Category : UNIX Files
Archive   : KC910.ZIP
Filename : KC.DOC

/****************************************************************************\
** Killer Cracker v9.10 LTD - Un*x /etc/passwd 'FAST' cracking engine **
** ======================================================================== **
** Password Preprocesser v2.00 -- Password Cracker Guess Mutator **
** ======================================================================== **
** Version 9.10 LTD Release Date: 09/20/91 **
** ======================================================================== **
** Written By Doctor Dissector, Copyright (C) 1990, 1991 **
** ======================================================================== **
** LIMITED EDITION -- DO NOT DISTRIBUTE **
\****************************************************************************/

=[ License ]==================================================================

This program is NOT free software BUT may be used without charge or
payment in any form IF your copy is a "registered" distributed version. You
may modify it as much as you please, however, you MAY NOT re-distribute it,
in any shape or for: ie. modified OR unmodified, without the expressed written
consent (ie. e-mail) of Doctor Dissector.
This program was initially distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
or FITNESS FOR A PARTICULAR PURPOSE.

=[ Disclaimer ]===============================================================

The author of this package, Doctor Dissector, will not assume liability
for ANY of the effects of the use or distribution of this package. If you,
at ANY time compile or use this package, you will assume full liability for
your own actions; Doctor Dissector can neither enforce the lawful use of this
package nor your actions before, during, or after exposure to this package.
Doctor Dissector does NOT endorse your unlawful use of this package to
appropriate computer accounts not under your lawful ownership.
The original intent of this program was to prove that Un*x accounts can be
easily, efficiently, and effectively cracked utilizing modified DES encryption
routines and proper statistical, mathematical, logical, and programming
skills.

=[ Files Included In Release Package ]========================================

WHATSNEW.910 Summary Of Version Changes/Modifications
KC.DOC Killer Cracker/Password Preprocesser Documentation

KC.EXE Killer Cracker MS/PC-DOS Pre-Compiled Executable
KC386.EXE Killer Cracker MS/PC-DOS 386/486 Pre-Compiled Executable
PWP.EXE Password Preprocesser MS/PC-DOS Pre-Compiled Executable

MAKEFILE Makefile For "make" Utility
KC.H Killer Cracker Header File
KC.C Killer Cracker Source File
PWP.H Password Preprocesser Header File
PWP.C Password Preprocesser Source File
BCRYPT.H Bcrypt Encryption Routines Header File
BCRYPT.C Bcrypt Encryption Routines Source File

B_ORDER.C Determines Byte Order Of Your Compiler
INT_SIZE.C Determines Integer Bit-Size Of Your Compiler

=[ Installation Instructions ]================================================

To compile and obtain a run-time version of Killer Cracker or/and Password
Preprocesser, follow the steps below:

1. Compile the included file "b_order.c" and execute the result binary
file. Record/remember what is printed out by the executable.
2. Compile the included file "int_size.c" and execute the result binary
file. Record/remember what is printed out by the executable.
3. Edit the file "Makefile" included with this package to your current
operating system and compiler tastes.
4. Type "make all" to compile Killer Cracker and Password Preprocesser.
5. To test Killer Cracker's encryption routines, test Killer Cracker
with the "-test" flag to insure the proper encryption result is
being obtained.
6. If you aren't using the "Makefile" to compile your executables, you
can compile Killer Cracker and Password Preprocesser seperately.
This is done by editing the file "kc.h" to your operating system
and compiler tastes and compile "kc.c". Then, compile "pwp.c".
7. If all else fails, ask someone who knows.

=[ Usage: Password Preprocesser ]=============================================

Password Preprocesser can be invoked several ways from the shell prompt.
Each method is chosen through command line flags, which must be preceded by
either a '-' or '/' character. In addition, each flag's name only has to be
typed in to the first character that will make that flag unique (ie. for the
flag 'logins' you only have to enter 'log' to make Password Preprocesser to
recognize the flag). The following section will discuss Password
Preprocesser's flags and various methods of invocation.

Brief: Mutates a wordlist read from the standard input into other possible
guesses for use with password 'crackers' and outputs the result to
the standard output.

