How to set an extremely weak password hashing algorithm for linux?

Question

As part of a lab exercise I want to have an extremely weak password hash in the /etc/shadow file. How could I go about doing this? MD5 is not quite weak enough, and I'm editing the /etc/pam.d/common-password file to change the hashing algo. I was thinking I would do descrypt but I cannot get it to work.

Any ideas?

Answer 1

There may be other possibilities depending on the goals and assumptions of your lab exercise. Assuming modern Ubuntu (as your later comment says), stock descrypt with a common salt is probably the weakest that you can use natively with full support:

$ echo -n 'password' | mkpasswd -s -S '00' -R 1 -m des
00xQPHYlVDIw6

Details:

Ubuntu's modern crypt implementation tries to keep you from creating overly weak hashes by design.

Other than native Unix crypt (descrypt), Ubuntu 16.04 has the following options, from crypt(3):

          ID  | Method
          ─────────────────────────────────────────────────────────
          1   | MD5
          2a  | Blowfish (not in mainline glibc; added in some
              | Linux distributions)
          5   | SHA-256 (since glibc 2.7)
          6   | SHA-512 (since glibc 2.7)

First, about salt. It sounds like you are only generating a single hash. If you were generating many hashes, you could use the same fixed/static salt for all of them, which would make the attack faster. I'll use a salt of all zeroes for simplicity.

descrypt may no longer be recognized. /etc/pam.d/common-password does refer to "Unix crypt" as the default, but this may mean "the OS default system crypt" rather than classic descrypt. descrypt would definitely be the weakest if the system supports it:

$ echo -n 'password' | mkpasswd -s -S '00' -R 1 -m des
00xQPHYlVDIw6

Note - in my testing, I was still able to use a descrypt password to log into an Ubuntu system. You can give descrypt a try, but the PAM documentation doesn't explicitly list it, so it may or may not work for your purposes.

Blowfish/bcrypt (2a and/or 2y) is by far the slowest, and doesn't seem to be supported in Ubuntu, so we'll discard it.

MD5crypt has a fixed number of rounds (1000), which is one of the reasons that it is now deprecated. And it is faster (and therefore weaker) than SHA-256 or SHA-512.

$ echo -n 'password' | mkpasswd -s -S '00000000' -m md5
$1$00000000$5ybxs8yjIGjFJv4/CuHRd1

Between SHA-256 and SHA-512, SHA-256 is a faster hash and so would theoretically be "weaker" for your purposes.

I checked to see if I could make the SHAs weaker by reducing the number of rounds. There appears to be no simple/naive way do this. The native Ubuntu mkpasswd command calls the underlying crypt function, which ignores -R values under 1000 by design:

SHA-256:

$ echo -n 'password' | mkpasswd -s -S '00000000' -R 1 -m sha-256
$5$rounds=1000$00000000$2h.5f29uvvoub7RFoFxxMG4Yg43KX3rL0rF8vn3CIPC

SHA-512:

$ echo -n 'password' | mkpasswd -s -S '00000000' -R 1 -m sha-512
$6$rounds=1000$00000000$hNBmdrAfQPp5VkP/POLNOo3Dv1tVsOORYGE4pKarVzYs43iS2GdEkUrPU2Xbo6m5mX8PPDPfcQvFKo7Ktar.W.

You could try to find a standalone implementation of one of these that does not use system crypt libraries and lets you override the rounds. But there is no guarantee that the utilities that need to interpret the hash will understand or respect a value lower than the expected minimum (1000). (If I were writing such a utility, I would reject as invalid any hashes with fewer rounds than expected!)

So that leaves us with native minimums for the number of rounds. To illustrate the relative speeds, here are some hashcat benchmark speeds (from a system with six GTX 970s):

Hashtype: bcrypt, Blowfish(OpenBSD)                          39955 H/s
Hashtype: sha512crypt, SHA512(Unix)                          426.6 kH/s
Hashtype: sha256crypt, SHA256(Unix)                         1017.3 kH/s
Hashtype: md5crypt, MD5(Unix), FreeBSD MD5, Cisco-IOS MD5  28070.8 kH/s
Hashtype: descrypt, DES(Unix), Traditional DES              2645.3 MH/s

So the weakest that is guaranteed to be supported on modern Ubuntu is currently md5crypt descrypt.