extension to your file. The original is never destroyed. But that can be easily fixed by adding a line of code if you like. ...just don't forget to back up any file you might need!)
Below is a simple demonstration of the script in action, followed by the real deal. Note that we only substitute four characters that aren't "representable" (SPC = a space, HT = a tab, LF = a line feed, CR = a carriage return -- actually the CR and LF are both replaced with a new-line).
Here's to people not knowing what you're up to ;)
Cheers,
Ex:
host # cat shell.pl <--- This script is one of our old ones with some lines chopped off, so it probably won't run :)#!/usr/bin/perl
if ( $port =~ /\D/) {
$port = getservbyname($port, $protocol) || die "getservbyname ${port}/$protocol\n";;
}
$inet_address = inet_aton($host) || die "inet_aton: ${host}\n";
$port_address = sockaddr_in($port, $inet_address);
$protocol_num = getprotobyname('$protocol');
while (1) {
$shell_shock=accept(NEWSOCKET, SOCKET)|| die "accept $!\n";
dup2(STDERR,2);
system("/bin/sh -i");
close($shell_shock);
}
exit;
host # ./octala -o shell.pl <--- Here we convert the file to octal, and strip out the offset field.
host # cat shell.pl.od
043 041 057 165 163 162 057 142 151 156 057 160 145 162 154 012
012 151 146 040 050 040 044 160 157 162 164 040 075 176 040 057
134 104 057 051 011 173 012 011 044 160 157 162 164 040 075 040
147 145 164 163 145 162 166 142 171 156 141 155 145 050 044 160
157 162 164 054 040 044 160 162 157 164 157 143 157 154 051 040
174 174 040 144 151 145 040 042 147 145 164 163 145 162 166 142
171 156 141 155 145 040 044 173 160 157 162 164 175 057 044 160
162 157 164 157 143 157 154 134 156 042 073 073 012 175 012 044
151 156 145 164 137 141 144 144 162 145 163 163 040 075 040 151
156 145 164 137 141 164 157 156 050 044 150 157 163 164 051 040
174 174 040 144 151 145 040 042 151 156 145 164 137 141 164 157
156 072 040 044 173 150 157 163 164 175 134 156 042 073 012 044
160 157 162 164 137 141 144 144 162 145 163 163 040 075 040 163
157 143 153 141 144 144 162 137 151 156 050 044 160 157 162 164
054 040 044 151 156 145 164 137 141 144 144 162 145 163 163 051
073 012 044 160 162 157 164 157 143 157 154 137 156 165 155 040
075 040 147 145 164 160 162 157 164 157 142 171 156 141 155 145
050 047 044 160 162 157 164 157 143 157 154 047 051 073 012 012
167 150 151 154 145 040 050 061 051 011 173 012 011 044 163 150
145 154 154 137 163 150 157 143 153 075 141 143 143 145 160 164
050 116 105 127 123 117 103 113 105 124 054 040 123 117 103 113
105 124 051 174 174 040 144 151 145 040 042 141 143 143 145 160
164 040 044 041 134 156 042 073 012 011 144 165 160 062 050 123
124 104 105 122 122 054 062 051 073 012 011 163 171 163 164 145
155 050 042 057 142 151 156 057 163 150 040 055 151 042 051 073
012 011 143 154 157 163 145 050 044 163 150 145 154 154 137 163
150 157 143 153 051 073 012 175 012 145 170 151 164 073 012
host # ./octala -a shell.pl.od <--- and here we take that octal file and translate it back to ASCIIhost # cat shell.pl.od.as
#!/usr/bin/perl
if ( $port =~ /\D/) {
$port = getservbyname($port, $protocol) || die "getservbyname ${port}/$protocol\n";;
}
$inet_address = inet_aton($host) || die "inet_aton: ${host}\n";
$port_address = sockaddr_in($port, $inet_address);
$protocol_num = getprotobyname('$protocol');
while (1) {
$shell_shock=accept(NEWSOCKET, SOCKET)|| die "accept $!\n";
dup2(STDERR,2);
system("/bin/sh -i");
close($shell_shock);
}
exit;
host # diff shell.pl shell.pl.od.as <--- Cool - They're exactly the same :)
This work is licensed under a
Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License#!/usr/bin/perl
#
# octala.pl - convert files from octal to ASCII or reverse
# Usage: octala [-o|-a] input_file
#
# 2008 - Mike Golvach - eggi@comcast.net
#
# Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License
#
if ( $#ARGV != 1 ) {
print "Usage: $0 [-o|-a] input_file\n";
exit(1);
}
$oct_or_asc = $ARGV[0];
$input_file = $ARGV[1];
if ( ! -f $ARGV[1] ) {
print "File $input_file can't be found! Over\n";
exit(2);
}
$tmp=$$;
%otoa = qw(000 NUL 001 SOH 002 STX 003 ETX 004 EOT 005 ENQ 006 ACK 007 BEL 010 BS 011 HT 012 LF 013 VT 014 FF 015 CR 016 SO 017 SI 020 DLE 021 DC1 022 DC2 023 DC3 024 DC4 025 NAK 026 SYN 027 ETB 030 CAN 031 EM 032 SUB 033 ESC 034 FS 035 GS 036 RS 037 US 040 SPC 041 ! 042 " 043 # 044 $ 045 % 046 & 047 ' 050 ( 051 ) 052 * 053 + 054 , 055 - 056 . 057 / 060 0 061 1 062 2 063 3 064 4 065 5 066 6 067 7 070 8 071 9 072 : 073 ; 074 < 075 = 076 > 077 ? 100 @ 101 A 102 B 103 C 104 D 105 E 106 F 107 G 110 H 111 I 112 J 113 K 114 L 115 M 116 N 117 O 120 P 121 Q 122 R 123 S 124 T 125 U 126 V 127 W 130 X 131 Y 132 Z 133 [ 134 \ 135 ] 136 ^ 137 _ 140 ` 141 a 142 b 143 c 144 d 145 e 146 f 147 g 150 h 151 i 152 j 153 k 154 l 155 m 156 n 157 o 160 p 161 q 162 r 163 s 164 t 165 u 166 v 167 w 170 x 171 y 172 z 173 { 174 | 175 } 176 ~ 177 DEL);