Usage: pwp [[flag] ...] < [wordlist|pwfile] > [resultfile]

Flags: -? display this usage menu
-Gecos create result words from GECOS fields of pwfile
-Help display this usage menu
-Include include original words into resultfile
-Kc save login/GECOS words in KC9 'single-crack' form
-LOGins create result words from login fields of pwfile
-LOWErcase convert original words to lowercase
-LOWReverse convert original words to lowercase & reverse
-Minlength:<#> min length <#> of result words
-NONalpha:<#> min non-alphabetic chars <#> in result words
-NOVowels remove vowels from original words
-Prefixes: prepend chars in to original words
-Reverse reverse original words
-Suffixes: append chars in to original words
-Translate: translate char in original words to char
-UPChar:<#> convert char <#> in original words to uppercase
-UPLast convert last char in original words to uppercase
-UPPercase convert original words to uppercase
-UPReverse convert original words to uppercase & reverse

Summary:
-? Displays a brief message on the usage of Password
Preprocesser and each of its command line flags.
-Gecos Creates a mutated list of words based on an input
/etc/passwd file's GECOS fields. This directs
Password Preprocesser to expect a /etc/passwd
format file as input instead of the usual
wordlist.
-Help Same as '-?'.
-Include Includes each original word which creates the mutant
result words into the resultfile. This is NOT
normally done as a default.
-Kc Writes any login or GECOS result words in Killer
Cracker's (versions 9.00 and up) 'single-crack'
format. See 'Single-Crack Mode' for more details.
-LOGins Creates a mutated list of words based on an input
/etc/passwd file's login (account name) fields.
This directs Password Preprocesser to expect a
/etc/passwd format file as input instead of the
usual wordlist.
-LOWErcase Mutates each original word to lowercase. If the
original word is already all lowercase and the
'include' flag is also enabled, the mutated word
will not be included in the resultfile.
-LOWReverse Mutates each original word to lowercase and then
reverses that result. If the original word is
equal to this result and the 'include' flag is
enabled OR the 'lowercase' flag is enabled and
the lowercase equivalent of the original word is
equal to this result, the mutated word will not
be included in the resultfile.
-Minlength:<#> Checks each result word to see if its length is
equal to or greater than the length specified by
<#>. If not, the word will not be written to the
resultfile.
-NONalpha:<#> Checks each result word to see if it contains
an equivalent amount of or greater amount of
characters that are non-alphabetic than <#>. If
not, the word will not be written to the
resultfile.
-NOVowels Mutates each original word by removing the vowels from
it. If the 'include' flag is enabled and the
result word is the same as the original word, the
mutated word will not be included in the
resultfile.
-Prefixes: Mutates each original word by pre-pending each
character, sequentially, in to it. Only
one character at a time is pre-pended to the
original word, so the number of resulting mutant
words is equal to the length of .
-Reverse Mutates each original word by reversing the word. If
the mutant word is equal to the original word and
the 'include' flag is enabled, the mutated word
is not included in the resultfile.
-Suffixes: Mutates each original word by post-pending each
character, sequentially, in to it. Only
one character at a time is post-pended to the
original word, so the number of resulting mutant
words is equal to the length of . Also,
if the original word's length is greater than 7,
no mutated word is generated.
-Translate: Mutates each original word by substituting each
occurrance of the character specified by
with the character. Multiple translation
flags can been used by the Password Preprocesser
(ie: it is possible to translate more than one
character at a time) to create even more word
mutants.
-UPChar:<#> Mutates each original word by converting the character
at index <#> to uppercase. If the mutant word
is equal to the original word and the 'include'
flag is enabled OR the mutant word is equal to
the uppercase equivalent of the original word
and the 'uppercase' flag is enabled OR the mutant
word is equal to the uplast equivalent of the
original word and the 'uplast' flag is enabled OR
the mutant word is less than <#> characters in
length, the mutated word is not included in the
resultfile.
-UPLast Mutates each original word by converting the last
character in the word to uppercase. If the mutant
word is equal to the original word and the
'include' flag is enabled OR the mutant word is
equal to the uppercase euqivalent of the original
word and the 'uppercase' flag is enabled, the
mutated word is not included in the resultfile.
-UPPercase Mutates each original word to uppercase. If the
original word is already all uppercase and the
'include' flag is also enabled, the mutated word
will not be included in the resultfile.
-UPReverse Mutates each original word to uppercase and then
reverses that result. If the original word is
equal to this result and the 'include' flag is
enabled OR the 'uppercase' flag is enabled and
the uppercase equivalent of the original word is
equal to this result, the mutated word will not
be included in the resultfile.

