Ive recently heard that There infact is a way in decoding Serv-u Passwords. Ive emailed Cat-Soft company on if they know how to decrypt these Serv-U passwords. This is some of my Feedback.


You can't actually decrypt passwords once they are encrypted. Serv-U uses
UNIX 'crypt' which was designed to be one-way only (and as far as I know
there has not been anyone yet that cracked this, so for all practical
purposes the clear text password is gone).


What Serv-U does is encrypt the user's password again when that person
logs in and then compares the enctyped password with what's stored. If
the two match it is assumed the clear text was the same. There is of
course always a (about) 1 in 10-to-the-power-20 chance that someone hit
on something that also verifies to be the same even though the clear text
did not match..


The first two characters of a encrypted password are the 'salt'. These
are random and determined at the time of the first password encryption
and passed on the the 'crypt' function. They are to scramble the
encryption results, so if you encrypt "secret" it'll give different
results each time you do that, thus making dictionary attacks difficult
(you'd have to encrypt a dictionary for all possible salt values before
being able to compare the dictionary with the encrypted passwords). So,
to compare encrypted passwords with what the user types you need to
encrypt the the user's text with the salt taken from the already
encrypted password (the first two characters), using 'crypt'.


I cannot give you the source for crypt, but various sources are available
on the Internet (see things like FreeBSD, Linux, and Crack). Also, the
DLL version of the password util at
ftp://ftp.cat-soft.com/Add-Ons/Passwd/ will do it for you (in fact, it'll
compare any cleartext with any encrypted password and tell you if the two
match). That DLL won't work in VB though (which is what you're using,
isn't it?).

This guy says Cat-soft thinks 95% serv-u use random crypting.
But there is a new method of decrypting.

Now the passwords for Serv-u Look like This..

[USER=a|1]
Password=tz1BACB112C654EB43BD5AFDBA8DBB4614


That is found in ServuDaemon.ini

If anyone has any information on decrypting Serv-U Passwords Plz. let me know. Thanks ~will

yes it is crackable

just try it yourself with like the password "abc"

yeah its crackable even the iroffer pass can be cracked...just need the proper tools. start with john the ripper, mdcrack, Supassconvert

if it uses crypt() function you can make it look like a unix passwd listing so for example....

UuCp:OORoMNEN9FyZfNE:4:4::/var/spool/uucppublic:/usr/lib/uucp/uucico

than crack it... using JTR

(i know I know not my login just pulled it off a site real quickly )

Get RainbowCrack.. It Now Supports MD5 Hash Cracking

hmmm.. I have 2 questions.

1. can we really dcrypt serv u passwords. if so then can sum1 be kind enogh to help me out decrtpting the password.
Version=2.5.4.2
[USER=revolt]
Password=evm55XQwucBAs


2. well whenever i am trying to start a new topic i get a error "Sorry, an error occurred. If you are unsure on how to use a feature, or don't know why you got this error message, try looking through the help files for more information.

The error returned was:

Sorry, you do not have permission to start a topic in this forum"

What does this mean ?? and y am i getting this error

Thank U

hmm.. i guess no 1 want to reply me.. pls. tell me y i am not able to start any new topic..

And also pls. guide me how to decrypt seru deamon passwords..

Thanks

password decyption is good, but servu, only reason is rehacking!? not really a fair move

god gave us a brain to search for better servers

aTa

i also need this sort of tool cause some times i forget the password

hey ara2.... your not interested in anyones post.... you want to get to the downloads....i been watching you for about an hour

look at your post times also....

well you paid the price... reset to 5 and warn point issued

Try Cain, it's nice decrypting program:
http://www.oxid.it/downloads/cain25b46.exe

The pass is "a"

Here the commandline (you need mdcrack)

nice i always thougt MD5 can't be decrypted but this seems to be wrong. Thank you for your support all now im trying your ways to decrypt and hope I'm successfully

edit, i'm sry , it dos work.

sry , nice stuff

well as you can see above it can't be decrypted just brute-forced.

Okey, what you get out the ini is for example :

xn937F70E2778A1FA78D95940DFD3BCE04

then this is the md5 hash

xn937F70E2778A1FA78D95940DFD3BCE04

and the bruteforced pasword will be something like this :

xnBrUtForced

so you have the first two chars to start with.
is there a program where you can brute force with, where you can give in the first digets?

I see that the vb frontend for mdcrack 1.2 has is, but the frontend dossen't work here.mdcrack crashes when i use it.



//found how to do it without the frontend.

i read about rehacking... it's lame but there other ways to get in.... when you have write-access you can easy copy your own encrypted pass to the servu..ini

Any ServU ini I've seen doesnt contain a 32bit md5 hash, it contains a mixture of characters etc such as b35s22/sh716 (that was just random) how would one convert this to the 32bit string?

I done the 1st one posted fine, the second one was taking a while, it got to the 7th character before I terminated it.

PS. Im not using the win32 version.

Hmm, can someone give MDCRACK.exe then?

Found it: http://membres.lycos.fr/mdcrack/download/mdcrack.exe

Big thx 4 the nfo i have search so often 4 the right pass in Servu.. because i have forget to backup my Server list :\ before i reinstall the system.

Thx again Doc

I could be be bloodry wrong here, but ServU does NOT use MD5 for one thing.

And for another, with version 5.0 they've changed encryption method, wont be long until everybody upgrades, meh

ok i cant get this to work
so whats fa948C78C24438E9F6BA4D5B756F7ACB37

it should be pass

I've been looking for one of these thanks

All this talk about MD5 hash cracking, in my opinion John the Ripper (JtR) is the best cracker as it works through each hash against a set of logic rules, therefore it doesn't just blindly brute force it actually systematically works its way through different possibilities. I know this isnt directly related, but cracking a LM hash with LC4 took me 18 hours for a 9 char password, JtR took 5.

ok now

can anyone help with how to crack an iroffer password

Look at both hashes once more.
Both of those are hashes of the same password.
First hash is hash provided by md5 hash feature in mysql (quickest way I knew to generate one since I run mysql locally anyway)
Second hash is hash generated by servu

Don't look same to me.

P.S. Did you use any other nicks?

have u ever tried to find out how md5 works gk0r ??

md5 is made to be a one time hash. So u can redo teh same password over and over and u'll rarely get teh same hash. As the other dude said. Serv-u stores the "salt" with the stored hash so servu can then use that salt with the password provided by the user connecting and get an md5 hash, and then compare teh result with what is stored.

Yea MD5 is a 1 way algorithm, But It doesn't change each time you run it through the algorithm, as someone said previously their would be no reason for authentication then.

here, i tested it, v5.0 still uses md5 encryption.


I made a pasword 123 in serv-u
the generated code was

Password=tg5D5E50C22BD32992937AFF199C01D47C
so the salt is "tg" and the md 5 hash is = 5D5E50C22BD32992937AFF199C01D47C

so when i brute the hash, the pasword i find wil be : tg123

People, people... why not to search the source for informations?

Here's an info from Serv-U Knowledge Base:

Guys, why not make salt more than 2 characters ? Won't it make bruteforce impossible if you make salt 8+ characters ?

AAAAAAAA

I get it. It is added to password before the encryption and then once more shortly after before the actual hash - stupid if you ask me but what the hell ......

OK here is a method you can use but it can take time!!!
1)Download the daemon.ini with password you want to crack.
2)Setup Servu on your own box with the INI with to-be-cracked pass.
3)Get any FTP pass cracking program and good dictionary and bruteforce it :-)

Hi, i need to know whats the user name for this

[USER=driveax|1]