I Challenge You To Crack The Code

-------------------------------------

I had quite an interesting experience recently. I was hired

by a company to perform a vulnerability assessment and

penetration test on their network. During the initial

meeting, one of the key technical staff presented me with a

challenge; He handed over the NTLM hash of the domain

Administrator account and challenged me to decipher it.

He explained that the complexity and length of the password

would prevent me from deciphering it during the time allotted

for the project. He was actually quite confident in my

impending failure. In most cases, this individual would have been right on the

mark. On the other hand, I'm not sure he expected to

challenge someone who has close associates with discretionary

time on some of the most powerful computers in the world. 6 Hours, 2 Servers, 64GB of Memory, and 32 Processors Later

and. . . . .

------------------------------------

It took just under six hours to decipher the password. Of

course, my 'associates' were using a program of my choice

on servers with 32 processors and 64GB of RAM a piece.

It's nice to have friends with access like this.

Especially in my line of work. Needless to say, my client

was shocked when I called him the next day and gave him

the password. Let's Have Some Fun: A Challenge For You

----------------------------------------------

(In order for you to do this, you need to go to:

http://www. defendingthenet. com/NewsLetters/

CrackTheCode-ThatsADirectChallenge. htm)Shortly after this experience, I started thinking about

writing an article about it. Then I thought to myself,

why write just an article? Why not come up with a challenge

for our readers?Hidden in this article is information that will ultimately

provide you with a phrase that has been encrypted. You will

need to know a few pieces of general information such as,

where to find the hash in this article,

how to extract the hash from the article, what the password

is that will reveal the hash, and what type of hash is being

used! Still with me on this? You will need to do all this

before you can start cracking the encrypted phrase. First, you need to find the hashed phrase located in this

article. I'll give you a hint; I recently wrote an article

about hiding messages in files. This article can be found

on the Defending The Net Newsletter Archive. It is also in

the www. CastleCops. com archive. Oh, and once you find where

the hash is you will need a password to extract it. This one

I am going to give away. The password to extract the hash

is 'letmein' (without the ' ' of course). Then, you will need a tool that can easily handle

deciphering of the hash once you extract it from this

article. There are quite a few out there that will do the

job, however, I highly recommend using pnva naq noyr i2. 69,

a publicly available security tool that no self respecting

security engineer should be without. You will also need to

know the type of hashing algorithm that was used. I decided

to use zrffntr qvtrfg svir because it is relatively

well-known. (Try saying that 13 times real fast!)Conclusion

----------------

The first person to successfully unravel this riddle and

e-mail me at riddle@paralogic. net with the deciphered phrase,

along with a detailed description of how they accomplished

the task, will receive a 512MB, USB2. 0 Jump Drive. As soon

as we receive this information we will post it on the main

page of www. defendingthenet. com. About The Author

----------------

Darren Miller is an Information Security Consultant with

over sixteen years experience. He has written many

technology & security articles, some of which have been

published in nationally circulated magazines & periodicals.

If you would like to contact Darren you can e-mail him at

Darren. Miller@ParaLogic. Net

Author:
Darren Miller