=[ Usage: Killer Cracker ]====================================================

Killer Cracker can be invoked several ways from the shell prompt. Each
method is chosen through command line flags, which must be preceded by either
a '-' or '/' character. In addition, each flag's name only has to be typed
in to the first character that will make that flag unique (ie. for the flag
'test' you only have to enter 'te' to make Killer Cracker recognize the flag).
The following section will discuss Killer Cracker's flags and various methods
of invocation.

Brief: Un*x /etc/passwd 'FAST' password cracking engine.

Usage: kc [[flag] ...] [-stdin < [wordfile]]

Flags: -? display this usage menu
-Fork fork session process into the background
-Help display this usage menu
-Inactive display and write inactive accounts
-Maximize maximize use of system resources
-Pwfile: set passwordfile to
-Quiet suppress all output from stdout
-Restore: restore session using as restorefile
-SIngle read wordfile in 'single-crack' format
-STdin read words from stdin instead of 'wordfile'
-TEst test crypt result for proper encryption
-TImeout: abort session after a period of minutes
-Validfile: set validfile to
-Wordfile: set wordfile to

Summary:
-? Displays a brief message on the usage of Killer
Cracker and each of its command line flags.
-Fork Places the cracking session into 'quiet' mode and
forks the process into the background. (Un*x
variants ONLY)
-Help Same as '-?'.
-Inactive Displays and writes 'inactive' accounts (accounts with
encrypted passwords that begin with the '*'
character or accounts with encrypted passwords
with a length not equal to 13 characters) to
stdout (when not in quiet mode) and the validfile.
Each 'inactive' entry will be displayed and/or
written as a 'valid' account with a cleartext
password of '*INACTIVE*'.
-Maximize Maximizes the upper resource limit for the cracking
process if the current upper resource limit is not
already at its maximum. NOTE: use this flag with
caution, as it MAY cause the system Killer Cracker
is running on to slow down a GREAT deal. (BSD
Un*x variants ONLY)
-Pwfile: Sets the path/filename of the /etc/passwd file to be
cracked to . If not in quiet mode and no
filename is specified, Killer Cracker will prompt
you for one.
-Quiet Suppresses all output from printing to stdout during
the cracking session. This tends to speed things
up a few percent (1-5%) if you aren't interested
in seeing all the data normally outputted to
the stdout device (console). This flag will also
instruct Killer Cracker to bypass any prompting
for files not specified in the command line.
-Restore: Prepares Killer Cracker to restore from a previously
aborted session or a pre-written restorefile and
sets the path/filename of the restorefile to
. This flag also will instruct Killer
Cracker to ignore all other command line flags
used in conjunction with this flag. For more
information on the restore feature of Killer
Cracker, see 'Restore File Format'.
-SIngle Reads each word to be encrypted from the wordfile
in 'single-crack' format. See the section titled
'Single-Crack Mode'.
-STdin Ignores any specified wordfile and reads each word
from stdin instead of from the specified wordfile,
if any. This flag will also instruct Killer
Cracker to bypass any prompting for files not
specified in the command line.
-TEst Tests Killer Cracker's encryption routines against a
set of pre-computed encrypted data to check the
validity of Killer Cracker's encryption routines
as compiled by the current compiler.
-TImeout: Aborts the cracking session after period of
minutes as if aborted by any other method and
places restoration data into the original
restorefile or "restore" if no original was
specified.
-Validfile: Sets the path/filename of the validfile (where all
valid cracked accounts will be written to) to
be .
-Wordfile: Sets the path/filename of the wordfile (where all
words to be tested/encrypted are stored) to
be . This flag is ignored if the 'stdin'
flag is used in conjunction.


