RainbowCrack demonstration

by Zhu Shuanglei <shuanglei@hotmail.com>
http://www.antsight.com/zsl/rainbowcrack/


Here are the demonstrations of RainbowCrack 1.0. Later versions of RainbowCrack behavior similarly.
All the demonstrations below are carried out on a standard workstation (666MHz CPU, 256MB RAM).

1. Crack 10 alpha passwords in 74 seconds

E:\rainbowcrack-1.0-win>type random_alpha.txt
USER0::165a1fabd5c06a68aad3b435b51404ee::::
USER1::cf1a193bf3053bc4aad3b435b51404ee::::
USER2::cf8465783349c275aad3b435b51404ee::::
USER3::fa2991e294ec4b1caad3b435b51404ee::::
USER4::afef1f7192613fcdaad3b435b51404ee::::
USER5::25baeee8807f408baad3b435b51404ee::::
USER6::4c15cb6912eb674eaad3b435b51404ee::::
USER7::d8caeb00464414fcaad3b435b51404ee::::
USER8::78339cce019af94caad3b435b51404ee::::
USER9::60a59cfe793a8b99aad3b435b51404ee::::

E:\rainbowcrack-1.0-win>dir g:\table1\
驱动器 G 中的卷是 -
卷的序列号是 D4B9-9424

g:\table1
的目录

2003-09-07 19:21 <DIR> .
2003-09-07 19:21 <DIR> ..
2003-09-01 09:59 128,000,000 lm_alpha_0_2100x8000000_bla.rt
2003-09-01 09:59 128,000,000 lm_alpha_1_2100x8000000_bla.rt
2003-09-01 10:00 128,000,000 lm_alpha_2_2100x8000000_bla.rt
2003-09-01 10:00 128,000,000 lm_alpha_3_2100x8000000_bla.rt
2003-09-01 10:01 128,000,000 lm_alpha_4_2100x8000000_bla.rt
5
个文件 640,000,000 字节
2 个目录 146,325,504 可用字节

E:\rainbowcrack-1.0-win>rcrack g:\table1\*.rt -f random_alpha.txt
reading lm_alpha_0_2100x8000000_bla.rt ...
128000000 bytes read, disk access time: 4.19 s
verifying the file ...
searching for 10 hashes ...
plaintext of cf1a193bf3053bc4 is FHBKEBL
plaintext of 4c15cb6912eb674e is PXPMJLD
plaintext of cf8465783349c275 is GSXGSSX
plaintext of d8caeb00464414fc is WSELHXL
plaintext of 25baeee8807f408b is KLKOTYT
plaintext of 165a1fabd5c06a68 is ZPTWYZZ
plaintext of 78339cce019af94c is BLSYQPP
cryptanalysis time: 53.61 s

reading lm_alpha_1_2100x8000000_bla.rt ...
128000000 bytes read, disk access time: 3.75 s
verifying the file ...
searching for 3 hashes ...
plaintext of afef1f7192613fcd is LHNNYLE
plaintext of 60a59cfe793a8b99 is FOXHUXW
cryptanalysis time: 18.79 s

reading lm_alpha_2_2100x8000000_bla.rt ...
128000000 bytes read, disk access time: 3.75 s
verifying the file ...
searching for 1 hash ...
plaintext of fa2991e294ec4b1c is VOFTOUQ
cryptanalysis time: 1.39 s

statistics
------------------------------------------
plaintext found: 10 of 10 (100.00%)
total disk access time: 11.68 s
total cryptanalysis time: 73.79 s
total chain walk step: 13681478
total false alarm: 13260
total false alarm step: 12317191

username password
------------------------------------------
USER0 ZPTWYZZ
USER1 FHBKEBL
USER2 GSXGSSX
USER3 VOFTOUQ
USER4 LHNNYLE
USER5 KLKOTYT
USER6 PXPMJLD
USER7 WSELHXL
USER8 BLSYQPP
USER9 FOXHUXW

Some comment:
In this experiment, we generate hashes of 10 randomly generated alpha only passwords and store them in random_alpha.txt. Files in g:\table1\ are so called "rainbow table" generated by rtgen.exe in the distribution. We issue the command "rcrack g:\table1\*.rt -f random_alpha.txt" to start the crack and find all of the 10 passwords within 74 seconds. However, additional 12 seconds are needed to load the precomputed rainbow tables from disk. 

2. Crack 10 alpha-numeric passwords in 184 seconds

E:\rainbowcrack-1.0-win>type random_alpha-numeric.txt
USER0::afdbc395b8d95e85aad3b435b51404ee::::
USER1::b0732c8605dc5912aad3b435b51404ee::::
USER2::939489337beb3360aad3b435b51404ee::::
USER3::d65c66d0ed29a503aad3b435b51404ee::::
USER4::083cb03678ade0d3aad3b435b51404ee::::
USER5::3ec2bf510dfc79a3aad3b435b51404ee::::
USER6::6e2aa2905020b118aad3b435b51404ee::::
USER7::bfd0ccaf4f20504aaad3b435b51404ee::::
USER8::ce8ca9efe3a5de26aad3b435b51404ee::::
USER9::0c51962a0be928aaaad3b435b51404ee::::

