topic Re: All possible password combinations! in SAS Procedures

All possible password combinations!

AKSHAYMOGHE — Fri, 07 Nov 2014 08:38:46 GMT

Hi All,

i want to create all possible combinations of length 8 that are possible from all 26 alphabates , 0-10 numeric and .,_,@ .

The repetation is allowed.

Please help.

Re: All possible password combinations!

Kurt_Bremser — Fri, 07 Nov 2014 09:32:55 GMT

Do you have ~43 TB space, either on disk or in RAM?

Re: All possible password combinations!

user24feb — Fri, 07 Nov 2014 09:40:32 GMT

KurtBremser raises an important topic. 🙂 .. but if you increase loops to 7 (not sure if you should actually do this)

Data A (Drop=i) B (Drop=i) ;
   Do i=1 To 26;
    C=Byte(i+64);
Output;
End;
Do i=1 To 26;
    C=Byte(i+96);
Output;
End;
   Do i=1 To 26;
    C=Byte(i+96);
Output;
End;
C="_"; Output;
C="."; Output;
C="@"; Output;
Run;

%Macro L(Loops=);
%Do i=1 %To &Loops.;
Data B (Drop=i);
Retain dummy;
%If &i.=1 %Then %Do;
Set B ;
%End;
%Else %Do;
Set B (Drop=C Rename=(D=C));
%End;
By C NotSorted;
If First.C Then Do;
Do i=1 To 26;
    D=C!!Byte(i+64);
Output;
End;
Do i=1 To 26;
    D=C!!Byte(i+96);
Output;
End;
   Do i=1 To 26;
    D=C!!Byte(i+96);
Output;
End;
D=C!!"_"; Output;
D=C!!"."; Output;
D=C!!"@"; Output;
End;
%If &i.=&Loops. %Then %Do;
    Drop C;
%End;
Run;
%End;
%Mend;
%L(Loops=3)

Re: All possible password combinations!

Kurt_Bremser — Fri, 07 Nov 2014 10:24:11 GMT

I'd do it like this:

%let allowed_chars=abcdefghij;

%let length=%sysfunc(length(&allowed_chars));

data _null_;

do i1 = 1 to &length;

do i2 = 1 to &length;

do i3 = 1 to &length;

do i4 = 1 to &length;

do i5 = 1 to &length;

do i6 = 1 to &length;

do i7 = 1 to &length;

do i8 = 1 to &length;

string =

substr("&allowed_chars",i1,1) !!

substr("&allowed_chars",i2,1) !!

substr("&allowed_chars",i3,1) !!

substr("&allowed_chars",i4,1) !!

substr("&allowed_chars",i5,1) !!

substr("&allowed_chars",i6,1) !!

substr("&allowed_chars",i7,1) !!

substr("&allowed_chars",i8,1)

;

end;

string =

substr("&allowed_chars",i1,1) !!

substr("&allowed_chars",i2,1) !!

substr("&allowed_chars",i3,1) !!

substr("&allowed_chars",i4,1) !!

substr("&allowed_chars",i5,1) !!

substr("&allowed_chars",i6,1) !!

substr("&allowed_chars",i7,1) !!

' '

;

end;

string =

substr("&allowed_chars",i1,1) !!

substr("&allowed_chars",i2,1) !!

substr("&allowed_chars",i3,1) !!

substr("&allowed_chars",i4,1) !!

substr("&allowed_chars",i5,1) !!

substr("&allowed_chars",i6,1) !!

' '

;

end;

string =

substr("&allowed_chars",i1,1) !!

substr("&allowed_chars",i2,1) !!

substr("&allowed_chars",i3,1) !!

substr("&allowed_chars",i4,1) !!

substr("&allowed_chars",i5,1) !!

' '

;

end;

string =

substr("&allowed_chars",i1,1) !!

substr("&allowed_chars",i2,1) !!

substr("&allowed_chars",i3,1) !!

substr("&allowed_chars",i4,1) !!

' '

;

end;

string =

substr("&allowed_chars",i1,1) !!

substr("&allowed_chars",i2,1) !!

substr("&allowed_chars",i3,1) !!

' '

;

end;

string =

substr("&allowed_chars",i1,1) !!

substr("&allowed_chars",i2,1) !!

' '

;

end;

string =

substr("&allowed_chars",i1,1) !!

' '

;

end;

run;

This also takes care of shorter passwords.

This step took ~70 seconds on my server.

Extrapolating this to a number of 39 characters or 65 characters (capitals included), you get 76 billion or 4 trillion seconds. (US billion/trillion)

Now lets assume you have a machine that is 1000 times as fast as mine (a pSeries p520), that means 76 million or 4 billion seconds.

This machine would still take 885 days to simply compute the smaller version (39 chars) strings in SAS. No output!

You're better off solving your problem in C.

Re: All possible password combinations!

jakarman — Fri, 07 Nov 2014 12:26:40 GMT

If you want to hack the sas stored passwords just use SAS.
Your only challenge in this is finding the routine SAS is using. Yep SAS is having the option to reverse decrypt all stored passwords.

You can give those passwords (pwencode or metadata) to be used to external DBMS systems. Those systems do not recognize the SAS encryption it must be decrypted before handed over.

the omaconfig.xml file is having some hints SAS(R) 9.4 Intelligence Platform: System Administration Guide, Third Edition

SAS(R) 9.4 Intelligence Platform: Security Administration Guide, Second Edition (How to Re-Encrypt Stored Passwords)

In the SAS session, set a passphrase as follows.

proc metadata in="<ChangePassPhrase> <PassPhrase>My passphrase</PassPhrase> </ChangePassPhrase>"; run;

The preceding code decrypts currently stored passwords and then re-encrypts them using the passphrase that you supply.

Of course you could also find a location where the decrypted password is shown.

Re: All possible password combinations!

Vladislaff — Fri, 07 Nov 2014 12:43:33 GMT

Here's my attempt with recursion:

PROC FCMP outlib=work.functions.wrapper;

subroutine combine(instr $, index, outstr $, fil);

outstr1=outstr;

if index = 0 then

do;

rc=fput(fil, outstr1);

rc=fappend(fil);

end;

else do;

n=lengthn(instr);

do i = 1 to n;

outstr1=catt(outstr1,substrn(instr,i,1));

call combine(instr, index-1, outstr1, fil);

outstr1=substr(outstr1,1,length(outstr1)-1);

end;

endsub;

subroutine combine_run(instr $, index);

fil=fopen('f','O');

call combine(instr, index, '', fil);

rc = fclose(fil);

endsub;

RUN;

options cmplib=work.functions;

filename f temp;

data _null_;

call combine_run('abcdef',8);

run;

data want;

infile f;

input;

pass=_infile_;

run;

filename f clear;