=[ Single Line Invocation ]===================================================

For those of you who have used previous versions of Killer Cracker and are
more familiar with a single-line command to execute Killer Cracker, it is
possible to instruct Killer Cracker to read words from standard input (using
the 'stdin' flag) and piping the output of Password Preprocesser into Killer
Cracker to achive a 'single-line command'. The following consist of a few
examples of how Killer Cracker can be invoked using one command line:


PWfile : pfile Abbreviations: log=logins, gec=gecos,
Wordfile : wfile inc=include, rev=reverse,
Validfile : vfile upr=upreverse, nov=novowels,
Restorefile : rfile std=stdin, pwf=pwfile,
val=validfile, res=restore

Example 1: Testing Login/GECOS And Mutants

pwp -log -gec -inc -rev < pfile | kc -std -pwf:pfile -val:vfile

Example 2: Testing A Wordfile And Mutants

pwp -rev -upr -inc -nov -min:5 < wfile | kc -std -pwf:pfile -val:vfile

Example 3: Testing A Wordfile And Mutants (Restoration)

pwp -rev -upr -inc -nov -min:5 < wfile | kc -res:rfile

These methods of invoking Killer Cracker also tend to save the disk space
necessary for storing the result wordlists/wordsets normally demanded by
Password Preprocesser.

=[ Printed Information ]======================================================

If Killer Cracker is invoked from the command line WITHOUT the '-quiet'
flag, it will normally display some information about the current session.
When first invoked, Killer Cracker will display a title for the current
version and other copyright information. Then, Killer Cracker will ask for
any filenames (pwfile, wordfile, validfile) not specified on the command line
(as long as you did not specify a '-stdin' wordfile). Then, the filenames for
each file (pwfile, wordfile, validfile) will be displayed so the operator can
verify that each file is specified correctly or incorrectly. Killer Cracker
will then display (if applicable) all flagged options (single, stdin wordfile,
inactive accounts, maximize system resources, session timeout). THEN, Killer
Cracker will then initialize the session and strip inactive/blank password
accounts from its internal linked account list.
Incedentally, login names displayed ANYTIME during a Killer Cracker
session inside of parenthesis (ie: "(guest)") represents a valid/cracked
account. Login names displayed ANYTIME during a Killer Cracker session inside
of braces (ie: "[guest]") represents an inactive account (an account with an
encrypted password field less than 13 characters in length).
Finally, when cracking does begin, under single-crack mode, Killer Cracker
will display each ACTIVE (non-stripped) account's name as it is compared
against each individual wordlist in the wordfile. When not cracking in single
crack format, each word from the wordfile is displayed as it is compared with
all ACTIVE accounts. A spinning cursor will also be displayed on the same
line. This cursor represents the current speed of the session in progress.
Under Killer Cracker version 9.10, each twist of the spinning cursor
represents 20 (TWENTY) complete encryption/comparisions. In earlier versions
of Killer Cracker with the spinning cursor (9.00, 9.01, 9.02, 9.03), each
twist USED to represent 10 complete encryption/comparisions. If an account
is cracked (found valid), its login-name will be displayed on-screen inside
of parenthesis, removed from the linked list of crackable accounts (so the
account is no-longer checked for 'more' valid passwords), and written to the
validfile.
Once Killer Cracker is complete cracking one word or one account, it will
display a 'current status' string inside of braces. This current status
includes the effective crypts/second ('c/s: XX') for the current session, and
the number of valid accounts found in the current session ('v: XX'). This
will continue until the end of the wordfile is reached, no more accounts
remain to be cracked, or the session is aborted.

=[ Aborting Killer Cracker ]==================================================

Under normal circumstances, Killer Cracker will crack passwords until it
has completed the last word from the designated wordlist or wordset. If
cracking must be aborted in the middle of a job and under Un*x, the job is
currently in the foreground, you can use the typical key-terminate sequence to
abort the current session. (Un*x and MS/PC-DOS) usually works,
and under Un*x, and should also work.
If under Un*x, the cracking job is in the background and you would like
to to abort it, you can either foreground the job and use the key-terminate
sequences (job control shells only) or you can use 'kill' to send the session
a signal. Signals that will abort a cracking session are: SIGALRM, SIGINT,
SIGQUIT, SIGTERM. *DO NOT* use the 'kill -9' sequence to abort cracking
sessions, as this will kill the cracking process and won't allow Killer
Cracker to insure all data has been stored and all files have been closed
properly.
NOTE: under MS/PC-DOS, if you instruct Killer Cracker to execute in
'quiet' mode, sometimes it takes several minutes for Killer Cracker to receive
the interrupt signal from the keyboard (don't ask me why...). Patience....

