How to Create Rainbow Tables for Hashing Algorithms Like MD5, SHA1 & NTLM « Null Byte :: WonderHowTo

A rainbow table can be thought of like a dictionary, except instead of words and their definitions, it holds combinations of characters on one side and their hashed form on the other. What is a hash and why would you want to know what random combinations of characters are hashed into?Passwords on the internet are almost always stored hashed. A hash is a method of cryptography that is very cheap to calculate in one direction but very expensive to calculate in the opposite direction. What that means is that you can take a raw text input, say the stringpassword, and run a hashing algorithm on it such as MD5 to get an output of5F4DCC3B5AA765D61D8327DEB882CF99.While MD5 may be being replaced by stronger hashing methods such as bcrypt, it's still commonly used on LAMP stacks across the internet today.Going back to rainbow tables, we should have an entry sayingpasswordon one side and5F4DCC3B5AA765D61D8327DEB882CF99on the other. Should we ever come across this hash, we can search our table, find it, and learn what the original string was. However, before we can do that, we must learn how to make a rainbow table.For this guide, I'll be demonstrating from a base of Kali Linux running in a virtual machine, but the instructions for most Linux distros will be basically the same. I will also include some information for those on the Windows platform.Step 1: Set Up RainbowCrackWe'll be usingRainbowCrackto create and sort our tables. Kali Linux comes with RainbowCrack already installed, but if you don't have it or are running on Windows, you candownload itor useaptitudeif you are on a Debian-based distro like Mint.On Windows, once you have downloaded RainbowCrack, create a new folder that you can easily navigate to with Command Prompt and extract everything into it. Then, open the Command Prompt, and navigate to the directory you created. Move on to Step 2, since the next paragraphs are for Kali.In Kali, once we're sure RainbowCrack is installed, we'll need to create a new folder and navigate into it. This is where our tables will be generated and sorted (seeStep 3and4for exceptions). You can use the following commands to set up the folder in your home directory. It's best to use a new and empty directory for the sorting process that comes after the table is generated.cd ~
mkdir RainbowTables
cd RainbowTablesIt's important to keep in mind that rainbow tables take up enormous amounts of storage space, especially when you include a wide character set and a long max length. Make sure you have room for hundreds of gigabytes at the very least. Having at least half a terabyte free is better. If you don't have this space available, you can still follow along using smaller character sets, shorter max lengths, and shorter chain lengths.Step 2: View the ParametersOnce we're in the directory we created, we can runrtgento make sure everything is installed correctly. This will also return some convenient help, with some example usages ofrtgenand the naming of parameters.rtgen

RainbowCrack 1.7
Copyright 2017 RainbowCrack Project. All rights reserved.
http://project-rainbowcrack.com/

usage: rtgen hash_algorithm charset plaintext_len_min plaintext_len_max table_index chain_len chain_num part_index
       rtgen hash_algorithm charset plaintext_len_min plaintext_len_max table_index -bench

hash algorithms implemented:
    lm HashLen=8 PlaintextLen=0-7
    ntlm HashLen=16 PlaintextLen=0-15
    md5 HashLen=16 PlaintextLen=0-15
    sha1 HashLen=20 PlaintextLen=0-20
    sha256 HashLen=32 PlaintextLen=0-20

examples:
    rtgen md5 loweralpha 1 7 0 1000 1000 0
    rtgen md5 loweralpha 1 7 0 -benchAs you can see, there are two usages given with one example for each:rtgen hash_algorithm charset plaintext_len_min plaintext_len_max table_index chain_len chain_num part_index

 rtgen md5 loweralpha 1 7 0 1000 1000 0

rtgen hash_algorithm charset plaintext_len_min plaintext_len_max table_index -bench

