286 lines
11 KiB
Plaintext
286 lines
11 KiB
Plaintext
Decryption of Win95 Passwords
|
|
|
|
----------------------------------------------------------------------------
|
|
|
|
Basically, you should be aware that if you ever mount disks from Unix
|
|
machines to Windows95 machines, the passwords of the unix machine (or
|
|
your other file servers) will be stored on the Windows machine's disk
|
|
essentially in the plain, and any 10-year computer-literate kid with a
|
|
little knowledge will be able to retrieve them in seconds if he gets
|
|
access to client machine.
|
|
|
|
The message below explains the details. Essentially it means that
|
|
the whole encryption scheme used by Microsoft in Windows95 is a Bad
|
|
Joke. Not only does it use too short keys (breakable by brute force
|
|
in 8 hours on a normal workstation), but additionally it screws up the
|
|
implementation, meaning that your keys can be trivially decrypted
|
|
in a fraction of a second without ever even brute-forcing the key.
|
|
The program to do this is below.
|
|
|
|
I find this kind of "security" shocking. I think this should go to
|
|
the mass media. At least make people at your sites aware of this
|
|
fiasco.
|
|
|
|
Tatu
|
|
|
|
------- start of forwarded message (RFC 934 encapsulation) -------
|
|
From: Frank Andrew Stevenson
|
|
To: cypherpunks@toad.com
|
|
Subject: Cracked: WINDOWS.PWL
|
|
Date: Mon, 4 Dec 1995 17:51:36 +0100 (MET)
|
|
|
|
A few days ago Peter Gutmann posted a description on how
|
|
Windows 95 produces RC4 keys of 32 bits size to protect
|
|
the .pwl files. I verified the information and wrote a
|
|
program to decrypt .pwl files with a known password, I then
|
|
discovered that the .pwl files where well suited for a known
|
|
plaintext attack as the 20 first bytes are completely predictable.
|
|
|
|
The 20 first bytes of any .pwl files contains the username, which
|
|
is the same as the filename, in capitals, padded with 0x00. From then
|
|
I wrote a program to bruteforce the .pwl file and optimized it
|
|
so it would run in less than 24 hours on an SGI. I run a test
|
|
of the bruter software and recovered an unknown rc4 key in 8 hours,
|
|
but the decrypted file was still largely uninteligeble, I then proceeded
|
|
to decrypt the file at all possible starting points, and discovered
|
|
valuable information (cleartext passwords) offset in the file.
|
|
|
|
This has enormous implications: RC4 is a stream cipher, it
|
|
generates a long pseudo random stream that it uses to XOR the
|
|
data byte by byte. This isn't neccecaraly weak encryption if you
|
|
don't use the same stream twice: however WIN95 does, every resource is
|
|
XORed with the same pseudo random stream. What's more the 20
|
|
first bytes are easy to guess. This is easy to exploit:
|
|
XOR the 20 bytes starting at position 0x208 with the user name
|
|
in uppercase, and slide this string through the rest of the file
|
|
(xoring it with whatever is there) this reveals the 20
|
|
first bytes of the different resources.
|
|
|
|
>From there I went on to study the structure of the .pwl file it is
|
|
something like this (decrypted):
|
|
|
|
USERNAME.........wpwpwpwpwpwpwpwpwpwp
|
|
rs???????
|
|
rs
|
|
rs
|
|
rs???????????
|
|
rs???????
|
|
|
|
where wp is i word pointer to the different resources (from start
|
|
of pwl file) The 2 first bytes of the resource (rs) is its length in bytes
|
|
(of course XOR with RC4 output) It is the fairly easy to find all the
|
|
resource pointers by jumping from start of resource to next resource,
|
|
had it not been for the fact that the size sometimes is incorrect
|
|
(courtesy of M$)
|
|
|
|
What follows is a short c program that tries to remedy this and
|
|
reconstruct the pointertable thus generating at least 54 bytes of the RC4
|
|
pseudorandom stream, and then proceedes to decrypt as much as possible from
|
|
the different resources.
|
|
|
|
What does this show? Although RC4 is a fairly strong cipher, it has the
|
|
same limitations as any XOR streamcipher, and implementing it without
|
|
sufficient knowledge can have dire consequences. I strongly suggest that
|
|
the programmers at Microsoft do their homework before trying anything like
|
|
this again!
