Pete Finnigan's Oracle security weblog

Kennie Nybo Pontoppidan says:

Dear mr. Finnigan

Great function, I really enjoy your posts.

You might want to include a few calls to the upper function before checking the username/password OR include a comment in the code, that input should be in upper case as the following test shows.

Best wishes,
Kennie Nybo Pontoppidan

SQL> create user pete identified by pete;

User created.

SQL> select testpwd('pete', 'pete' ) from dual;

TESTPWD('PETE','PETE')
---------------------------------------------------

N

SQL> select testpwd('PETE', 'pete' ) from dual;

TESTPWD('PETE','PETE')
---------------------------------------------------

N

SQL> select testpwd('pete', 'PETE' ) from dual;

TESTPWD('PETE','PETE')
---------------------------------------------------

N

SQL> select testpwd('PETE', 'PETE' ) from dual;

TESTPWD('PETE','PETE')
---------------------------------------------------

Y

Pete Finnigan says:

Thanks very much for your comment. Very good catch, i should have checked for that before i published it.

I have updated the code and added calls to UPPER and published it again in the same location.

Thanks again

Kind regards

Pete

Kennie Nybo Pontoppidan says:

Hi Pete

Not because I'm normally the Evil Tester From Hell, but I don't think your program works with mixed case passwords. Have a look at the example below.

Best wishes,
Kennie

SQL> create user pete2 identified by "Pete2"
2 ;

User created.

SQL> select testpwd('PETE', 'PETE2' ) from dual;

TESTPWD('PETE','PETE2')
-------------------------------------------------------------------------------

N

SQL> select testpwd('PETE', 'Pete2' ) from dual;

TESTPWD('PETE','PETE2')
-------------------------------------------------------------------------------

N

SQL> select testpwd('pete', 'PETE2' ) from dual;

TESTPWD('PETE','PETE2')
-------------------------------------------------------------------------------

N

SQL> select testpwd('pete', 'pete2' ) from dual;

TESTPWD('PETE','PETE2')
-------------------------------------------------------------------------------

N

Pete Finnigan says:

Hi Kennie,

Thanks for your comment. Here is my test of the same:

SQL> connect system/oracle1
Connected.
SQL> create user pete2 identified by pete2;

User created.

SQL> connect testpwd/testpwd
Connected.
SQL> select testpwd('PETE2','PETE2') from dual;

TESTPWD('PETE2','PETE2')
-----------------------------------------------------------------------

Y

SQL> select testpwd('PETE2','pete2') from dual;

TESTPWD('PETE2','PETE2')
-----------------------------------------------------------------------

Y

SQL> select testpwd('pete2','PETE2') from dual;

TESTPWD('PETE2','PETE2')
-----------------------------------------------------------------------

Y

SQL> select testpwd('pete2','pete2') from dual;

TESTPWD('PETE2','PETE2')
-----------------------------------------------------------------------

Y

SQL>

The difference is that i used "PETE2" as the username BUT you used "PETE" but the user you create at the top is PETE2. The function was working correctly for you because the password for PETE is not PETE2.

cheers

Pete

Andre says:

Hi Pete,
the function that returns the password hash value should be called hash or similar, not crack. Nomen est omen. The cracking is in the logic that uses the hash function to compare the hashed value of an input string to the oracle stored password hash. i.e.: oracle stored password hash=hash(input)

input can be:
. username
. reverse(username)
. username1..100
. replace(username,'O','0')
. replace(username,'I','1')
. replace(username,'E','3')
. candidate password
. candidate password1..99
...add your own rules

to get a long list of candidate passwords I read from an external table pointing to a large wordlist, then store them in a plsql table. This worked for me even when the list contained millions of words (eg from red database).

this is a very powerful and flexible combination, and if you are able to collect all password hashes company wide you can do company wide reporting!

Kind regards,
Andre

Pete Finnigan says:

Hi Andre,

Thanks for your comment. I was aware of the naming as i copied and modified the function from my pl/sql based cracker script. The naming is strictly wrong as you suggest and I will ammend it next time I make an update. Paul rang me the other evening to suggest an ammendment and when i add that i will change the name.

I was aware of all of the above input modes and indeed many more that i use myself in audits. Thanks for making them available for people to use.

Kind regards

Pete