 rtgen md5 loweralpha 1 7 0 -benchOf course, because of the space constraints, the parameters aren't really explained, so I'll do that so it's easier to follow along later.hash_algorithm:This is the hash algorithm that we want our rainbow tables to use. You can see a list of available algorithms underhash algorithms implementedin the return text. For our example, we will use MD5, but RainbowCrack is just as capable of making perfect SHA1 and NTLM tables, and I will provide the code for the tables for all three.charset:The set of characters used to generate the plain-text strings for the rainbow tables.Numericis digits 0–9,loweralphais alphanumeric (all letters and digits 0–9), but only in lowercase. For a full list of charsets that you can use, see "charset.txt" that comes with RainbowCrack.plaintext_len_min:The minimum length of plaintext strings. For example, if we choose a numeric charset and a min and max of 1, our table will contain all digits 0–9 and their hashed equivalent.plaintext_len_max:The maximum length of plaintext strings. For example, if we choose a min of 1 and a max of 2, we get all digits 0–9 and 00–99 and their hashed equivalents in our table.table_index:This parameter selects the reduction function. A reduction function is a math formula that trims the number of combinations by removing combinations that are incredibly unlikely to be used. By doing so, it lowers computational time drastically. But the flip-side is that there is a tiny possibility that any given reduction function will skip the combination we're looking for, so "perfect" tables use multiple runs with different reduction functions to make tables that are "perfect," containing every possible combination.chain_len:This controls the length of each table. The larger this number is, the more plaintexts are hashed and stored in the table. This is why the reduction function mentioned above matters — it will reduce possible combinations to the chain length you picked. The flip-side of having a long chain length is generation time. If you want a table that is "perfect" and vast, it can take months.chain_num:This is the number of chains to generate. Each chain will be 16 bytes.part_index:This is for situations where your hard disk space or computing power is limited, or when your filesystem is unable to address extraordinarily large files. We can change this from the 0 that it should normally be to segment the table file into smaller parts.-bench:This is a flag that you can add to do a benchmark on the settings that you have selected. It will not actually create any rainbow tables, it will just determine some numbers that you can use to determine how fast you can generate table entries. Based off of that, you can determine how long table generation will actually take.Step 3: Generate the Rainbow TablesNow, let's generate those tables! Note, if you're using Windows instead of Linux, you may have to usertgen.exeinstead of justrtgenin my examples below. Run each of the commands below separately. But be warned, these will take hours to fully generate. You can hitCtrl-Con your keyboard to quit, and the next time you run the same command, it will resume where it left off.rtgen md5 loweralpha-numeric 1 7 0 2400 24652134 0
rtgen md5 loweralpha-numeric 1 7 1 2400 24652134 0
rtgen md5 loweralpha-numeric 1 7 2 2400 24652134 0
rtgen md5 loweralpha-numeric 1 7 3 2400 24652134 0
rtgen md5 loweralpha-numeric 1 7 4 2400 24652134 0
rtgen md5 loweralpha-numeric 1 7 5 2400 24652134 0The commands above generate six different rainbow tables using theloweralpha-numericcharset which contains 36 possible characters. For any plaintext falling into that category, we will have over a 99% chance of having its hashed equivalent in our tables.rtgen md5 loweralpha-numeric 1 7 0 2400 24652134 0
rainbow table md5_loweralpha-numeric#1-7_0_2400x24652134_0.rt parameters
hash algorithm:         md5
hash length:            16
charset name:           loweralpha-numeric
charset data:           abcdefghijklmnopqrstuvwxyz0123456789
charset data in hex:    61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39
charset length:         36
plaintext length range: 1 - 7
reduce offset:          0x00000000
plaintext total:        80603140212

