linux Password Circumvention

Sometimes it is necessary to get past the passwords set up for computer systems. Whether the password was forgotten, typed incorrectly when it was set, or an employee has departed without passing on the password, it needs to be reset. There are two ways to accomplish this process. If you have access to the security account management (SAM) file, you can crack it using a brute-force password cracking tool. Otherwise, you may have to overwrite the old password using a tool made for that purpose.

Most Linux vulnerabilities are manifested in one of several ways:

> Poorly configured services or applications

> Buffer overflows

> Generally poor system security

The vulnerabilities in Linux do not tend to reside in the kernel of the operating system itself, and as such, you will not be performing actual exploits of Linux in the next two labs. Instead, the discussion covers areas of vulnerability and methods of preventing security breaches on Linux systems. This lab will focus on the local machine (within the local network area), including privilege escalation and password cracking.

Materials Required

Completion of th.is lab requires the following software be instilled and configured on your workstation:

> Kali Linux

>John the Ripper version 1.7.9

Estimated Completion Time

If you are prepared, you should be able to complete this lab in 60 to 75 minutes.

Lab Part 1 Password Circumvention Testing with John the Ripper

In this section, you will perform two tasks. The first is intended to acquaint you with Linux file permissions and passwords. The second will demonstrate a Linux/UNIX password cracker called John the Ripper.

Linux Permissions and Passwords

For this lab, you will have to switch back and forth between root-level and user-level access. You can do this fairly quickly with the su command. You may wish to note your assigned username and password (both user- and root-level here)

Username:

Root password:

1. From the command line, gain root privileges by executing the su command and enter the root password. Once you are logged in as root, create a directory by typing:

mkdir <yournametemp> and press Enter.

Change the current directory to th.is directory by typing:

cd <yournametemp> and press Enter.

2. Now, type the following at the command line:

ls -a and press Enter.

You should see a listing of the files in your new directory.You should not have any at this point. Create three files using the touch command. Type the following, and press Enter

touch file.txt file2 file3.myfile

3. Now execute the -l option of is, like this:

ls -l and press Enter.

You should see the following:

4. As you can see in, all of these files start out with read and write permissions for the owner (root) and read permission for everyone else (the owner's group and the rest of the world). This is the equivalent of the command chmod 644.

5. Say you want to restrict access to the file file3.myfile. You wan t it to be completely off limits to anyone except the owner (root).Execute the command:

chmod 600 file3.myfile

After doing this, you can then type ls -1 to check the permissions as shown below.

6. Now, change to your standard user accou nt by typing su <username>. You should still be in the directory with the new files you have created.Try to access the file file3.myfile by typing:

cat f ile3.myf ile

Were you denied access? You should see results similar to those shown below. Now try to access the other two files the same way, by typing cat followed by the filename. What happens? Because the files arc empty, you should be returned to the command line without

an error. If the file had con tent, it would be displayed on the screen.

7. Now, change back to the root user by typing su root, pressing Enter, and then providing the root password. Another useful command for changing permissions is the chown command. This command allows you to change the file or directory's owner. Now, as the root user, type the following:

chown <Username> f ile3.myf ile and press Enter.

' Now type ls -l to see the permissions as shown below:

8. Once again, switch back to the user account by typing su <username>. Now try to access the file by typing cat f ile3.myf ile and press Enter. Were you allowed to access the file?

9. As your regular user account, attempt to access the /etc/shadow file by typing cat /etc/shadow at the command prompt. You should be told that you are denied permission. Use the su command to become the root user, and then repeat the command. You should get a listing of the machines users and encrypted passwords. List some of the entries here:

10. The command to create a user in Linux is useradd. There are several options for this command (this is not all of them):

> -c -Add a comment about the user account (full name is often entered)

> -d-The user's home directo1y

> -e -User account expiration date

> -g -The user's primary group (a number or name)

> -G -Any supplemental groups of which the user is a member

> -s -Specify the user's shell (example: /bin/ bash)

> -u -Set the user's UID (user ID number)

Next, you create a new user in Linux. For simplicity's sake, name this account the same as your existing user account name, but add a "2" to the end. So, for example, if your username is "jsmith," the new user is "jsmith2."This makes it easier to manage for you and your instructor.

