Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 09-15-2022, 05:13
TmC TmC is offline
VIP
 
Join Date: Aug 2004
Posts: 326
Rept. Given: 1
Rept. Rcvd 15 Times in 9 Posts
Thanks Given: 2
Thanks Rcvd at 22 Times in 16 Posts
TmC Reputation: 15
Hardcoded md5 serial number crack

Good evening to all of you!

I am currently trying to crack a program that can be registered with a pre-defined set of serial numbers, hardcoded into the application as a big set of md5 hashes (the serial number format is !!!!-!!!!-!!!!-!!!! where ! can be anything in ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789)

I am sorry I can't share the program since it contains recognisable data.

I am currently trying two ways:

1. I extracted all serial number hashes, and currently running a generator that randomises numbers between 1 and 36 and then takes from the allowed char set the corresponding value and forms a random serial number, then convert to md5 and check if hash is in the list. if not, discard and try a new one. The program has been running for 4 hours and not a single valid serial number has appeared

2. I built a program to generate all possible combinations of serial numbers, both clean and as md5values. In 4 hours of runtime, I completed the last four !!!!, but the remaining !!!!-!!!!-!!!! still has to come and I suspect it will run for long.

Since none of the methods appear to yield a result in a reasonable time, does any of you have any suggestion to speed up the process?

Might the CUDA toolkit be of any help?

I also thought about rainbow tables, but they tend to be more useful for words, rather than for serial numbers. I know they are pre computed and that a serial number is just a defined series of char...but don't know if rainbow tables for serial numbers exist.

Thanks to anyone.
Reply With Quote
  #2  
Old 09-15-2022, 13:21
aijundi aijundi is offline
Friend
 
Join Date: Jul 2019
Posts: 31
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 1
Thanks Rcvd at 25 Times in 13 Posts
aijundi Reputation: 0
Unfortunately, neither way will yield any results. You have a 16 character serial with 36 character charset, that is 36^16 combinations, almost 8*10^24.

Assuming you crack trillions of passwords per second, it will take thousands of years to go through all these combinations.

If you still want to try cracking the hashes, then use a tool called hashcat, making a program yourself will most likely be very slow compared to it.
Reply With Quote
  #3  
Old 09-15-2022, 13:54
LaDidi LaDidi is offline
VIP
 
Join Date: Aug 2004
Posts: 203
Rept. Given: 2
Rept. Rcvd 11 Times in 10 Posts
Thanks Given: 29
Thanks Rcvd at 25 Times in 19 Posts
LaDidi Reputation: 11
@TmC :
Calculate MD5 with your serial.
Change one MD5 hash with this one.
That's all.
Reply With Quote
  #4  
Old 09-15-2022, 15:46
foosaa foosaa is offline
Friend
 
Join Date: Dec 2005
Posts: 98
Rept. Given: 34
Rept. Rcvd 11 Times in 9 Posts
Thanks Given: 151
Thanks Rcvd at 75 Times in 29 Posts
foosaa Reputation: 11
Quote:
Originally Posted by LaDidi View Post
@TmC :
Calculate MD5 with your serial.
Change one MD5 hash with this one.
That's all.
Yes. This is the simplest attack you could do. Don't worry about cracking the hash. Attack the hash by replacing one the existing hash with a known hash.

If you find the location of the predefined hashes in the program, create a new MD5 hash of any string (say blablabla) and replace one of the hashes in the existing predefined hashes with the created hash and you are done. It should work unless there are any other checks that are based on the serial number.

If you would like to share the executable privately for patching, let me know and I'll see if I can help to patch it.
Reply With Quote
  #5  
Old 09-15-2022, 17:55
TmC TmC is offline
VIP
 
Join Date: Aug 2004
Posts: 326
Rept. Given: 1
Rept. Rcvd 15 Times in 9 Posts
Thanks Given: 2
Thanks Rcvd at 22 Times in 16 Posts
TmC Reputation: 15
Quote:
Originally Posted by foosaa View Post
It should work unless there are any other checks that are based on the serial number.
There is no problem with patching the program. (inlining rather than patching, since it is part of a suite that has also a hardware part and the hardware is checking for program integrity at startup).

Unfortunately, the serial is checked also when requesting updates through the update routine, and even patching the program wont pass the server check.

The serial is passed in cleartext so a patch that simply gives one random hash to check does not work.

Last edited by TmC; 09-15-2022 at 18:04.
Reply With Quote
  #6  
Old 09-15-2022, 18:56
TmC TmC is offline
VIP
 
Join Date: Aug 2004
Posts: 326
Rept. Given: 1
Rept. Rcvd 15 Times in 9 Posts
Thanks Given: 2
Thanks Rcvd at 22 Times in 16 Posts
TmC Reputation: 15
Quote:
Originally Posted by aijundi View Post
If you still want to try cracking the hashes, then use a tool called hashcat, making a program yourself will most likely be very slow compared to it.
Do you know if it is possible to supply a mask for the well known parts while letting the program generate unknown ones?
Reply With Quote
  #7  
Old 09-15-2022, 19:53
aijundi aijundi is offline
Friend
 
Join Date: Jul 2019
Posts: 31
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 1
Thanks Rcvd at 25 Times in 13 Posts
aijundi Reputation: 0
Quote:
Originally Posted by TmC View Post
Do you know if it is possible to supply a mask for the well known parts while letting the program generate unknown ones?
Yes it is possible
Reply With Quote
  #8  
Old 09-16-2022, 02:41
traf0 traf0 is offline
Family
 