E:\rainbowcrack-1.0-win>dir f:\table2\
驱动器 F 中的卷是 IMPORTANT
卷的序列号是 BC3B-00E6

f:\table2
的目录

2003-09-07 08:16 <DIR> .
2003-09-07 08:16 <DIR> ..
2003-09-05 09:24 640,000,000 lm_alpha-numeric_0_2400x40000000_all.rt
2003-09-05 16:38 640,000,000 lm_alpha-numeric_1_2400x40000000_all.rt
2003-09-05 09:29 640,000,000 lm_alpha-numeric_2_2400x40000000_all.rt
2003-09-05 09:34 640,000,000 lm_alpha-numeric_3_2400x40000000_all.rt
2003-09-07 08:14 640,000,000 lm_alpha-numeric_4_2400x40000000_all.rt
5
个文件 3,200,000,000 字节
2 个目录 356,710,912 可用字节

E:\rainbowcrack-1.0-win>rcrack f:\table2\*.rt -f random_alpha-numeric.txt
reading lm_alpha-numeric_0_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 3.60 s
verifying the file ...
searching for 10 hashes ...
plaintext of 083cb03678ade0d3 is 56VST9C
plaintext of b0732c8605dc5912 is 7BKKNIX
cryptanalysis time: 80.31 s
reading lm_alpha-numeric_0_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 5.70 s
searching for 8 hashes ...
plaintext of afdbc395b8d95e85 is E0EEH16
cryptanalysis time: 5.28 s
reading lm_alpha-numeric_0_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 5.81 s
searching for 7 hashes ...
plaintext of 939489337beb3360 is 45E9RDA
plaintext of d65c66d0ed29a503 is ESJ7M3
cryptanalysis time: 4.78 s
reading lm_alpha-numeric_0_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 3.53 s
searching for 5 hashes ...
plaintext of bfd0ccaf4f20504a is H8OJKKJ
cryptanalysis time: 2.69 s
reading lm_alpha-numeric_0_2400x40000000_all.rt ...
115367936 bytes read, disk access time: 3.39 s
searching for 4 hashes ...
cryptanalysis time: 2.46 s

reading lm_alpha-numeric_1_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 3.65 s
verifying the file ...
searching for 4 hashes ...
cryptanalysis time: 36.16 s
reading lm_alpha-numeric_1_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 6.52 s
searching for 4 hashes ...
plaintext of 6e2aa2905020b118 is DRUZ58W
cryptanalysis time: 2.31 s
reading lm_alpha-numeric_1_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 6.14 s
searching for 3 hashes ...
cryptanalysis time: 2.20 s
reading lm_alpha-numeric_1_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 3.55 s
searching for 3 hashes ...
plaintext of ce8ca9efe3a5de26 is 5SBCKBS
cryptanalysis time: 1.37 s
reading lm_alpha-numeric_1_2400x40000000_all.rt ...
115367936 bytes read, disk access time: 3.20 s
searching for 2 hashes ...
cryptanalysis time: 1.33 s

reading lm_alpha-numeric_2_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 3.51 s
verifying the file ...
searching for 2 hashes ...
cryptanalysis time: 18.10 s
reading lm_alpha-numeric_2_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 5.98 s
searching for 2 hashes ...
cryptanalysis time: 1.46 s
reading lm_alpha-numeric_2_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 5.83 s
searching for 2 hashes ...
cryptanalysis time: 1.47 s
reading lm_alpha-numeric_2_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 3.52 s
searching for 2 hashes ...
plaintext of 0c51962a0be928aa is 0IVLZLR
cryptanalysis time: 0.77 s
reading lm_alpha-numeric_2_2400x40000000_all.rt ...
115367936 bytes read, disk access time: 3.09 s
searching for 1 hash ...
cryptanalysis time: 0.52 s

reading lm_alpha-numeric_3_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 3.50 s
verifying the file ...
searching for 1 hash ...
cryptanalysis time: 9.06 s
reading lm_alpha-numeric_3_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 5.65 s
searching for 1 hash ...
cryptanalysis time: 0.68 s
reading lm_alpha-numeric_3_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 5.27 s
searching for 1 hash ...
cryptanalysis time: 0.68 s
reading lm_alpha-numeric_3_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 3.52 s
searching for 1 hash ...
cryptanalysis time: 0.73 s
reading lm_alpha-numeric_3_2400x40000000_all.rt ...
115367936 bytes read, disk access time: 3.10 s
searching for 1 hash ...
cryptanalysis time: 0.74 s

reading lm_alpha-numeric_4_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 3.52 s
verifying the file ...
searching for 1 hash ...
cryptanalysis time: 9.06 s
reading lm_alpha-numeric_4_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 5.71 s
searching for 1 hash ...
cryptanalysis time: 0.70 s
reading lm_alpha-numeric_4_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 6.27 s
searching for 1 hash ...
cryptanalysis time: 0.72 s
reading lm_alpha-numeric_4_2400x40000000_all.rt ...
131158016 bytes read, disk access time: 3.54 s
searching for 1 hash ...
plaintext of 3ec2bf510dfc79a3 is 2IOWPCS
cryptanalysis time: 0.51 s

statistics
------------------------------------------
plaintext found: 10 of 10 (100.00%)
total disk access time: 107.02 s
total cryptanalysis time: 184.12 s
total chain walk step: 48407057
total false alarm: 17824
total false alarm step: 14477473

username password
------------------------------------------
USER0 E0EEH16
USER1 7BKKNIX
USER2 45E9RDA
USER3 ESJ7M3
USER4 56VST9C
USER5 2IOWPCS
USER6 DRUZ58W
USER7 H8OJKKJ
USER8 5SBCKBS
USER9 0IVLZLR

Some comment:
This time the target are hashes of alpha-numeric passwords. We need longer cryptanalysis time to reveal the passwords.