DEMO: Rainbow Tables

It's important that we're not storing any kind of passwords in clear text form. So if we have a database and it's storing passwords, we shouldn't actually be storing the actual passwords. We should be doing something like hashing those values, and it's common practice nowadays to hash those values. So if you were to ever get a hold of passwords, you couldn't just see what that password is. But there are ways to get around that.

Just a reminder that this is for educational and ethical hacking purposes only. This is meant to protect systems, not to compromise them.

Where Passwords Are Stored

I'm on a Cisco switch, and what I'm going to do is a show run. If I do a show run, you can see that there are some passwords that are stored on here. Here's the username and here are the passwords. And as you can see, most of these passwords are in clear text — that is, I can read them and see what they say. So I could easily log in as Derek or Liam with these passwords. This is problematic. What we want to do is, in this case right here, we're using secret to hash this value. So this is a hashed value, and that's what we want to do. Because these are hashed values, us as hackers, if we're trying to hack into a system, this is what we're going to see, and we don't know what the password is. But we can look this up in a rainbow table to figure out what the password is.

I can do the same thing on a Linux box. This is a Kali Linux box. What I'm going to do is take a look at the shadow file — what this is is where the passwords are being stored — and for this user, demo user, this is the user that I'm logged in at. We can see that this is a hashed value. So here again it's being stored as a hashed value.

What a Rainbow Table Is

Now it's time to put on our adversary hat. Now it's time to hack into a system. Let's say we steal this database, and this database has usernames on it and passwords, but all the passwords are hashed. So we see a lot of these hashed values here, and we want to figure out what is the password for each one of these users. One way to do this is with a rainbow table. We're actually going to create a rainbow table and then use it.

Quite simply, a rainbow table is a table that has passwords in it and their associated hash values. What we can see here is that each one of these passwords is a little different. We've got a couple things that are changed here. We've got something that's changed here, something that's changed there, another thing that's changed. So each one of these are slightly different. What has happened is, in this case we're using Argon2, and we're pumping these passwords into this hashing algorithm and we're getting all the hashes for it. And now what we have is, for each one of these passwords, we know the hashed value out of it.

So how do we use these rainbow tables? They have the hash value and the password. Let's say we steal a database, and in this database there's a bunch of usernames and hashed values for the password. What we're looking for is what is the password for each one of these users. Now, first thing is we have to know how were these hashed, so we need to figure out what is the algorithm that was used to hash those. Let's say in this case it's Argon2. So now we need a rainbow table that has been created with Argon2. So now we find this rainbow table, and we cross reference these hashes — the actual hashes for the actual passwords — with the rainbow table and see if there's a match. And we've got a match. This one right here for G House matches up with this hash right here. So we could assume that G House's password is this password right there. So now we know what G House's password is.

Creating an MD5 Hash

First, let's just see how we can create an MD5 hash, because MD5 is going to be what we're going to use. MD5 is not recommended — it's considered a weak hashing algorithm at this point in time — but it'll be good enough for the purposes of seeing how this works and how this functions.

What we're going to do is echo, and -n. This just makes sure that at the end of this line it doesn't hit a return, because if it hit a return then we could mess up our hash. And then we're going to do ABC, and we're going to then pipe that into md5sum. So md5sum is the program that's going to create this hash, and it's going to be creating the hash of ABC — capital A, capital B, capital C, because the uppercase and lowercase does matter. So we're going to hit this, and there we see pretty quickly that it then has the hash value for this. So this is the hash value of ABC using the md5sum algorithm.

Building the Rainbow Table

Next, let's create a rainbow table. What I'm going to do is use a program. This program is just something I put together; had ChatGPT help me out with it. So let's get into this program. It's just a bash file, and what it's doing is generating — it's just going to generate three characters. So it's going to start out with just 0, 1, 2. In fact, this is the range that it's going to do: it starts out with nothing, and then 0 1 2 3 4 5 6 7 8 9, and then lowercase A through Z, and then uppercase A through Z. And then what it will actually do is it'll create 01, 02, 03, 04, 05 — so it'll do all of two characters, and then it'll do all of three characters. So it will then create an MD5 hash out of that. This is essentially that same command we were just playing around with, just looks a little different. And then it's going to echo this as the password with the hash for that password.

So this is the program. Let's go ahead and execute it, and you're going to see what this actually looks like. This is a bash file, so what we're going to do is bash rainbowgen.sh, and then we're going to hit enter. And as you can see, it's doing all iterations of this up to three characters. It'll take a little bit for this to run. As you can see, it's just stepping through all of these and creating all of the hash values for these.