Join Date: Nov 2017
Posts: 79
Rept. Given: 0
Rept. Rcvd 4 Times in 4 Posts
Thanks Given: 185
Thanks Rcvd at 106 Times in 42 Posts
traf0 Reputation: 4
Quote:
Originally Posted by TmC View Post
Do you know if it is possible to supply a mask for the well known parts while letting the program generate unknown ones?
Great tutorial how to perform mask attack using hashcat
Code:
https://www.4armed.com/blog/perform-mask-attack-hashcat/
Reply With Quote
  #9  
Old 09-16-2022, 04:55
TempoMat TempoMat is offline
Friend
 
Join Date: Jan 2006
Posts: 86
Rept. Given: 10
Rept. Rcvd 6 Times in 6 Posts
Thanks Given: 4
Thanks Rcvd at 25 Times in 18 Posts
TempoMat Reputation: 6
Quote:
Originally Posted by aijundi View Post
Unfortunately, neither way will yield any results. You have a 16 character serial with 36 character charset, that is 36^16 combinations, almost 8*10^24.

hashcat, making a program yourself will most likely be very slow compared to it.
Sholdn't the number of conbinations be 36^19, if the password format ist given as !!!!-!!!!-!!!!-!!!!?
Or are the 3 dashes removed from the password before the MD5 Hash.

@TmC: Can you share the extracted MD5 Hashes?
Just a dumb question: Are the MD5 init variables the standard ones?
Reply With Quote
  #10  
Old 09-16-2022, 05:43
aijundi aijundi is offline
Friend
 
Join Date: Jul 2019
Posts: 31
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 1
Thanks Rcvd at 25 Times in 13 Posts
aijundi Reputation: 0
Quote:
Originally Posted by TempoMat View Post
Sholdn't the number of conbinations be 36^19, if the password format ist given as !!!!-!!!!-!!!!-!!!!?
Or are the 3 dashes removed from the password before the MD5 Hash.
I have no idea if they are removed or not, but they either never change or removed, which in both cases leaves 16 variable characters.
Reply With Quote
  #11  
Old 09-16-2022, 06:06
TmC TmC is offline
VIP
 
Join Date: Aug 2004
Posts: 326
Rept. Given: 1
Rept. Rcvd 15 Times in 9 Posts
Thanks Given: 2
Thanks Rcvd at 22 Times in 16 Posts
TmC Reputation: 15
Quote:
Originally Posted by TempoMat View Post
Sholdn't the number of conbinations be 36^19, if the password format ist given as !!!!-!!!!-!!!!-!!!!?
Or are the 3 dashes removed from the password before the MD5 Hash.
The 3 dashes are always there, they are known chars.

Quote:
Originally Posted by TempoMat View Post
Just a dumb question: Are the MD5 init variables the standard ones?
Don't understand
Reply With Quote
  #12  
Old 09-16-2022, 16:09
Jupiter's Avatar
Jupiter Jupiter is online now
Lo*eXeTools*rd
 
Join Date: Jan 2005
Location: Moscow, Russia
Posts: 194
Rept. Given: 24
Rept. Rcvd 58 Times in 34 Posts
Thanks Given: 8
Thanks Rcvd at 119 Times in 30 Posts
Jupiter Reputation: 58
Lightbulb MD5 collisions

When I saw title of this thread ("Hardcoded md5 serial number crack") my first thought was "COLLISIONS". But no one mentioned MD5 collisions yet.

It's better to threat serial number as bytes (not as text) to successfully implement an attack.

You can find appropriate MD5 collision sources at GitHub, for example:
MD5 collision

Quote:
Originally Posted by TmC View Post
Don't understand
May be he means MD5 initial values from reference implementation.
__________________
EnJoy!
Reply With Quote
  #13  
Old 09-16-2022, 16:30
TmC TmC is offline
VIP
 
Join Date: Aug 2004
Posts: 326
Rept. Given: 1
Rept. Rcvd 15 Times in 9 Posts
Thanks Given: 2
Thanks Rcvd at 22 Times in 16 Posts
TmC Reputation: 15
Quote:
Originally Posted by Jupiter View Post
When I saw title of this thread ("Hardcoded md5 serial number crack") my first thought was "COLLISIONS". But no one mentioned MD5 collisions yet.

It's better to threat serial number as bytes (not as text) to successfully implement an attack.

You can find appropriate MD5 collision sources at GitHub, for example:
MD5 collision



May be he means MD5 initial values from reference implementation.
They are plain MD5 textual hashes like MD5(Serial) = Hash
Reply With Quote
  #14  
Old 09-16-2022, 17:23
aijundi aijundi is offline
Friend
 
Join Date: Jul 2019
Posts: 31
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 1
Thanks Rcvd at 25 Times in 13 Posts
aijundi Reputation: 0
Perhaps you can check this and do something similar
Reply With Quote
  #15  
Old 09-16-2022, 17:56
foosaa foosaa is offline
Friend
 
Join Date: Dec 2005
Posts: 98
Rept. Given: 34
Rept. Rcvd 11 Times in 9 Posts
Thanks Given: 151
Thanks Rcvd at 75 Times in 29 Posts
foosaa Reputation: 11
Quote:
Originally Posted by TmC View Post
There is no problem with patching the program. (inlining rather than patching, since it is part of a suite that has also a hardware part and the hardware is checking for program integrity at startup).

Unfortunately, the serial is checked also when requesting updates through the update routine, and even patching the program wont pass the server check.

The serial is passed in cleartext so a patch that simply gives one random hash to check does not work.
Yup. Thought so. Would you mind sharing the program name in a PM? Thanks.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 20:34.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2022 )