Well was just wondering how we could brite force serv-u
password having the ini file, i know that is use a 128 bit
encryption / MD5 and i was looking fo an MD5 brutforce
cracker, like John the ripper for unix password, I know
that thissubject comes very often on a lot board, but i
like when things comes to difficult stuff, and am sur it is ^^

thnxs for anu clue...

By the way will try cain to try to break it...

well save the hashes to a file open cain and load them.. it will crack various MD hashes

md5 md4 md2 , cram, apop, etc etc

you can brute force or dict crack...its pretty straight forward

biggest problem is the time.. depending on the password strength can take minutes ,hours or days

well worth a try

err i dun think serv-u uses md5 m8. most web boards do.

but their is a serv-u cracker out there, got 1 on a chinese site just recently...

pretty sure not md5 tho

if u wanna crack md5 dun use john or that stuff, there is a special cracker named md5crack i think..

cracks like 4 letters in like 20 seconds

i don't know the encryption of servu pwd.

here is mdcrack if you need

it cracks md4, md5 and ntlm1 .

MDCrack

enjoy

sb pls write nfo to crack serv-u pws tried everything but nothing works !

GOT IT

mdcrack.exe -V (yd)2B7B9EE515C3546308EF9F09B268B5AE

u clear the first 2 letters and u will get it in a few hours

e.g. this password is (f u c k) ! u have to leave (yd) out !

can you use @stake lc4 also ?
if so, how do i import the adminpass from servu.ini ?

i'll test mdcrack.exe now! thx for sharing.

no, lc4 is not able to crack md5 passwords.

Im looking for FreeBSD MD5 password cracker, which is not JTR (John The Ripper).
Is there some faster tool? Something like SAMInside for NT? That is written in assembler or something?
2000 keys/sec is too slow for bruteforce...

just tested mdcrack with a passwordlength of 3 chars.
seems to work really fine.

i also visited the authors website, there i read that an 8 char password consisting of a-z;A-Z;0-9 might take 490 day or something. (to take the example of servu passwords, it's most likely that you can't determin a smaller charset)
if so, are there faster md5 crackers or might it be possible to cluster it somehow to have more comps cracking it?

greetz
=k3Rn=

For me mdcrack doesn't work. I've tried few passes and without any luck (salt was substracted before cracking; it was a long time ago and i don't have these passes now).
I've read somewhere that Serv-U encrypts its passes with md5 and then hexes the hashes in someway.



P.S. If i remember correctly these passes i was trying were encrypted using servu 4.x. And with which ServU version were encrypted yours passes?

didn´t have any luck....probely because i´m not sure what code these are!!
qc828E090B85DC209B3FC7CC50D8584517

bbD0B54811F097DF6578FA7527DE84ED01

xp99025BD2BD982FD8507ADDF56A212088

keep getting this!!

<<System>> MDcrack v1.2 is starting.
<<Error>> A md5 digest must have 16 bytes length (32 ascii digits from 0 to F).


can somebody help me out on this please??


Thx

Devil

try CAIN http://www.oxid.it/

over 3000000 pass/sek
very fast and stable

thx for the tip....now its working for me!!!

Est-ce que quelqu'un peux expliquer clairement comment y arrivé? merci

Somebody can explain clearly how y arrived? thx

y? what y?

It doesn't work for me, i think the new serv-u uses different encryption.

hashes serv-u: 2D56B323E4B25E285CD88F18C50A3D5C
caine md5 hashes = 3D801AA532C1CEC3EE82D87A99FDF63F

Both the password is temp.

Mdcrack works however.

hrm. i'm not sure what serv-u does to hide it's passes but ill browse through the documentation, bound to be somthin more there. =\~

serv-u adds the first two lowercase characters from the hash (which are generated the first time you make a password) to the beginning of the password, and then md5 hash it

example:
pe9BAB288332AB2DB1362EEB1DF462DE2C would be a serv-u stored password for "test", which in fact is the md5 hash of "petest" with "pe" added at the beginning so serv-u will know what characters it needs to add to the password to get the correct hash

made a quick script to generate passwords:
http://home.no.net/~fritzer1/servu.php

so cain probably does it differently while mdcrack does the same, since you end up getting different hashes

mdcrack is much easier to use to crack the servu hashes. Just use the following:

mdcrack -s 'abcdefghijklmnopqrstuvwxyz' -b bb D0B54811F097DF6578FA7527DE84ED01

where bb will be added to the actual password in the result. This one crack for me in about 200 seconds on a 1Ghz machine.

I used the -s option to reduce the size of the characterset to brute force.

hmm i think its bad to try see the other peoples pass in serv-u...
Anyway nice tutorial...

Rehackers are no nice persons ^^

lol
can someone put it back up so i can download it?
thanks

Yes.. would someone be kind and post another download link for mdcrack? ; )

TIA

maybe u use !google

http://mdcrack.df.ru/index2.html

k this turned out to be a bit confusing
i saw 3 different people with 3 different ways to work mdcrack

I found a ServUDaemon.ini on a box I run, and has something I have never seen in it.(Following) I'm just wondering how I would go about cracking this, and what this SKEY/OPT thing is? Something new in 5.0 maybe? Thanks in advance. ; )

[USER=admin|1]
Password=4C744A0C565D4E16540814030A595355170E
Maintenance=System
PasswordType=OTP S/KEY MD5
SKEYValues=0 0 EF9DDC99C42FBCFD 588 junk005

I`m not sure but i Think there are 2 keys eventually is one of them for syste mamintenance and the other one for ftp login ???

what about v2.5? what about this?

it works fine for me with cain...

aapje.. You cracked the password I posted with cain? or were you talking to someone else? If so, please tell me how, I am very interested in learning.

hmm md5 works fine... but what about older passwords from older servu versions ? They are way diffrent. Coulndn't find info for wich encryption it is.

Hi how can i decode servu 2.5 password there are a little shorter

password is h4

use PasswordsInside, best md5, md5 cracker in my opinion. Has fast burteforce, awsome dictionary attacks!
http://insidepro.com

this