{"id":32,"date":"2012-07-19T22:15:36","date_gmt":"2012-07-20T05:15:36","guid":{"rendered":"http:\/\/seanmurphree.com\/blog\/?p=32"},"modified":"2012-07-19T22:52:43","modified_gmt":"2012-07-20T05:52:43","slug":"blowfish-level1","status":"publish","type":"post","link":"https:\/\/seanmurphree.com\/blog\/?p=32","title":{"rendered":"Blowfish Level1"},"content":{"rendered":"

Welcome back for another posting at Technolution. \u00a0Please remember the final password for today’s game will be stripped on this page and replaced with Y’s. \u00a0If you want to do the level, go do it. \u00a0Now, onto the games! \u00a0Today we’re going to be starting a new wargame on the SmashTheStack Network<\/a>, Blowfish! \u00a0You can find information about the Blowfish wargame on it’s main page, here<\/a>. \u00a0Reading up, this game already seems a little different in the way level 1 works. \u00a0Instead of ssh’ing in right away, we’re supposed to telnet to port 6666 of blowfish.smashthestack.org. \u00a0Upon connecting, an encrypted password will be sent to us for level 2. \u00a0However, as it is encrypted, we will have to decrypt it before we can use it to ssh into blowfish as level2.<\/p>\n

Today I’m working from Windows, so we’ll be using PuTTy to get the password. \u00a0Open Putty, choose telnet (since there is a protocol difference) and specify port 6666 on blowfish.smashthestack.org. \u00a0Before connecting, choose to never close window on exit. \u00a0We do this since the server closes the connection after sending the string and we need the window to stay open long enough for us to read the string ourselves. \u00a0Once you’re setup, go a head and connect. \u00a0Upon connecting we should get the following text:<\/p>\n

$1$4JKI4bjj$EucGdPgVb6uc4oTUQ.mJV0
\n———————————-<\/p>\n

Crack this passwd with john the ripper
\nand use the password to login with
\nssh level2@blowfish.smashthestack.org -p 2222<\/p>\n

– http:\/\/iamyas.blogspot.com\/2008\/01\/format-of-etcshadow-file.html<\/a>
\n– http:\/\/www.openwall.com\/john\/<\/a><\/p><\/blockquote>\n

Ok, that’s straight forward. \u00a0If you haven’t used john the ripper before, go download it from the above link. \u00a0John is a password cracking utility. \u00a0In this case we’re going to be cracking a md5 password hash from \/etc\/shadow. \u00a0John cracks password files and thus the password hashes have to be in the correct format. \u00a0Simply make a password.txt file (name doesn’t matter) in the john\\run directory (with the john.exe file). \u00a0Lines in the password.txt file should be for the format:<\/p>\n

username:password:last_password_change:min_days:max_days:warning:inactive:expired_date<\/p><\/blockquote>\n

That’s a long list, but for what we are doing the only important fields are the username:password fields. \u00a0To make use, let’s put the following in our password.txt file.<\/p>\n

level2:$1$4JKI4bjj$EucGdPgVb6uc4oTUQ.mJV0:::::::<\/p><\/blockquote>\n

Next, load a command prompt and change your current directory to wherever your john.exe file is. \u00a0From here we will use the dictionary list supplied by john, password.lst, to attempt to guess the password used for level2. \u00a0(The password that when encrypted by md5, gives the md5 hash we received above.) \u00a0To do this we use the follow command, and get the following results!<\/p>\n

c:\\…\\john179\\run> john –wordlist=password.lst passwd.txt
\nLoaded 1 password hash (FreeBSD MD5 [32\/32])
\nYYYYYYY (level2)
\nguesses: 1 time: 0:00:00:00 100% c\/s: 9533 trying: YYYYYYY<\/p><\/blockquote>\n

Tada! \u00a0Here we are. \u00a0John found the password that when encrypted with MD5, gives the same password hash as we had for username level2. \u00a0Now we can take that password and -following the instructions we received at the beginning of the level- ssh to port 2222 on blowfish.smashthestack.org and log in as level2\/YYYYYYY.<\/p>\n

In today’s example we used a wordlist. \u00a0That means that if the original password (in this case “YYYYYYY”) wasn’t in password.lst, then we would never have gotten the password. \u00a0This can be maneuvered around by using a brute force attack, and hopefully we’ll see something like that in a later level. \u00a0Brute force attacks end up trying all possible character combinations (given a specific character set) and thus don’t require lists. \u00a0However, for long enough passwords, brute forcing can take prohibitively long to get a password in the worst, or even average, case scenario. \u00a0(If you’re interested in brute force cracking and how long things are taking in 2011, I’d recommend watching the Economics of Password Cracking in the GPU Era<\/a> talk from Defcon19, by Robert “Hackajar” Imhoff-Dousharm of SanDisk Corporation.)<\/p>\n

Anyway, we’ll stop there for today. \u00a0Please check back later for the next level of Blowfish, as well as other wargames and postings!<\/p>\n","protected":false},"excerpt":{"rendered":"

Welcome back for another posting at Technolution. \u00a0Please remember the final password for today’s game will be stripped on this page and replaced with Y’s. \u00a0If you want to do the level, go do it. \u00a0Now, onto the games! \u00a0Today … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[16,6,4],"tags":[17,51,19,20,18,49,47],"_links":{"self":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/32"}],"collection":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=32"}],"version-history":[{"count":10,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/32\/revisions"}],"predecessor-version":[{"id":36,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/32\/revisions\/36"}],"wp:attachment":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=32"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=32"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=32"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}