Today I was made aware of two interesting security portals where they have coverage of security tools and other interesting information for security testers. They are:

http://www.windowhaxor.net/ and http://www.linuxhaxor.net/

HERE IS AN EXTRACT:

Oracle 11g database password hash cracker


OrakelCrackert is an Oracle 11g database password hash cracker using a weakness in the Oracle password storage strategy.

With Oracle 11g, case sensitive SHA1 based hashing is introduced. Storing passwords in a case sensitive way introduces more possible password combinations so password cracking takes longer.

For example, the number of possible password combinations using a password generated out of the character set “[a-z][A-Z][0-9]#$_” where passwords start with a alpha character using is 52/65 * 65 ^ passlength. For an 8 position password this means 254.915.850.312.500 combinations.

Since Oracle is still storing the DES based password hashes, an attack much faster than brute forcing can be launched for most (not all) passwords. To do so:

1 - Get both the Oralce < 11g and 11g password hash, for example by executing the query “select user, password, spare4 from sys.user$ where username = ”.

2 - Crack the old DES based password hash (field “password”) which is generated using the upper case version of the mixed case password (note: this is not applicable to all possible passwords in Oracle 11g).

3 - If the upper case password is found, calculate the SHA1 result of the ASCII value of the password followed by the salt (nibble 41-60 of field SPARE4) to the SHA1 based password hash (nibble 1-40 of field SPARE4). Do this for every upper/lower case combination possible until you have got a match.

4 - Voila!

Visit the following link to get more details about the story above: http://www.windowhaxor.net/2007/10/04/oracle-11g-database-password-hash-cracker/

Enjoy!

Clement