=[ Single-Crack Mode ]========================================================

Killer Cracker's 'single-crack' mode option allows you to create a highly
tailored wordlist (ie.login/GECOS mutations) for each individual user in a
/etc/passwd file. This is done by creating a SET of LISTS of words. This
set of lists of words is a textfile. The number of the LISTS of words in
one set MUST be equal to or less than the number of individual ACTIVE accounts
in the prospective /etc/passwd file. Each LIST of words in the set MUST be
separated by a line containing ONLY the characters '***!***'. If implemented
correctly, this will instruct Killer Cracker to take the first list of words
from the SET (wordfile) and compare them ONLY against the first user in the
/etc/passwd file; then take the second list and second user, etc. If the
amount of word LISTS in the set are less than the amount of users in a
/etc/passwd file, then the cracking session will end when Killer Cracker
completes the last LIST of words.

Example: SET of 3 word LISTS

hello
wow
***!***
password
secret
lock
***!***
lucid
root
key
***!*** <== Not necessary for last list

If there were four users, let's say 'larry', 'moe', 'curly', and 'jack',
they would be tested as follows:

User Words Tested
-------- ------------------------
larry hello, wow
moe password, secret, lock
curly lucid, root, key
jack

Everything clear now? Good. Incidentally, Password Preprocesser, also
included with this package, will write word LISTS in a SET if you feed it
an /etc/passwd file to mutate (using either the 'login' or 'gecos' flags in
conjunction with the 'kc' flag).

=[ Restore File Format ]======================================================

Sometimes it is helpful to know what kind of information is held in Killer
Cracker's restore files and/or you may want to edit some of that information
to modify your cracking session when you decide to continue it.
The following information describes the format of Killer Cracker's restore
file and the informatin Killer Cracker reads from it. Notice the most basic
format of the file as 'IDENTIFIER=TOKEN'. Case is ignored in the
identifier field, but TOKEN's field is case sensitive.

Example: Restore File

PWfile=/etc/passwd
Wordfile=/usr/lib/dict
Validfile=/usr/myhomedir/valid.crack
Flag=fork
Flag=timeout:100
Flag=maximize
Lastword=phoenix

This restore file will instruct Killer Cracker to crack '/etc/passwd'
using the wordlist in '/usr/lib/dict' and placing valid accounts in the
file '/usr/myhomedir/valid.crack'. Also, the flags 'fork' and 'maximize'
have been enabled and a session timeout is set at 100 minutes. Cracking
will continue on the word 'phoenix'.

Description Of Identifiers:
PWfile Filename of the pwfile (same as -pwfile: from the
command line).
Wordfile Filename of the wordfile (same as -wordfile: from the
command line).
Validfile Filename of the validfile (same as -validfile: from the
command line).
Flag Command flags (same as - from the command line).
Lastword The last word tested during the aborted session and the word
from which cracking will continue from when restored
(Non-'single-crack' mode ONLY).
Lastuser The last user tested during the aborted session and the user
from which cracking will continue from when restored
('single-crack' mode ONLY).

=[ System Dependant Notes ]===================================================

MS/PC-DOS Killer Cracker has an upper account limit of a couple thousand
accounts (give or take, depending on the amount of free memory
available at the time of execution). If you get a 'memory
allocation' error, try cutting down the size of your pwfile and
try it again.

32-BIT DOS When using "KC386.EXE", be sure memory memory managers like
QEMM386, EMM386, NETROOM, etc... are DISABLED, as GCC (what
compiled "KC386.EXE") is not compatible with them. Also, signal
processing (CONTROL-C) is ignored (as in STRIPPED).

UN*X Additional flags available: 'fork', 'maximize'. See 'Usage:
Killer Cracker' for additional details.

STRIPPED Signal processing (CONTROL-C) is ignored (hitting CONTROL-C will
not save Killer Cracker's session data, only terminate the current
session abruptly.

-----------------------------------------------------------------------------
Thanx to Razor, So76, Scooter, PLAGUE, VIz, and all others who aided in the
research and development of this password cracker.
-(c) 1991----------------------------------------------------------------EOF-