|
|
|
|
|
|
DISCLAIMER:
|
|
This is a quick hack, I don't make any claims about usefulness for
|
|
any purpose, nor do I take responsibility for use nor consequences of
|
|
use of the software. FUNCOM of Norway is not responsible for any of this,
|
|
(I speak for myself, and let others speak for themselves)
|
|
|
|
This source is hereby placed in the public domain, please
|
|
improve if you can.
|
|
|
|
- --- glide.c ---
|
|
|
|
#include
|
|
#include
|
|
|
|
unsigned char Data[100001];
|
|
unsigned char keystream[1001];
|
|
int Rpoint[300];
|
|
|
|
main (int argc,char *argv[]) {
|
|
FILE *fd;
|
|
int i,j,k;
|
|
int size;
|
|
char ch;
|
|
char *name;
|
|
int cracked;
|
|
int sizemask;
|
|
int maxr;
|
|
int rsz;
|
|
int pos;
|
|
int Rall[300]; /* resource allocation table */
|
|
|
|
if (argc<2) {
|
|
printf("usage: glide filename (username)");
|
|
exit(1);
|
|
}
|
|
|
|
/* read PWL file */
|
|
|
|
fd=fopen(argv[1],"rb");
|
|
if(fd==NULL) {
|
|
printf("can't open file %s",argv[2]);
|
|
exit(1);
|
|
}
|
|
size=0;
|
|
while(!feof(fd)) {
|
|
Data[size++]=fgetc(fd);
|
|
}
|
|
size--;
|
|
fclose(fd);
|
|
|
|
/* find username */
|
|
name=argv[1];
|
|
if(argc>2) name=argv[2];
|
|
printf("Username: %s\n",name);
|
|
|
|
/* copy encrypted text into keystream */
|
|
cracked=size-0x0208;
|
|
if(cracked<0) cracked=0;
|
|
if(cracked>1000) cracked=1000;
|
|
memcpy(keystream,Data+0x208,cracked );
|
|
|
|
/* generate 20 bytes of keystream */
|
|
for(i=0;i<20;i++) {
|
|
ch=toupper(name[i]);
|
|
if(ch==0) break;
|
|
if(ch=='.') break;
|
|
keystream[i]^=ch;
|
|
};
|
|
cracked=20;
|
|
|
|
/* find allocated resources */
|
|
|
|
sizemask=keystream[0]+(keystream[1]<<8);
|
|
printf("Sizemask: %04X\n",sizemask);
|
|
|
|
for(i=0;i<256;i++) Rall[i]=0;
|
|
|
|
maxr=0;
|
|
for(i=0x108;i<0x208;i++) {
|
|
if(Data[i]!=0xff) {
|
|
Rall[Data[i]]++;
|
|
if (Data[i]>maxr) maxr=Data[i];
|
|
}
|
|
}
|
|
maxr=(((maxr/16)+1)*16); /* resource pointer table size appears to be divisible by 16 */
|
|
|
|
/* search after resources */
|
|
|
|
Rpoint[0]=0x0208+2*maxr+20+2; /* first resource */
|
|
for(i=0;i> 8) & 0x00ff;
|
|
}
|
|
cracked+=maxr*2+2;
|
|
|
|
printf("%d bytes of keystream recovered\n",cracked);
|
|
|
|
/* decrypt resources */
|
|
for(i=0;i < maxr;i++) {
|
|
rsz=Rpoint[i+1]-Rpoint[i];
|
|
if (rsz>cracked) rsz=cracked;
|
|
printf("Resource[%d] (%d)\n",i,rsz);
|
|
for(j=0;j
|
|
E3D2BCADBEF8C82F A5891D2B6730EA1B PGPencrypted mail preferred, finger for key
|
|
|
|
------- end -------
|
|
|
|
From owner-best-of-security@suburbia.net Tue Dec 5 11:25:09 1995
|
|
Return-Path: owner-best-of-security@suburbia.net
|
|
Received: from mail5 (root@mail5.netcom.com [192.100.81.141]) by onyx.infonexus.com (8.6.12/8.6.9) with ESMTP id LAA08923 for ; Tue, 5 Dec 1995 11:25:04 -0800
|
|
Received: from yarrina.connect.com.au by mail5 (8.6.12/Netcom)
|
|
id LAA16224; Tue, 5 Dec 1995 11:19:40 -0800
|
|
Received: from suburbia.net (suburbia.apana.org.au [192.188.107.90]) by yarrina.connect.com.au with ESMTP id GAA21167
|
|
(8.6.12/IDA-1.6); Wed, 6 Dec 1995 06:08:54 +1100
|
|
Received: (majordom@localhost) by suburbia.net (8.6.12/Proff-950810) id GAA20352 for best-of-security-outgoing; Wed, 6 Dec 1995 06:07:49 +1100
|
|
Received: from tavor.openu.ac.il (root@tavor.openu.ac.il [147.233.128.1]) by suburbia.net (8.6.12/Proff-950810) with SMTP id GAA20347 for ; Wed, 6 Dec 1995 06:
