News for hackers. Stuff that matters.

A comment on Xerox Alto zero-day: cracking disk password protection on a 45 year old system.

Re:Xerox Alto zero-day: cracking disk password protection on... by Keyframe on Thursday January 04, 2018 @03:47PM (#16073927)
Reminds me of a year or two ago when I had to boot my old SGI. Forgot the user password on IRIX and thought that this is where I'll be clever (hacking terminals, matrix music in the background, etc.). Turns out, IRIX had 8 character limit for user passwords. Thanks to the modern GPUs and a passwd file restored from the system (on a recovery console), a few hours later I had the password brute-forced. I'll get to be clever hax0r next time, I guess.
[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by e12e on Thursday January 04, 2018 @04:48PM (#16074372)
I don't know. Cracking passwords using A SUPERCOMPUTER FROM THE FUTURE, seems plenty worthy of some decent theme music...
[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by vidarh on Friday January 05, 2018 @04:58AM (#16077667)
Fits right into Kung Fury [1] - a parody/homage of 80's movies that includes time travel and Hackerman... And a dinosaur, vikings and nazis and David Hasselhoff. It's as bad as it sounds, but in a good way. They fit an impressive amount of 80's movie tropes into 30 minutes.

https://www.youtube.com/watch?v=bS5P_LAqiVg&t=1306s

[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by ASalazarMX on Thursday January 04, 2018 @06:47PM (#16075195)
I hope he ran the Hollywood script while the password cracker ran modestly in the background

https://github.com/dustinkirkland/hollywood

[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by 13of40 on Thursday January 04, 2018 @06:23PM (#16075049)
Best one I've seen was a university library card catalog system from the 80s/90s that used unshadowed, 8-character salted passwords via the crypt() function on the Unix box it was on. Inexplicably, whoever wrote the application had limited it to require exactly five uppercase letters, crackable in a few seconds on my 33Mhz 386.
[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by romwell on Thursday January 04, 2018 @06:48PM (#16075197)
Maybe that was the reason? To provide a way for the developer to do customer support in these cases, that is.

The password being there, as the people in the bike store where I bought the lock told me, to keep the honest people honest.

[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by 13of40 on Thursday January 04, 2018 @07:44PM (#16075523)
Anyone with admin access on the Unix box could have just edited the password file and put in a hash for a password they knew.
[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by kalleboo on Thursday January 04, 2018 @09:33PM (#16076026)
My high school in the late 90's similarly handed out passwords all composed of 8 (or was it 6?) numbers. Combined with Windows 98's weak hashing (was it LanMan back then?), Cain & Abel on contemporary hardware could reveal them in seconds.
[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by amatecha on Thursday January 04, 2018 @04:34PM (#16074278)
I was in a similar situation. I bought a used SGI Octane, but didn't have the root password and I didn't want to reformat the machine (and didn't have OS discs). It ended up being pretty easy to crack the password, though I can't remember the exact process (this was years ago). Once you have physical access, pretty much any security implementation can be defeated.
[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by mmjaa on Thursday January 04, 2018 @03:49PM (#16073947)
Turns out I need to do that with my old SGI. Got any tips?
[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by Keyframe on Thursday January 04, 2018 @05:03PM (#16074500)
Multiple ways to do it. All lead to you getting to the /etc/passwd file and the hash inside for the root.

If you have IRIX installation CD then you can even set the new password, but you probably don't have it? You can also put the disk into another SGI, also not what everyone has. If guest account is enabled, login with guest (no password) and just cat the /etc/passwd. If guest account is not enabled, you can do the cat via sash, which is a bit more compicated, like this: https://web.archive.org/web/20151023042224/http://crackaddic...

Once you have your hash, do it with John the Ripper (GPU version). Store the password int a text file in format of root:hash and run john the ripper on it. Encryption is, AFAIK, DES so use john --format=des passwd.txt if john doesn't autodetect which encryption it is (I remember I had to set it manually). It can take awhile, depending on the GPU, but not that long.

If you run into trouble, I can have a look. I think I wrote down somewhere what to do, in case I need it again.

[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by mmjaa on Friday January 05, 2018 @08:55AM (#16078540)
Thanks for this, looks to be not a problem at all! Well, now I've got one less reason to keep the SGI boxes wrapped up, thanks!
[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by Aloha on Thursday January 04, 2018 @04:46PM (#16074357)
Boot from a CD, mount the drive, change the password or remove it - if it were linux I'd edit /etc/shadow - obviously easier with another IRIX machine to put the drive into.
[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by neko_koneko on Thursday January 04, 2018 @05:55PM (#16074896)
When I was in similar situation (bought an old SGI O2 box and didn’t had any other SGI machines to plug HDD into to get /etc/passwd), I used telnet RCE/privilege escalation exploit: https://www.exploit-db.com/exploits/20149/, worked like a charm. These old systems have many vulnerable services running by default, including telnet.
[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by mmjaa on Friday January 05, 2018 @08:57AM (#16078550)
Had some great suggestions, but this one wets my whistle the most, haha!

Probably what I'll do, though, is set up SCSI on a linux box somewhere and try to xxx the shadow, seems to be the smoothest route .. don't wanna mess too much, because after all, 20 years later .. I still wanna boot my old SGI like the good ol' days. :)

[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by jjwiseman on Thursday January 04, 2018 @03:52PM (#16073976)
Not quite what you're asking, but if you just want to get a shell on the machine, IRIX often had a bunch of accounts with no password. Try lp, demo, games, and guest.
[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by DanBC on Thursday January 04, 2018 @04:24PM (#16074226)
Would something like John the Ripper, first with wordlists and then with incremental mode, be acceptable? http://www.openwall.com/john/

http://www.openwall.com/john/doc/

[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by atkbrah on Thursday January 04, 2018 @06:50PM (#16075211)
You will need /etc/passwd file from SGI the disk. Either use irix installation CDs or boot the system over network [1]. You could also try booting openbsd [2] to get your hands to it.

Next you would use something like hashcat [3] to bruteforce the password.

1. http://software.majix.org/irix/install-network.shtml

2. https://ftp.openbsd.org/pub/OpenBSD/6.2/sgi/INSTALL.sgi

3. https://hashcat.net/hashcat/

[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by contingencies on Thursday January 04, 2018 @06:24PM (#16075063)
Try logging in as lp. Often no password.
[ Parent | on HN ]
Re:Xerox Alto zero-day: cracking disk password protection on... by raverbashing on Thursday January 04, 2018 @04:10PM (#16074117)
I think you don't need a GPU to crack an old password (with crypt?) limited to 8 chars.

Better than that only the Windows LM Hashes

[ Parent | on HN ]