if ( $oct_or_asc eq "-o" ) {
system("od -b $input_file >odfile.$tmp");
open(TMPODFILE, "<odfile.$tmp");
@TMPODFILE = <TMPODFILE>;
close(TMPODFILE);
open(NEWODFILE, ">$input_file.od");
foreach $odline (@TMPODFILE) {
if ( $odline =~ /^\w+$/ ) {
next;
}
$odline =~ s/^\w+ //;
print NEWODFILE $odline;
}
close(NEWODFILE);
unlink("odfile.$tmp");
} elsif ( $oct_or_asc eq "-a" ) {
open(TMPASFILE, "<$input_file");
@TMPASFILE = <TMPASFILE>;
close(TMPASFILE);
open(NEWASFILE, ">$input_file.as");
foreach $asline (@TMPASFILE) {
@asline = split(" ", $asline);
foreach $aschunk (@asline) {
$fixedaschunk = $otoa{$aschunk};
$fixedaschunk =~ s/SPC/ /;
$fixedaschunk =~ s/HT/\t/;
$fixedaschunk =~ s/LF/\n/;
$fixedaschunk =~ s/CR/\n/;
print NEWASFILE $fixedaschunk;
}
}
close(NEWASFILE);
unlink("odfile.$tmp");
} else {
print "Unrecognized option: $oct_or_asc\n";
exit(3);
}
, Mike
linux unix internet technology
Friday, May 2, 2008
Perl Script To Do Lame Encryption With Octal Dump On Linux Or Unix
Thursday, February 21, 2008
Generating Encrypted Strings For Password Restoration
Greetings,
This is a little bit of a twist on an old post (one of many, actually) that we did on password cracking in Linux and Unix using Perl.
In the previous entry in our ongoing series of randomly connected password hacking posts, and pretty much every other one of them, we've looked at how to guess passwords using brute force methods, or otherwise "figure out" a users password. For those of you who missed it, check out this post on generating all possible 8 character passwords with Perl.
Today, we're going to look at something similar, but different enough that it warrants its own post: How to generate the encrypted string (given a user name and password) that you can use to manually edit your Linux or Unix system's shadow file and change someone's password. Of course, you'd need elevated privileges (or a means to get them) in order to do this. But, for the purposes of this post, we'll just assume you do.
Looking at this ethically, it's a good way to get yourself out of a sticky situation if you garble the root password and have to boot off of CD into single user mode and "have to" manually edit the shadow file so you can log back in!
Basically, the script below accepts two forms of input, which we've elected to read from STDIN. This can be easily modified to take arguments, although we chose this method so that the password you were trying to recreate the encrypted field for wouldn't show up in anyone else's "ps" output.
The nature of DES is such that, for virtually every invocation of this script, given the exact same username and password, you'll end up generating an entirely unique string. However, when this is decrypted by the "crypt" function on your OS, each unique string will resolve to the same password you entered each and every time.
Of course, we don't officially endorse cutting and pasting into your shadow file (and strongly recommend you run "pwconv" afterward if you have to), but hopefully this little reverse-password-cracking Perl script will help save your bacon at least once :)
Best wishes and enjoy,
This work is licensed under a
Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License#!/usr/bin/perl
#
# encrypted password field generator
#
# 2008 - Mike Golvach - eggi@comcast.net
#
# Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License
#
print "Enter a user name: ";
$name = <STDIN>;
system("stty -echo");
print "Password: ";
$pass = <STDIN>;
system("stty echo");
print "\n";
chop($name);
chop($pass);
print &cryptPwd($name,$pass);
print "\n";
sub cryptPwd
{
local($cp_name,$cp_passwd) = @_;
@cp_saltine = ('a' .. 'z','A' .. 'Z', '0' .. '9','.','/');
$now = time();
($cp_name_pt1, $cp_name_pt2) = unpack ("C2",$cp_name);
$week = $now / (60*60*24*7) + $cp_name_pt1 + $cp_name_pt2;
$cp_numsalt = $cp_saltine[$week % 64] . $cp_saltine[$now % 64];
$cp_cryptpass = crypt($cp_passwd,$cp_numsalt);
return($cp_cryptpass);
}
, Mike
linux unix internet technology
Wednesday, January 16, 2008
Perl Password Cracker For Linux and Unix
As you may recall, from a few postings ago, we took a look at wrapping a popular password cracker in Unix and/or Linux shell scripting for ease of use.
