In this lecture I'll show you how to generate your own rainbow tables and how to try to crack hashes
using the generated tables. We'll use a program called RainbowCrack that includes tools for both generating
rainbow tables and cracking them. Let's install rainbow crack on Kali Linux: apt update &&
apt install rainbow crack.
It was installed.
If you use another distribution like Ubuntu, Linux Mint or even Windows you have to download the program
from its official Web site. In Linux
you just download the archive that already contains the executable tools.
Then all you need to do is to set the execution permission on those tools.
The tool used to generate the tables is called rtgen.
This is its usage and these are the hash algorithms that are implemented.
You can see a lot of options and I'll try to explain
each option as I write it. So rtgen the command
then comes the hash algorithm.
This is the first option and represents the hash algorithm that we want the rainbow tables to use.
You can see a list of available algorithms under hash algorithms implemented section in the return output
of
rtgen command. In this example we'll use sha256. The next option is charset. It represents the set of
characters of the plaintext string used to generate the hashes for the rainbow tables.
You can see all available charsets in a file called charset.txt in /usr/share
/rainbowcrack directory. In this file
it can be numeric, alpha, alphanumeric and so on. In this example I'll choose loweralpha.
Plaintext length
minimum is the next option and represents the minimum characters in each clear text password. And I write
1; plaintext length
maximum is the next option and represents the maximum number of characters in each word, for which will
calculate the hash. I'll write only 3 because I don't want to wait too long to generate the tables
but if you have enough time available you should choose a larger value.
Take care that if you choose a value too large you'll have to wait days, weeks or months for the operation
to finish. The next parameters is rainbow table index and this is usually set to zero.
This parameter will select the reduction function which is a math formula that trims the number of combinations
by removing combinations that are incredibly unlikely to be used.
By doing so it lowers computational time with the flip side that there is a tiny possibility that it
will skip the combination
we are looking for. The next option is rainbow chain length and is the length of each table and the
large of this number is the more plaintext are hashed and store in the table.
I write 2400.
The next option is chain num or rainbow chain count and is the number of rainbow chains to generate.
I'll write 100000. And the last option is part index or file title suffix. This is used
for rainbow tables which are to be linked with each other to prevent duplicating.
Usually it's set to zero. Before generating a table
it is a good idea to check and see an approximation of the amount of time the table is going to take
to generate. To do so
you use the "-bench" argument at the end of the arguments excluding the last three arguments, like
this:
-bench
and we are awaiting
in this example it will calculate 4.39 million hashes per second.
It will not actually create any rainbow tables, just determine how fast you can generate table entries.
Let's generate the rainbow table!
I'm hitting the enter key. The generation process usually takes an incredibly long time.
What you can do is to generate sets of rainbow tables on multiple computers. Sets of rainbow tables are just
rainbow tables based on each other.
For example instead of generating a rainbow table of 100 gigabytes you could generate 100 files of 1
gigabyte.
This is done by having indexes on the tables. In this example
this will be a very small rainbow table because the maximum password length is 3.
It's just an example to see how it really works. And it takes approximately one minute; it's done.
The rainbow table file or files are stored in /usr/share/rainbowcrack/ directory,
no matter the directory where you've executed the command from. This is at least applicable to Kali Linux
when installing rainbow crack using apt. This is the rainbow table file
we've just generated. The next step is to sort it; to do that
I'll use a tool called "rtsort" that belongs to the Rainbow crack package as well.
I'm executing artsort and the directory that contains the table as its argument.
/usr/share/
rainbowcrack/
It has been sorted.
Note that the argument is the directory that contains the table files, not the file or the files.
Now we can try to crack a hash using rcrack, another tool that is part of rainbowcrack.
Let’s see the hash of any 3 lower alpha characters
word.
Using this online tool I'll calculate the sha256 of: xav
You can choose any characters you like.
This is the hash and I am copying it to the clipboard.
Now back to Kali I am executing arcrack, the path to the rainbow file,
this is the directory that contains the file, -h and the hash and I am pasting it.
Perfect.
The hash has been cracked.
The clear text password that gives that hash is xav.
Thank you!
That's all! In the next lecture
I'll talk about the countermeasures you could take to mitigate the risk of cracking passwords
hashes using rainbow tables.