PDA

View Full Version : How to gain entry to almost any house for sale


Zok
03-03-2009, 10:19 PM
Disclaimer: I do NOT endorse breaking and entering - it is against the law and you will face legal penalties if you're caught. This story is for informational purposes ONLY.

So I was walking home from one of the academic buildings on campus (actually, I was walking to my car) when I saw a lockbox on the ground. If you don't know what a lockbox is, it's where Al Gore wanted to put the US Economy. But for real, when you're selling your house you want to give the realty company access to it for when you're not around. To allow your realty company to do this without copying your keys, people often buy lockboxes (or the realty company will give them one) with a letter combination lock. Inside the box is your house key. The box goes around the doorknob.

http://www.nexternal.com/resc/images/R07998877LG1.gif

If you don't know what I'm talking about, stop reading now and do some googling.

Anyway, I found one of these guys on the ground and was thinking "well, I'll bet I could get into this - I'm a pretty smart guy." So I bring it home and show it to my roommate. My roommate works for Remax and she immediately tells me "Oh, real estate ages are DUMB - the combo is going to be an English word for sure. They can't remember things that aren't words"

With this knowledge, I get to coding. I wrote a perl script that asks you for all of the letters on each of the wheels of the lockbox. Then it finds every possible permutation of those letters and compares them to a list of three letter English words (ALL three letter words).

I narrowed down my possible combinations from 1000 to about 40. I opened the lockbox in less than 2 minutes after that.

The moral of the story? CHOOSE A RANDOM PASSWORD! Otherwise assholes like me can go walking around the neighbourhood with a laptop in hand and open houses.

Script:

use strict;