Now, it is going to take a while to go through all of these. In fact, you can see my CPU is pegged and it's already been a minute or so, and you can see it's slowly counting up. So it's going to take a while. And the other thing too is this is actually not what we want. We don't want it just printed out on the screen. What we really want is to pipe this into a file. So if I do this command right here, it's going to pump it into a comma separated value file, or CSV. I've already done this and it took a while — it took probably 20 minutes, maybe 30 minutes to do that.

Let's go ahead and take a look at that file and see what that file looks like. I'm going to do a cat and then MD5 rainbow table.csv. This is the one that we created. This goes a lot faster because all it's doing is listing out the contents of the file; it's not calculating anything. So now it's finished. And if we wanted to see how many lines this is, we could do wc -l with that file and hit enter, and there's 25,000 lines. So there's 25,000 combinations of this.

Looking Up a Hash

Let's do that echo again where we're echoing the ABC so we can get that value. This is the hash value that we're looking for. So now what we just need to do is look at the hash value in this hashing table to find out what the password is. Of course we know the password right here, but let's say we didn't know that that was the password. Well, we're going to look this up in the table.

The program we're going to use to do that will be grep. That's the command that we'll use. And so we are looking this up. We're going to put a quote, and then we will paste this — so copy that selection and we'll paste it right here. And then where are we going to look this up? We're going to look it up in this file that we created right here. So I will copy this and we'll paste it here, and we'll hit enter. And there you have it. Now we know what the password is: A, B, C.

So that's how you use a rainbow table. Now we have all of these references that we can look up and figure out what the passwords are with any certain hash.

Long Passwords and Salting

Now there are two great ways to combat a rainbow table and pretty much make this rainbow table useless, and that is a long password and salting.

Let's see what happens with these long passwords. What I'm going to do is nano, and we're going to take a look at the rainbow gen, but I've got a second one here. So we're just going to take a glance at that. The coding in here looks a little bit different, but essentially it does the same thing. The only thing it does differently is we can specify the length. The other one that I created, I just created it so it's simple and that it will create just three characters long. This one we can create one character, two character, three character, four character, and it also will put out the elapsed time.

So let's see what this one does. I'm going to do a bash — so let's do bash rainbowgen2 — and at the end here it's looking for one more variable, and let's just say one. What it'll do is go through one iteration and just one character passwords, and it'll tell us how long it takes to run this. So it goes through there and essentially it happens right away. Less than a second. It says 0 seconds.

So let's do the same thing, but let's do two characters. So it's going to run through here. You notice that it figured it all out for one character. But now let's do two. And we can see that this is going to take a little bit longer. We go from 0 seconds to — this is going to finish up here — and we got 11 seconds. So it took 11 seconds to do that.

Now let's take this and let's do it for three and see how long it takes to do three. Essentially, it took almost or even 10 times longer to do two characters over one character. So now we're going to see how long it takes to do three characters, and that'll give us an idea of every time we add another character to our passwords, how less effective the rainbow table is. Essentially what's going to happen here is that we're going to have so many characters that it would take a lot of processing power to create a rainbow table for our specific case. And so that becomes problematic, when we're spending all of our time creating this rainbow table, and essentially makes the rainbow table no longer useful if you get past a certain point from a number of characters that you're using for your password.

While this is running, I did want to show you the salting aspect of this. Now, we're not going to get heavy into salting right here, but what we're going to do is take a look at that shadow file again. So I'm going to do cat /etc/shadow, and — oh, I do need to have sudo, and we'll do that. Between these little dollar signs right here, we see some extra characters. Well, what that is is that's a salt, and the salt in some way or form gets added into this, and so it's not actually part of the password. That salting is essentially going to drastically change what the hash is and make it so that way a rainbow table is not really useful against it.

And you can see the same thing on the Cisco device right here. We have some salting that's added to this hash. So here's the salt and then here's the hash. And that salt really makes these rainbow tables kind of useless.

So as we can see, it takes 323 seconds, which is over 5 minutes, to create a rainbow table that has three characters. So you can see where this is going: if it takes 0 seconds for one character, 10 seconds for two characters, and over five minutes for three characters, you can imagine four characters is going to be just astronomically larger, and then even more so for five characters. At some point in time, it just doesn't become feasible to make a rainbow table, because you exponentially increase so much every time you add another character, and that becomes problematic. So really one of the combats to this is make long passwords, and it makes it harder for it to figure out what your password is using a rainbow table.

The Attack Card

Here's the attack card on those rainbow tables. A rainbow table is a table of passwords and their hashes, so it's a hash-to-password lookup table. We can look up the hash that's associated and figure out what somebody's password is. It's a pre-populated table, so you figure it out ahead of time, so you could use it on some hashes. And the table is very specific to the algorithm that's being used, any settings, any techniques that are being used. So you have to have a table that's very specific and lined up exactly to however the passwords were hashed.