11. At the command prompt (still acting as root user), type the following (all together):

useradd <Username2> and press Enter.

Useradd cjustice2

This user needs a password.To assign an initial password for the user, type this:

passwd <username2> and press Enter.

Passwd cjustice2

You are prompted for a password for the user. Enter the same characters as the username for now. Do you get an error message? If so, what does it say? Why? Record your responses here:

Now type the command:

cat /etc/passwd and press Enter.

Look for the new user and write its entry here:

cjustice2:x:1000:1001::/home/cjsutice2:/bin/sh

12. One of the key aspects of any user account is password aging. For those of you unfamiliar with this term, it means controls the administrator implements to manage how often users change their passwords. The command in Linux that handles this is chage, and it has several options, as well:

> -m Specifies the minimum number of days between password changes

> -M Specifies the maximum number of days between password changes

> -W The number of days before a user gets a warning message that his or her password will be rendered invalid

> -E Specifies the expiration date (YYYY-MM-DD format)

> -I (Uppercase i) Specifies the number of days the password can be inactive before the account is disabled

> -1 (Lowercase L) Lists current settings

Next, you 'll add some password aging restriction s to the new user. A simple way to get a user to change their password immediately upon the next login is to execute the chage command as follows:

chage -d 0 <Username2> and press Enter.

That is a zero (0) after the -d flag. Upon the next login of the user, they will be

prompted to enter a new password. Now, continue being logged in as root, and type the following command:

chage -1 <username2> and press Enter.

Write down what the console returns:

13. Now, execute the following commands (pressing Enter after each command): chage -m 5 -M 60 -w 10 -E 2014-01-01 -I 10 <username2> chage -1 <username2>

Write down what the console returns:

Cracking Linux Passwords with John the Ripper

For this lab, you will make use of a popular *nix password cracker called John the Ripper, affectionately referred to as "John" by security professionals. John is fast and flexible, and for this lab, the target account to crack will be the previously created user account from the prior lab.

Create a simple password list or find one online that is compatible with John, and save it as a text file in the /usr/bin/john directory. You also must run John as root.

1. From the command line as root, type yum -y install john and press Enter to install John the Ripper.

2. Create a simple password list or find one online that is compatible with John, and save it as a text file in your home directory.

3. Type john. You see a list of commands, similar to those shown below.

4. Now as root, move to your home directory and execute John by typing:

John - -wordlist=<passwordfile /etc/shadow

john /etc/shadow -w password.lst

Using default input encoding: UTF-8

Loaded 5 password hashes with no different salts (tripcode [DES 128/128 AVX])

Warning: OpenMP is disabled; a non-OpenMP build may be faster

Press 'q' or Ctrl-C to abort, almost any other key for status

0g 0:00:00:00 DONE (2015-11-22 12:07) 0g/s 32200p/s 32200c/s 161000C/s 123456..sss

Session completed

5. Depending on the order of the users listed in /etc/shadow and the order of the passwords listed in the password file, you may get results instantaneously or have to wait a few minutes. If you get results, they probably resemble below.

6. Now, type this command:

john /etc/shadow -show and press Enter.

You see the current results from John as shown in figure 4.20-7 (the password is the

second field).

Linux Passwords and Rainbow Tables

A rainbow crack is a technique that allows the creation of a hash cracker, a tool that allows one to pre­ compute all possible passwords up to a specified length using a specified hashing algorithm.When the resulting password/ hash pairs (known as rainbow tables) are stored in a database, the hashed values can be used for a reverse lookup of the actual password. This approach is capable of decoding most applica­ tion level encryptions within seconds.The rainbow tables, which require a lot of precomputation time, need very little actual "cracking" time. This trade-off allows for a user to do a lot of computing time once, and then quickly crack an MDS, SHA1, LM, or NTLM password. While Windows is very suscep­ tible to this type of attack (using very insecure LM hashes, and newer, more secure NTLM hashes), most versions of Linux are not susceptible to this attack since they rou tinely use a process known as "salting" of password hashes. A salt is a randomly chosen set of characters that is added to an MDS or similar hash, and then stored in plaintext in front of the password. This effectively makes the use of rainbow tables against salted passwords exponentially more difficult, increasing the amount of precomputation time and memory to the multiple terabyte level, making password cracking with these tables very impractical