# RainbowCrack demonstration

by Zhu Shuanglei <shuanglei@hotmail.com>
http://www.antsight.com/zsl/rainbowcrack/

Here are the demonstrations of RainbowCrack 1.0. Later versions of RainbowCrack behavior similarly.
All the demonstrations below are carried out on a standard workstation (666MHz CPU, 256MB RAM).

## 1. Crack 10 alpha passwords in 74 seconds

E:\rainbowcrack-1.0-win>type random_alpha.txt USER0::165a1fabd5c06a68aad3b435b51404ee:::: USER1::cf1a193bf3053bc4aad3b435b51404ee:::: USER2::cf8465783349c275aad3b435b51404ee:::: USER3::fa2991e294ec4b1caad3b435b51404ee:::: USER4::afef1f7192613fcdaad3b435b51404ee:::: USER5::25baeee8807f408baad3b435b51404ee:::: USER6::4c15cb6912eb674eaad3b435b51404ee:::: USER7::d8caeb00464414fcaad3b435b51404ee:::: USER8::78339cce019af94caad3b435b51404ee:::: USER9::60a59cfe793a8b99aad3b435b51404ee:::: E:\rainbowcrack-1.0-win>dir g:\table1\ 驱动器 G 中的卷是 - 卷的序列号是 D4B9-9424 g:\table1 的目录 2003-09-07 19:21 <DIR> . 2003-09-07 19:21 <DIR> .. 2003-09-01 09:59 128,000,000 lm_alpha_0_2100x8000000_bla.rt 2003-09-01 09:59 128,000,000 lm_alpha_1_2100x8000000_bla.rt 2003-09-01 10:00 128,000,000 lm_alpha_2_2100x8000000_bla.rt 2003-09-01 10:00 128,000,000 lm_alpha_3_2100x8000000_bla.rt 2003-09-01 10:01 128,000,000 lm_alpha_4_2100x8000000_bla.rt 5 个文件 640,000,000 字节 2 个目录 146,325,504 可用字节 E:\rainbowcrack-1.0-win>rcrack g:\table1\*.rt -f random_alpha.txt reading lm_alpha_0_2100x8000000_bla.rt ... 128000000 bytes read, disk access time: 4.19 s verifying the file ... searching for 10 hashes ... plaintext of cf1a193bf3053bc4 is FHBKEBL plaintext of 4c15cb6912eb674e is PXPMJLD plaintext of cf8465783349c275 is GSXGSSX plaintext of d8caeb00464414fc is WSELHXL plaintext of 25baeee8807f408b is KLKOTYT plaintext of 165a1fabd5c06a68 is ZPTWYZZ plaintext of 78339cce019af94c is BLSYQPP cryptanalysis time: 53.61 s reading lm_alpha_1_2100x8000000_bla.rt ... 128000000 bytes read, disk access time: 3.75 s verifying the file ... searching for 3 hashes ... plaintext of afef1f7192613fcd is LHNNYLE plaintext of 60a59cfe793a8b99 is FOXHUXW cryptanalysis time: 18.79 s reading lm_alpha_2_2100x8000000_bla.rt ... 128000000 bytes read, disk access time: 3.75 s verifying the file ... searching for 1 hash ... plaintext of fa2991e294ec4b1c is VOFTOUQ cryptanalysis time: 1.39 s statistics ------------------------------------------ plaintext found: 10 of 10 (100.00%) total disk access time: 11.68 s total cryptanalysis time: 73.79 s total chain walk step: 13681478 total false alarm: 13260 total false alarm step: 12317191 username password ------------------------------------------ USER0 ZPTWYZZ USER1 FHBKEBL USER2 GSXGSSX USER3 VOFTOUQ USER4 LHNNYLE USER5 KLKOTYT USER6 PXPMJLD USER7 WSELHXL USER8 BLSYQPP USER9 FOXHUXW

Some comment:
In this experiment, we generate hashes of 10 randomly generated alpha only passwords and store them in random_alpha.txt. Files in g:\table1\ are so called "rainbow table" generated by rtgen.exe in the distribution. We issue the command "rcrack g:\table1\*.rt -f random_alpha.txt" to start the crack and find all of the 10 passwords within 74 seconds. However, additional 12 seconds are needed to load the precomputed rainbow tables from disk.

