4

As part of a lab exercise I want to have an extremely weak password hash in the /etc/shadow file. How could I go about doing this? MD5 is not quite weak enough, and I'm editing the /etc/pam.d/common-password file to change the hashing algo. I was thinking I would do descrypt but I cannot get it to work.

Any ideas?

6
  • 6
    How weak do you need if MD5 isn't bad enough? It'll take less than a minute to bruteforce for a 6 character password on even low end hardware nowadays, given the hash...
    – Matthew
    Feb 17, 2017 at 16:42
  • 2
    I believe linux uses "md5crypt" which is significantly stronger than plain MD5. Check out hashcat benchmarks.
    – Joe Smith
    Feb 17, 2017 at 16:56
  • True, but it's still the fastest hash out of the formats supported by default. You could look at using one of the SHA options, with a really low round count ($6$rounds=1$...). The MD5 option doesn't support modifying the number of rounds.
    – Matthew
    Feb 17, 2017 at 17:11
  • 2
    You're probably going to want to revert back to ye ol' DES-based scheme. Feb 17, 2017 at 18:20
  • @XiongChiamiov I've been trying, but how do I exactly do that on a Ubuntu system? I've figured out how to do it on a RHEL based machine.. But there is no info about it on a ubuntu system so far..
    – Joe Smith
    Feb 17, 2017 at 19:16

1 Answer 1

6

There may be other possibilities depending on the goals and assumptions of your lab exercise. Assuming modern Ubuntu (as your later comment says), stock descrypt with a common salt is probably the weakest that you can use natively with full support:

$ echo -n 'password' | mkpasswd -s -S '00' -R 1 -m des
00xQPHYlVDIw6

Details:

Ubuntu's modern crypt implementation tries to keep you from creating overly weak hashes by design.

Other than native Unix crypt (descrypt), Ubuntu 16.04 has the following options, from crypt(3):

          ID  | Method
          ─────────────────────────────────────────────────────────
          1   | MD5
          2a  | Blowfish (not in mainline glibc; added in some
              | Linux distributions)
          5   | SHA-256 (since glibc 2.7)
          6   | SHA-512 (since glibc 2.7)

First, about salt. It sounds like you are only generating a single hash. If you were generating many hashes, you could use the same fixed/static salt for all of them, which would make the attack faster. I'll use a salt of all zeroes for simplicity.

descrypt may no longer be recognized. /etc/pam.d/common-password does refer to "Unix crypt" as the default, but this may mean "the OS default system crypt" rather than classic descrypt. descrypt would definitely be the weakest if the system supports it:

$ echo -n 'password' | mkpasswd -s -S '00' -R 1 -m des
00xQPHYlVDIw6

Note - in my testing, I was still able to use a descrypt password to log into an Ubuntu system. You can give descrypt a try, but the PAM documentation doesn't explicitly list it, so it may or may not work for your purposes.

Blowfish/bcrypt (2a and/or 2y) is by far the slowest, and doesn't seem to be supported in Ubuntu, so we'll discard it.

MD5crypt has a fixed number of rounds (1000), which is one of the reasons that it is now deprecated. And it is faster (and therefore weaker) than SHA-256 or SHA-512.

$ echo -n 'password' | mkpasswd -s -S '00000000' -m md5
$1$00000000$5ybxs8yjIGjFJv4/CuHRd1

Between SHA-256 and SHA-512, SHA-256 is a faster hash and so would theoretically be "weaker" for your purposes.

I checked to see if I could make the SHAs weaker by reducing the number of rounds. There appears to be no simple/naive way do this. The native Ubuntu mkpasswd command calls the underlying crypt function, which ignores -R values under 1000 by design:

SHA-256:

$ echo -n 'password' | mkpasswd -s -S '00000000' -R 1 -m sha-256
$5$rounds=1000$00000000$2h.5f29uvvoub7RFoFxxMG4Yg43KX3rL0rF8vn3CIPC

SHA-512:

$ echo -n 'password' | mkpasswd -s -S '00000000' -R 1 -m sha-512
$6$rounds=1000$00000000$hNBmdrAfQPp5VkP/POLNOo3Dv1tVsOORYGE4pKarVzYs43iS2GdEkUrPU2Xbo6m5mX8PPDPfcQvFKo7Ktar.W.

You could try to find a standalone implementation of one of these that does not use system crypt libraries and lets you override the rounds. But there is no guarantee that the utilities that need to interpret the hash will understand or respect a value lower than the expected minimum (1000). (If I were writing such a utility, I would reject as invalid any hashes with fewer rounds than expected!)

So that leaves us with native minimums for the number of rounds. To illustrate the relative speeds, here are some hashcat benchmark speeds (from a system with six GTX 970s):

Hashtype: bcrypt, Blowfish(OpenBSD)                          39955 H/s
Hashtype: sha512crypt, SHA512(Unix)                          426.6 kH/s
Hashtype: sha256crypt, SHA256(Unix)                         1017.3 kH/s
Hashtype: md5crypt, MD5(Unix), FreeBSD MD5, Cisco-IOS MD5  28070.8 kH/s
Hashtype: descrypt, DES(Unix), Traditional DES              2645.3 MH/s

So the weakest that is guaranteed to be supported on modern Ubuntu is currently md5crypt descrypt.

1
  • Great answer, thanks for the breakdown. I think I will make an alias that will just write the descrypt password like you showed above to the /etc/shadow file. And just make the passwd link point to my command instead. I glad to hear that it works. It'll give the participants of the lab something to think about. Thanks!
    – Joe Smith
    Feb 20, 2017 at 23:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .