/* 
 *
 * 
 *	PalmCrack 1.1
 * 
 *      By: Steve Lodin for Noncon Inc
 *	http://www.noncon.org/
 *      
 */

/* 
   
Pilot application (requires pc.prc and pcX.pdb) for Password Cracking

pc.prc is the main application - PalmCrack
pcX.pdb is the wordlist database for password checking (where X is the number
of words in the database - 3, 26, 2048, or 23956)

This program is (C) Copyright 1999 by Steve Lodin.

This program is provided free of charge.  It may be copied/beamed/shared.
In the spirit of "postcard-ware", here is my request.  If you use this
program to crack a password, please send me the plaintext of the password
you break.  I will compile a list of cracked passwords.  If you have 
additional words you would like added to the dictionary, please send those 
also.

	palmcrack@noncon.org



Program Description
-------------------
This program tries to crack an single encrypted password.  If a wordlist
database is found, it tries this first.  A brute force crack is attempted
next if requested by the user if the password wasn't found using the wordlist.
The brute force crack is very compute intensive, mainly because of the number
of iterations required.  As a result, the brute force check is disabled by
default.

                               Number of Iterations
                               UNIX (x=8)  NT (x=14)    NT Case Insensitive
                               ----------  ---------    -------------------
   Lower case = 26^x =          2 x 10^11  6 x 10^19
   Lower case w/nums = 36^x =   3 x 10^12  6 x 10^21
   Mixed case = 52^x =          5 x 10^13               6 x 10^19
   Mixed case w/nums = 62^x =   2 x 10^14               6 x 10^21
   All symbols = 92^x           5 x 10^15               3 x 10^25

   As you can see, the number of iterations is pretty huge and not really
   feasible for a tiny, single CPU Dragonball Pilot.  As an estimate, for
   passwords up to 4 characters in length, it takes approximately 5
   hours just to check the entire space for only lower case characters!

   26+26^2+26^3+26^4 iterations / 27 iterations/sec / 3600 secs/hr = 4.9 hours

This program currently works on standard UNIX passwords based on the crypt() 
function (not FreeBSD-type) and on NT LANMAN password hashes (not MD4 hashes).  
See http://www.l0pht.com/l0phtcrack/ for more information on NT passwords.

See http://www.cisco.com/warp/public/701/64.html for more information on 
Cisco Type 7 Passwords.


Program Operation
-----------------
To test the program, install the PRC and one of the PDB files.  On a UNIX 
box, assign a password that is in the wordlist database to a user.  Take
the /etc/passwd file (or /etc/shadow) encrypted password entry for that 
user and enter it into PalmCrack.  On an NT box, assign a password 
that is in the wordlist database to a user, then run pwdump, or pwdump2
if SYSKEY is enabled, in order to dump the password file entry.  In the debug 
menu,  you can select one of the Delay entries so that you can see the test 
password and test password encrypted value in the Pilot display.  On a Cisco
box, look for the string "... password 7 <something>" and the <something> is 
the encrypted password in the router config.

To run the program in a production mode, load one of the high word count
databases or create your own list of potential passwords and load that.  On
the target system, grab the encrypted password string of the target user.
If you don't expect it to be in the wordlist database, you can turn on the
brute force check (good luck!) via the Debug menu.

You can get the encrypted password strings into the program via three methods:

1) Use graffiti to manually enter the encrypted password entry.
2) Enter the entry(s) into a Memo on the PC (using cut and paste from a UNIX
   window) and Hotsync the Memo to the Pilot.  Then use the Edit menu options
   for cutting and pasting an entry into the password field of the PalmCrack
   application.
3) Use the Online program from Mark/Space Softworks to connect to a serial
   port and have VT100 access to the target UNIX box.  Once you reach this 
   point, you can have your sessions logged to the Memo pad, so just 
   cat /etc/password (or /etc/shadow) and you'll have your password entry 
   in a Memo.  Follow step two above.


Wordlist Databases
------------------
The pc3.pdb file has the following words:
	abat,abate,abater
The pc26.pdb file has the following words:
	Aarhus,Aaron,Ababa,aback,abaft,abandon,abandone,abandons,abase,abased,
	abasemen,abasemen,abases,abash,abashed,abashes,abashing,abasing,abate,
	abated,abatemen,abatemen,abater,abates,abating,Abba
The pc2048.pdb file has the most popular passwords as defined by Solar Designer
	who is the author of the Jack the Ripper password cracker.  (password.lst)
The pc23956.pdb file is /usr/dict/words with redundant words over 8 chars removed.


Test UNIX Entries
-----------------
The following entries are given as examples.  The first set are available in the
wordlist databases.  The second set are not in the wordlist databases, but are
instead to be used for bruteforce testing.

	Word		UNIX String	Wordlist DB
	----------	-------------	----------------
	abate		6IBtH0Pa.Z3CU	pc3 pc26 pc23956
	abandon		BR.UVEuUghtVo	pc26 pc23956
	abates		QYWNkxa6.4Gvw	pc26 pc23956
	catheter	brvrJuAj/9bbM	pc23956
	zoning		va3hnhc7iCD7k	pc23956

	a		l.TZl6dtiYQzw	bruteforce
	aaaaa		a7v48i2ATppKc	bruteforce
	b		80qMFthAKk20g	bruteforce
	c		x052cJUxVZML2	bruteforce

Test NT Entries
---------------
The following entries are given as examples.  The first set are available in the
wordlist databases.  The second set are not in the wordlist databases, but are
instead to be used for bruteforce testing.