In today's post, we're actually going to do the password cracking ourselves!
This code has been tested on Solaris Unix and RedHat Linux and is 100 percent guaranteed to be somewhat entertaining ;) Again, I feel obligated to note that this software is for recreational use only and is actually intended to help system administrators find weak passwords in order to maximize security (In tomorrow's post, we'll look at a way to help with generating new passwords that will have everyone on your watch begging to be able to create their own ;)
This script makes use of Perl's built-in crypt function, which works in much the same way as the standard Unix or Linux crypt function does. Since we haven't yet figured out how to break the level of encryption you, hopefully, have on your systems, this program could also be considered a password guesser.
I wrote this up so that it can be invoked simply by its name, like so:
./pwdcheck
and requires no argument. This version prompts for input. It could be easily modified to accept command line arguments, but I left that alone for now, since it's not the main aim of the script. This script is also very simple, as I wanted to demonstrate the shell script concept of password guessing in its purest form. If you choose to try and find a single password you would type the name in when prompted. For a list of passwords, you would type in the name of the list (absolute or relative) with passwords in it (one to a line). Then the script will check your /etc/shadow file for any passwords that match your guess.
It's no lie that this method of password cracking is far less sophisticated than the methods used by products like John The Ripper, etc. However, it does demonstrate how the crypt function works and what really goes on at the guts of all of those types of programs (JTR, for instance, uses fastcrypt and does its own word manipulation outside of the "guessing" routine).
Hope you enjoy this and find some use for it. Tomorrow, we'll look at a script that will produce random passwords (great for helping out with system administration) that you can use for input to this script.
Cheers,
This work is licensed under a
Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License#!/usr/bin/perl
#
# pwdcheck - Simple password checker.
# Works with password file input, one
# password per line, or one password
# at a time. Must be root to execute!
#
# 2008 - Mike Golvach - eggi@comcast.net
#
# Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License
#
#
print "Will you be checking one password or a list of them? [P or L]\n";
chomp($answer=<stdin>);
$answer=~ tr/A-Z/a-z/;
if ($answer eq "p") {
print "password to check?\n";
chomp($guess=<stdin>);
print "Do you keep your password entries in passwd,\n";
print "shadow, or another file? [P, S or O]\n";
chomp($reply=<stdin>);
$reply=~ tr/A-Z/a-z/;
if ($reply eq "s") {
open(SHADOW, "</etc/shadow");
} elsif ($reply eq "p") {
open(SHADOW, "</etc/passwd");
} elsif ($reply eq "o") {
print "What's the absolute pathname of the file?\n";
chomp($pathname=<stdin>);
if ( -f $pathname) {
open(SHADOW, "<$pathname");
} else {
print "I don't think it's there...\n";
exit;
}
} else {
print "Can't find that anywhere...\n";
exit;
}
@SHADOW=<SHADOW>;
foreach $LINE (@SHADOW) {
@line=split(/:/, $LINE);
$passwd{$line[1]} = $line[0];
}
foreach $PART (@SHADOW) {
@stab=split(/:/, $PART);
if (crypt($guess, $stab[1]) eq $stab[1]) {
print "Got $guess for user $passwd{$stab[1]}!\n";
$yes = 1;
}
}
if ( $yes eq 1) {
exit;
} else {
print "...Doesn't look like it...\n";
}
} elsif ($answer eq "l") {
print "Name of word file?\n";
chomp($passfile=<stdin>);
print "Absolute pathname of passwd, shadow or\n";
print "other relevant file?\n";
chomp($shadow=<stdin>);
open(SHADOW, "<$shadow");
@SHADOW=<SHADOW>;
foreach $LINE (@SHADOW) {
@line=split(/:/, $LINE);
$passwd{$line[1]} = $line[0];
}
close(SHADOW);
open(PWDFILE, "<$passfile");
@passfile=<PWDFILE>;
foreach $guess (@passfile) {
$guess=~ s/\s//g;
print "Checking for $guess ...\n";
open(SHADOW, "<shadow");
foreach $PART (@SHADOW) {
@stab=split(/:/, $PART);
if (crypt($guess, $stab[1]) eq $stab[1]) {
print "Got $guess for user $passwd{$stab[1]}!\n";
open(PD, ">>Passwords");
print PD "Login: $passwd{$stab[1]}\t\tPassword: $guess\n";
close(PD);
}
close(SHADOW);
}
}
} else {
print "Which part didn't you get?\n";
}
exit;
, Mike
linux unix internet technology