## 2. Crack 10 alpha-numeric passwords in 184 seconds

E:\rainbowcrack-1.0-win>type random_alpha-numeric.txt USER0::afdbc395b8d95e85aad3b435b51404ee:::: USER1::b0732c8605dc5912aad3b435b51404ee:::: USER2::939489337beb3360aad3b435b51404ee:::: USER3::d65c66d0ed29a503aad3b435b51404ee:::: USER4::083cb03678ade0d3aad3b435b51404ee:::: USER5::3ec2bf510dfc79a3aad3b435b51404ee:::: USER6::6e2aa2905020b118aad3b435b51404ee:::: USER7::bfd0ccaf4f20504aaad3b435b51404ee:::: USER8::ce8ca9efe3a5de26aad3b435b51404ee:::: USER9::0c51962a0be928aaaad3b435b51404ee:::: E:\rainbowcrack-1.0-win>dir f:\table2\ 驱动器 F 中的卷是 IMPORTANT 卷的序列号是 BC3B-00E6 f:\table2 的目录 2003-09-07 08:16 <DIR> . 2003-09-07 08:16 <DIR> .. 2003-09-05 09:24 640,000,000 lm_alpha-numeric_0_2400x40000000_all.rt 2003-09-05 16:38 640,000,000 lm_alpha-numeric_1_2400x40000000_all.rt 2003-09-05 09:29 640,000,000 lm_alpha-numeric_2_2400x40000000_all.rt 2003-09-05 09:34 640,000,000 lm_alpha-numeric_3_2400x40000000_all.rt 2003-09-07 08:14 640,000,000 lm_alpha-numeric_4_2400x40000000_all.rt 5 个文件 3,200,000,000 字节 2 个目录 356,710,912 可用字节 E:\rainbowcrack-1.0-win>rcrack f:\table2\*.rt -f random_alpha-numeric.txt reading lm_alpha-numeric_0_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 3.60 s verifying the file ... searching for 10 hashes ... plaintext of 083cb03678ade0d3 is 56VST9C plaintext of b0732c8605dc5912 is 7BKKNIX cryptanalysis time: 80.31 s reading lm_alpha-numeric_0_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 5.70 s searching for 8 hashes ... plaintext of afdbc395b8d95e85 is E0EEH16 cryptanalysis time: 5.28 s reading lm_alpha-numeric_0_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 5.81 s searching for 7 hashes ... plaintext of 939489337beb3360 is 45E9RDA plaintext of d65c66d0ed29a503 is ESJ7M3 cryptanalysis time: 4.78 s reading lm_alpha-numeric_0_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 3.53 s searching for 5 hashes ... plaintext of bfd0ccaf4f20504a is H8OJKKJ cryptanalysis time: 2.69 s reading lm_alpha-numeric_0_2400x40000000_all.rt ... 115367936 bytes read, disk access time: 3.39 s searching for 4 hashes ... cryptanalysis time: 2.46 s reading lm_alpha-numeric_1_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 3.65 s verifying the file ... searching for 4 hashes ... cryptanalysis time: 36.16 s reading lm_alpha-numeric_1_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 6.52 s searching for 4 hashes ... plaintext of 6e2aa2905020b118 is DRUZ58W cryptanalysis time: 2.31 s reading lm_alpha-numeric_1_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 6.14 s searching for 3 hashes ... cryptanalysis time: 2.20 s reading lm_alpha-numeric_1_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 3.55 s searching for 3 hashes ... plaintext of ce8ca9efe3a5de26 is 5SBCKBS cryptanalysis time: 1.37 s reading lm_alpha-numeric_1_2400x40000000_all.rt ... 115367936 bytes read, disk access time: 3.20 s searching for 2 hashes ... cryptanalysis time: 1.33 s reading lm_alpha-numeric_2_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 3.51 s verifying the file ... searching for 2 hashes ... cryptanalysis time: 18.10 s reading lm_alpha-numeric_2_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 5.98 s searching for 2 hashes ... cryptanalysis time: 1.46 s reading lm_alpha-numeric_2_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 5.83 s searching for 2 hashes ... cryptanalysis time: 1.47 s reading lm_alpha-numeric_2_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 3.52 s searching for 2 hashes ... plaintext of 0c51962a0be928aa is 0IVLZLR cryptanalysis time: 0.77 s reading lm_alpha-numeric_2_2400x40000000_all.rt ... 115367936 bytes read, disk access time: 3.09 s searching for 1 hash ... cryptanalysis time: 0.52 s reading lm_alpha-numeric_3_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 3.50 s verifying the file ... searching for 1 hash ... cryptanalysis time: 9.06 s reading lm_alpha-numeric_3_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 5.65 s searching for 1 hash ... cryptanalysis time: 0.68 s reading lm_alpha-numeric_3_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 5.27 s searching for 1 hash ... cryptanalysis time: 0.68 s reading lm_alpha-numeric_3_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 3.52 s searching for 1 hash ... cryptanalysis time: 0.73 s reading lm_alpha-numeric_3_2400x40000000_all.rt ... 115367936 bytes read, disk access time: 3.10 s searching for 1 hash ... cryptanalysis time: 0.74 s reading lm_alpha-numeric_4_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 3.52 s verifying the file ... searching for 1 hash ... cryptanalysis time: 9.06 s reading lm_alpha-numeric_4_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 5.71 s searching for 1 hash ... cryptanalysis time: 0.70 s reading lm_alpha-numeric_4_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 6.27 s searching for 1 hash ... cryptanalysis time: 0.72 s reading lm_alpha-numeric_4_2400x40000000_all.rt ... 131158016 bytes read, disk access time: 3.54 s searching for 1 hash ... plaintext of 3ec2bf510dfc79a3 is 2IOWPCS cryptanalysis time: 0.51 s statistics ------------------------------------------ plaintext found: 10 of 10 (100.00%) total disk access time: 107.02 s total cryptanalysis time: 184.12 s total chain walk step: 48407057 total false alarm: 17824 total false alarm step: 14477473 username password ------------------------------------------ USER0 E0EEH16 USER1 7BKKNIX USER2 45E9RDA USER3 ESJ7M3 USER4 56VST9C USER5 2IOWPCS USER6 DRUZ58W USER7 H8OJKKJ USER8 5SBCKBS USER9 0IVLZLR

Some comment:
This time the target are hashes of alpha-numeric passwords. We need longer cryptanalysis time to reveal the passwords.