	Word		NT String				Wordlist DB
	----------	--------------------------------	----------------
	abate		C76CB71539EE26DBAAD3B435B51404EE	pc3 pc26 pc23956
	abandon		B8CA0FF2B03CAC28AAD3B435B51404EE	pc26 pc23956
	abates		CA6FD006F5F1C6D6AAD3B435B51404EE	pc26 pc23956
	catheter	2B4DCFB51E169629944E3DF489A880E4	pc23956
	zoning		11410DCD84F90C23AAD3B435B51404EE	pc23956

	a		7584248B82DC9F9EAAD3B435B51404EE	bruteforce
	aaaaa		A80F6E6A87BA6AC2AAD3B435B51404EE	bruteforce
	b		902139606B6D16B5AAD3B435B51404EE	bruteforce
	c		F9393D97E7A1873CAAD3B435B51404EE	bruteforce


Test Cisco Entries
------------------

	Word		Cisco String
	----------	--------------------------------
	term		051F031D2C
	test		01305E1812
	term		1403171901
	ocdeq		130A14160E1D	


Program Forms Flow
------------------

Main Page (PalmCrack) -> UNIX Password Entry  -> Running -> Main Page
                      -> NT Password Entry    -> Running -> Main Page
		      -> Cisco Password Entry -> Running -> Main Page


Minimum Hardware Requirements
-----------------------------
I believe the minimum requirements are a PalmPilot with PalmOS 2.  I wrote
the software using the GCC SDK for Win32 with GCC 2.7.2.2, the GNU Emacs 
editor version 19.34.1 for Win32 and the CoPilot version 1.0b9 for 
emulation.  I tested the program using the following hardware 
configurations:

	- 3Com PalmPilot Professional with PalmOS 2.0.5 Pro and 1MB
	- IBM WorkPad (PalmIIIx) with PalmOS 3.1 and 4MB

It was also tested using the PalmOS Emulator (POSE) v2.1d29 with the following
configurations:

	- 3Com PalmPilot Professional with PalmOS 2.0.5 Pro and 1MB
	- 3Com PalmIII with PalmOS 3 and 2MB
	- 3Com PalmIIIx with PalmOS 3.1 and 4MB
	- 3Com PalmV with PalmOS 3.1 and 4MB


Memory Requirements
-------------------
The program itself takes approximately 31KB (version 1.1).

A dictionary with 4000 words yields a PDB file of 63KB, which loaded into 
my Pilot as a size of 101KB.  The 23956 word dictionary yields a PDB file
of 364KB which loaded into the Pilot as a size of about 644KB.


Performance
-----------
The current performance* for UNIX dictionary wordlist comparisons is 25/sec.^  
The current performance* for NT dictionary wordlist comparisons is 60/sec.

* Note, this is based on unmodified clock speed of a PalmPilot Professional.
  Using the ClockMaster hack or other clock speed modifying programs will
  change these performance results.

^ Note, Alec Muffett says that in 1992 when working on Crack, replacing crypt()
  with fcrypt() yielded 25/sec on a Sun 3/60.  This makes sense because the
  Sun 3/60 was based on a Motorola processor!


PalmCrack Revision History
--------------------------
1.1	12/09/99

	Added Cisco password decryption to the product.  Added form, labels,
	buttons, and Cisco type 7 decryption code.  Added Example Cisco 
	Passwords to the Help Menu.

1.0	11/19/99

	Changed the name from SnatchCrack to PalmCrack.


SnatchCrack Revision History
----------------------------
2.0	11/02/99

	Released version.  Changed the dictionaries to include the 23956
	word version.

1.6	10/12/99

	Fixed NT LANMAN password cracking.  In order to do so, replace the
	NTCrack version of files with the Crack5.0a NT version.  Modified 
	Makefile appropriately.  Fixed the Help -> Encrypt version of NT
	encryption also.

1.5	9/29/99

	Added NT LANMAN password cracking support.  Not yet completely
	working.  Added three entries to the help menu.  The first is 
	a list of example UNIX passwords and its corresponding encrypted 
	value.  The second help menu entry is the NT version of example
	passwords.  The third help menu entry is Encrypt which will take
	the password of your choice and encrypt it giving you the
	ciphertext so you can test the program.  At this point, the NT
	encryption version is not yet implemented.  Added a warning
	popup to the brute force enabling menu items to remind the user
	that brute force can take a long time!

1.4	4/16/99

	Changed debug menu wording, added focus to password entry field, 
	added more info to README.

1.3	4/2/99

	Brute force checking is disabled by default.  It has to be enabled
	using the menu pulldown structure described below.  Currently, only
	lower case brute force checking is performed, no upper case, 
	digits or symbols.

	Created Debug menu pulldown.  Put the following under it:
		Added Debug Delay modes to menu. 10, 75, 150 are the choices.
		Added brute force max size debug menu items. 4 and 8 are the
			choices beyond the default 8 for UNIX and 14 for NT.

1.2	3/26/99
	
	This version supports wordlist databases.  Included is the perl
	script scmwdb to create the PDB database file containing the list
	of words to compare from.

	Also, the brute force check is disabled in this version.

	This version does about 25 checks per second.

1.1	9/10/98

	This version does brute force checking only.  No statistics available.


Todo
----
- Pass control back to the OS to recognize events so that the application can
  be stopped or cancelled.

- Add support for PalmOS3 (including the Progress widget).

- Have Alec Muffett "crack-ize" the program :-).

- Add support for the NT challenge response password scheme.


Credits
-------
Thanks go to Alec Muffett for writing Crack and to the L0pht team for
writing L0phtCrack and the L0phtCisco Pilot applications.  Also, Eric
Young for his crypto code.  Thanks to Major Malfunction for his Pilot
Cisco decryption code.  Finally, thanks to Jonathan Wilkins and
Jesse Burns for NTcrack.

*/