|
|
Received: from ramon.openu.ac.il[rafi]
|
|
by tavor.openu.ac.il with SMTP id AA26474
|
|
(5.67a8/IDA-1.5 for ); Tue, 5 Dec 1995 21:06:56 +0200
|
|
Received: by ramon.openu.ac.il id AA01003
|
|
(5.67a8/IDA-1.5); Tue, 5 Dec 1995 21:06:53 +0200
|
|
Date: Tue, 5 Dec 1995 21:06:50 +0200 (IST)
|
|
From: Rafi Sadowsky
|
|
X-Sender: rafi@ramon
|
|
To: Best Of Security List
|
|
Cc: FIRST Teams
|
|
Subject: BoS: win95 and WfWg .pwl files cracked(fwd)[folloup to yesterdays posting]
|
|
Message-Id:
|
|
Mime-Version: 1.0
|
|
Content-Type: TEXT/PLAIN; charset=US-ASCII
|
|
Sender: owner-best-of-security@suburbia.net
|
|
Errors-to: nobody@connect.com.au
|
|
Precedence: bulk
|
|
Reply-To: nobody@mail.uu.net
|
|
Status: RO
|
|
|
|
just thought the addition about exporting any shares ( due to the ../ bug in
|
|
MS/win* ) making your *.pwl files readable to the whole internet
|
|
night just make your life a trifle more interesting :-(
|
|
|
|
--
|
|
Rafi Sadowsky rafi@tavor.openu.ac.il
|
|
[postmaster@openu.ac.il] FAX: +972-3-6460744
|
|
|
|
---------- Forwarded message ----------
|
|
Date: Tue, 5 Dec 1995 23:12:12 +1100
|
|
From: samba-bugs@anu.edu.au
|
|
To: Multiple recipients of list
|
|
Subject: win95 and WfWg .pwl files cracked
|
|
|
|
I have just tried Frank Stevensons program for cracking .pwl files. It
|
|
indeed works.
|
|
|
|
With it I could obtain the plain text passwords from a Windows95 .pwl
|
|
file or a windows for workgroups .pwl file in less than a second. I
|
|
tried it on 3 different files. All were successfully decrypted.
|
|
|
|
This is very bad.
|
|
|
|
It means that anyone with access to a WfWg or Win95 box that has been
|
|
used to login to a samba (or NT or OS/2 etc) server can take the .pwl
|
|
files off the PC and use them to get valid passwords on the server.
|
|
|
|
Note that this is not directly a security hole in samba. Its a huge
|
|
security hole in the way WfWg and Win95 store their passwords on disk.
|
|
It equally affects networks which use NT and OS/2 server. It also
|
|
affects people who just use other WfWg and Win95 machines as servers.
|
|
|
|
Also, if your WfWg and Win95 systems have not been patched to avoid
|
|
the "cd ../" bug and you export any shares then anyone who can attach
|
|
to those shares can obtain your .pwl files. It doesn't matter what
|
|
directory you are exporting.
|
|
|
|
What can you do about this?
|
|
|
|
Well, if you don't care about security then just do nothing :-)
|
|
|
|
Otherwise:
|
|
|
|
First of all, change your router rules to disable tcp139, udp137 and
|
|
udp138 from entering your network from the Internet.
|
|
|
|
Secondly, disable your WfWG and Win95 boxes from saving passwords on
|
|
disk when connecting to SMB servers. Can someone please post clear
|
|
instructions on exactly how to do this? (preferably with how to make
|
|
it permanent)
|
|
|
|
Thirdly, delete all the .pwl files on your WfWG and Win95 boxes.
|
|
|
|
Theres probably more you should do. I only found out about this
|
|
decryption program a few minutes ago. I imagine more advice will be
|
|
forthcoming from other people on this list.
|
|
|
|
Andrew
|
|
|
|
----------------------------------------------------------------------------
|
|
|
|
[Image]
|
|
|
|
|