sequential starting point begin from 0 (0x0000000000000000)
generating...
65536 of 24652134 rainbow chains generated (0 m 21.3 s)
131072 of 24652134 rainbow chains generated (0 m 32.8 s)
196608 of 24652134 rainbow chains generated (0 m 32.2 s)
262144 of 24652134 rainbow chains generated (0 m 32.9 s)
327680 of 24652134 rainbow chains generated (0 m 32.2 s)
393216 of 24652134 rainbow chains generated (0 m 33.0 s)
458752 of 24652134 rainbow chains generated (0 m 33.3 s)
524288 of 24652134 rainbow chains generated (0 m 34.0 s)
589824 of 24652134 rainbow chains generated (0 m 33.3 s)
655360 of 24652134 rainbow chains generated (0 m 33.8 s)
720896 of 24652134 rainbow chains generated (0 m 33.0 s)
786432 of 24652134 rainbow chains generated (0 m 32.3 s)
851968 of 24652134 rainbow chains generated (0 m 34.0 s)
917504 of 24652134 rainbow chains generated (0 m 34.3 s)
983040 of 24652134 rainbow chains generated (0 m 34.4 s)
1048576 of 24652134 rainbow chains generated (0 m 33.7 s)
.....When each rainbow table is finished, it will be saved as the .rt file that the command generates, putting it into your current directory. So each rainbow table will get its own unique .rt file. Note that on newer versions, rainbow tables may be saved in your/usr/share/rainbowcrackdirectory instead of your current directory.If you are trying to create tables for SHA1 or NTLM, or perhaps a different charset and length for MD5, you can referencethe tables created by the RainbowCrack team. At the bottom of the page, you can select the algorithm you are looking for to view a list of the commands to run to build your own.Step 4: Sort the Rainbow TablesOur rainbow table generation is done, but we can't use them just yet. We need to sort them into one table that we can then efficiently search. Luckily, doing this is easy, we just run:rtsort .As long as we are in the directory we generated them in, thertsort .command will turn all the tables we generated into easy-to-search .rt files. These files will be accessible in the directory we chose, in this case,Rainbow Tablesin the home directory. However, in some versions of Rainbow Crack, all .rt files will be saved in the/usr/share/rainbowcrackdirectory, no matter what directory you're currently in. The command above should still work when in the folder you created inStep 1.Now you have a near perfect rainbow table at your disposal. We'll discuss what we can do with this table, how to do it, and how to protect yourself from people attempting to use rainbow tables to crack your passwords in another guide coming soon.Don't Miss:Null Byte's Guides on Password CrackingFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image and screenshots by Goods/Null ByteRelatedHow To:Use Hash-Identifier to Determine Hash Types for Password CrackingHow To:Hack MD5 passwords with Cain and AbelHow To:Creating Unique and Safe Passwords, Part 1 Using WordlistsHack Like a Pro:How to Crack Passwords, Part 1 (Principles & Technologies)How To:Hack MD5 passwordsHacking Windows 10:How to Intercept & Decrypt Windows Passwords on a Local NetworkHack Like a Pro:Cryptography Basics for the Aspiring HackerNews:Inside Bitcoin - Part 2 - Cryptographic HashesHow To:Crack MD5 Hashes with All of Kali Linux's Default WordlistsHack Like a Pro:Digital Forensics Using Kali, Part 2 (Acquiring a Hard Drive Image for Analysis)How To:Crack Shadow Hashes After Getting Root on a Linux SystemHack Like a Pro:How to Crack Passwords, Part 2 (Cracking Strategy)Hacking Windows 10:How to Dump NTLM Hashes & Crack Windows PasswordsHow to Hack Wi-Fi:Cracking WPA2-PSK Passwords with CowpattyRainbow Tables:How to Create & Use Them to Crack PasswordsHow To:Make an Unbreakable Linux Password Using a SHA-2 Hash AlgorithmHow To:How Hackers Take Your Encrypted Passwords & Crack ThemSecure Your Computer, Part 2:Password-Protect the GRUB Bootloader on Dual-Booted PCsHow To:Recover a Windows Password with OphcrackHow To:GPU Accelerate Cracking Passwords with HashcatNews:FarmVille German Limited Edition ThemeGoodnight Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsHow To:Remove a Windows Password with a Linux Live CDNews:Rainbow Chickens