Call: +44 (0)1904 557620 Call
Blog
Home / Archives / October 2007 / CheckPwd version 2 A12 is released

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "Oracle 11g for Windows is available"] [Next entry: "Nice ideas to scrape the alert log in Windows"]

CheckPwd version 2 A12 is released

October 24th, 2007 by Pete


Today a new version of the Oracle password cracker checkpwd has been released at version 2.0 A12. The new cracker has a lot of features not present in the other popular Oracle password crackers such as orabf or woraauthbf. These include:

  • Support for 11g Passwords
  • APEX password cracking
  • collection of passwords from the database
  • ability to crack password hashes in the history
  • Cracking role passwords

I downloaded the latest version to test it but was unable to get it to work on my system. Its unclear whether this is an issue with checkpwd or my system. A test shows that I can connect to my local 10gR2 database with SQL*Plus on the command line but when checkpwd tries to connect to the same database from the same directory it fails with an ORA-12154 error. If i then try to connect to a remote Oracle database (9iR2) then it fails with a ORA-12705 error instead. So i finally tried a non-database connection to try and crack SCOTT's password off line. This also fails. Interestingly a sqlnet.log file is created for the non-database connection mode and the sqlnet.log file shows that the password cracker is trying to connect to a database called ORCL.

Finally a second error seems to occur after the database connect error, an error "SymSetSymWithAddr64 could not be loacted in link lib DBGHELP.dll" is sent to an error dialog box.

This is a pity as I would like to have shown some tests here and tested the new features and be able to compare to woraauthbf and orabf. The feature list of checkpwd is good. Lets hope Alex gets it sorted out, I think the A12 is alpha so we can forgive some glitches.

The one thing I want to note is the license difference between checkpwd and the other two main tools. Checkpwd if used commercially should recognise RDS and the tool and a link to RDS in any customer reports, the other two tools have no such restrictions, woraauthbf is GPL2 and the source is available and although orabf does not include source there are no restrictions for commercial use.

There has been 6 Comments posted on this article


October 24th, 2007 at 10:37 pm

Pete Finnigan says:

Pete,

it's right, the A12 means alpha but I tested checkpwd on different processors (Pentium M, Core2Duo, Xeon) and operating systems (XP, MCE, Vista) and the database connect is working for me.

What Oracle libraries are you using? 9.2 or the 10.2 instant client? What openssl.dll are you using?

The new license is not unusual. Many security tools (e.g. amap) have this restriction even if many people are ignoring the license.



October 24th, 2007 at 10:39 pm

Pete Finnigan says:

Pete,

I was able to connect using the ServiceName format:

C:\checkpwd system/xxxx@192.168.1.200:1521/xe passwords.txt

It only found one APEX user - SYSTEM - which is really not an APEX user, so I wonder if that part of the tool is not yet complete. It also claimed that the password was OK when I know that it is not! smile

- Scott



October 24th, 2007 at 11:42 pm

Pete Finnigan says:

Scott,

that's not true.

The user SYSTEM is an Oracle database and an APEX user (different tables/different passwords). If you lookup in wwv_flow_fnd_user you will see that the user SYSTEM is there.

The APEX passwords are case sensitive.

Regards

Alex



October 25th, 2007 at 08:59 am

Pete Finnigan says:

Hi Alex,

Thanks for your comment.

I have 8.1.7.4, 9.2.0.1, 10.2.0.1 and 11.1.6.1 installed. The 10gR2 is first in the path and sqlplus finds it correctly and works from the same directory that checkpwd is installed in and it logs in fine.

Your distribution includes the instant client and i tried the bypassing the tnsnames.ora simple connect method which should pick up the instant client first in the same directory as checkpwd but that failed also.

cheers

Pete



October 25th, 2007 at 12:07 pm

Pete Finnigan says:

Finally this was a problem (and a known bug) of the Oracle Instant Client and not of checkpwd. If an Oracle Client 9.2 is installed it is necessary to specify the NLS_LANG manually. Other tools using the instant client like sqlplus (for instant client) are also affected by this bug.

After a discussion with Pete we will also change the license back to the old model.



October 26th, 2007 at 04:53 pm

Pete Finnigan says:

Alex,

While that may be true, there are a number of other workspaces and APEX users on that instance of APEX. And it came back saying that the APEX password was OK, when I can tell you that it would not be hard to guess it for this specific install of APEX.

Does this tool support Oracle XE, or was it only intended to work with APEX 3.0 on SE/EE?

Thanks,

- Scott -


October 2007

Archives

Weblog Home
Weblog Archives

Syndication

RSS 1.0 FEED RSS 2.0 FEED Atom 0.3 FEED Powered by gm-rss 2.0.0