my @tlw = (
"aaa","aah","aam","aba","abb","abc","abe","abm","abo","abo","abs","abt","aby","ace","acm",
"acs","act","ada","add","ade","ade","adj","ado","adp","ads","adv","adz","aec","aer","afb",
"afl","aft","aga","agc","age","age","ago","agr","agy","aha","ahq","ahs","aid","aif","ail",
"aim","ain","air","ait","ake","ala","alb","ale","ali","all","all","alm","alp","alt","alu",
"ama","ami","amp","amt","amu","amy","ana","ana","ana","and","and","ane","ane","ani","ann",
"ant","ant","ant","ant","anu","any","aok","apb","apc","ape","apo","apo","app","apr","apt",
"ara","arc","ard","ard","are","arf","ari","ark","arl","arm","arp","ars","art","art","ary",
"ase","ase","ash","ask","asn","aso","asp","ass","ate","ate","atp","aud","auf","auk","aus",
"aut","aut","aux","ave","avg","awe","awk","awl","awn","axe","aye","aym","ayr","aza","azo",
"azo","baa","bab","bad","bag","bah","bai","bal","bam","ban","bap","bar","bas","bat","bax",
"bay","bbb","bbc","bbl","bcd","bds","bed","bee","beg","bel","ben","bes","bet","bey","bfa",
"bhp","bia","bib","bid","big","bim","bin","bin","bio","bio","bis","bit","biz","bks","blt",
"bme","bmr","bmw","boa","bob","bod","boe","bog","boh","bon","boo","bop","bor","bot","bow",
"box","boy","boz","bps","bra","bre","brg","bri","brn","bro","brs","bsi","btu","bub","bud",
"bug","bul","bum","bun","bur","bus","but","buy","bwr","bye","byu","cab","cad","caf","cal",
"cam","can","cap","car","cat","caw","cay","cbc","cbs","ccc","cdn","cdt","ceb","ceo","cep",
"ceq","cgs","cha","chi","chm","chu","cia","cid","cig","cio","cir","cis","cit","cle","clo",
"cns","cob","cod","cog","col","col","com","com","con","con","coo","cop","cor","cos","cot",
"cow","cox","coy","coz","cpa","cpi","cpl","cpr","cps","cpu","cra","crc","crl","crt","cru",
"cry","csa","csb","csc","cse","csp","cst","ctg","ctn","cts","ctv","cub","cud","cue","cul",
"cum","cun","cup","cur","cut","cva","cwm","cwt","dab","dad","dag","dah","dak","dal","dam",
"dan","dap","daw","day","dbl","dce","ddr","dds","ddt","deb","dec","dee","def","dei","del",
"den","der","des","dev","dew","dey","dia","dia","dib","did","die","dig","dim","din","dip",
"dir","dis","dis","dit","diu","div","dix","dli","dma","dmz","dna","doa","dob","doc","dod",
"doe","dog","doh","dol","dom","dom","don","doo","dor","dos","dos","dot","dou","dow","doz",
"dpn","dpp","dra","drs","dry","dst","dtl","dub","dud","due","dug","dun","duo","duo","dup",
"dux","dvm","dwt","dye","dys","dzo","eak","eam","ean","ear","eat","eau","ebb","ecg","eck",
"eco","ecu","ede","edh","edo","edt","eec","eeg","eel","een","eer","eer","eff","eft","egg",
"ego","ehf","eke","ekg","eld","elf","eli","elk","ell","elm","elt","ely","emb","eme","emf",
"ems","emu","enc","end","end","ene","ene","eng","ens","ent","eof","eon","eos","epa","eph",
"epi","era","ere","erg","erk","err","ers","ery","esb","esc","ese","ese","esp","esq","esr",
"ess","ess","est","eta","etc","etc","eth","eth","eug","eur","eva","eve","ewe","exa","exo",
"exp","ext","eye","faa","fab","fad","fag","fah","fan","fao","far","fat","fax","fay","fbi",
"fcc","fda","feb","fed","fee","fem","fen","fer","fet","feu","few","fey","fez","fha","fib",
"fic","fid","fid","fie","fig","fin","fir","fit","fix","fla","flo","flu","fly","fmc","fmn",
"fob","foe","fog","foo","fop","for","for","fou","fox","fpc","fps","fra","fro","fry","fsh",
"fsk","ftc","ftp","fug","ful","fum","fun","fur","fux","fwd","fyi","fyn","gab","gad","gag",
"gal","gam","gan","gao","gap","gar","gas","gat","gay","gba","gbg","gbj","gbm","gbz","gca",
"gcc","gda","gdr","gds","gee","gel","gem","gen","gen","geo","geo","get","gev","gey","gib",
"gid","gie","gig","gij","gin","gip","git","gle","gmc","gmh","gmt","gnp","gnu","goa","gob",
"god","gog","gon","gon","gon","goo","gop","got","gov","goy","gpi","gpo","gre","gro","gsa",
"gta","gul","gum","gun","gur","gut","guv","guy","gym","gyn","gyp","haa","hac","had","hae",
"hag","hah","hal","ham","han","hap","has","hat","haw","hay","hcl","hed","hee","heh","hel",
"hem","hem","hen","hep","her","hes","het","hew","hex","hey","hgt","hhd","hic","hid","hie",
"him","hin","hip","his","hit","hkj","hob","hoc","hod","hoe","hog","hoi","hol","hom","hon",
"hoo","hop","hor","hot","how","hoy","hrs","hsi","hts","hub","hue","hug","huh","hui","hum",
"hun","hup","hus","hut","hwy","hyp","ial","ian","ias","ibm","ibo","icc","ice","icj","ics",
"icy","ida","idb","ide","ide","ido","ids","iec","iee","ier","ifc","ife","ifs","ify","ihs",
"iii","ike","ila","ile","ilk","ill","ill","ils","imf","imo","imp","inc","ind","ine","ing",
"ink","inn","ins","int","ion","ion","iou","ipa","iqs","ira","ire","irk","irl","irq","irs",
"ise","ish","ism","ism","iso","iso","ist","itd","ite","ito","its","its","itt","ity","iud",
"ium","ius","ivb","ive","ive","ivs","ivy","iwo","ize","jab","jag","jai","jam","jan","jap",
"jar","jat","jaw","jay","jct","jed","jem","jet","jeu","jew","jib","jig","jim","job","joe",
"jog","jon","jos","jot","jow","joy","jug","jul","jun","jus","jut","kab","kae","kai","kas",
"kat","kay","kbp","kea","kef","keg","kel","ken","kep","kew","kex","key","kgb","kgs","khz",
"kid","kim","kin","kin","kip","kit","kkk","kkt","knp","koa","kob","kon","kop","kor","kos",
"kph","kra","krp","kru","kum","kun","kwa","kwh","kwt","kyd","kyu","lab","lac","lad","lag",
"lah","lam","lan","lao","lap","lar","lat","lav","law","lax","lay","lbs","lcd","lea","led",
"lee","leg","lei","lek","leo","let","let","leu","lev","lex","ley","lib","lid","lie","lim",
"lio","lip","lip","liq","lit","liz","lob","loc","lod","log","log","lom","lon","loo","lop",
"lor","los","lot","lou","low","lox","loy","loz","lpg","lpm","lpn","lsd","lsi","ltd","lud",
"lug","luk","lum","luo","lur","lux","lxx","lyc","lye","lyo","lys","mab","mac","mac","mad",
"mae","mag","mah","maj","mal","mal","mam","man","mao","map","mar","mas","mas","mat","maw",
"max","may","mba","mdt","mea","med","mee","meg","mel","mem","men","mer","mer","mes","met",
"meu","mev","mew","mex","mez","mfa","mfd","mfg","mfh","mgr","mhd","mhg","mho","mhz","mia",
"mid","mid","mig","mil","mim","min","mir","mis","mis","mit","mix","mkt","mld","mlf","mli",
"mlr","mme","moa","mob","mod","moe","mog","moi","mol","mom","mon","mon","moo","mop","mor",
"mot","mow","mpg","mph","mra","mrs","msc","msg","msi","mss","mst","mta","mtb","mts","muc",
"mud","mug","mum","mut","mux","mvp","myc","myo","mzi","nab","nad","nae","nag","nam","nan",
"nap","nat","nay","nbc","nco","ncr","nea","neb","nee","nek","neo","net","new","ney","nfs",
"ngc","ngk","nib","nig","nik","nil","nim","nip","nit","niv","nix","nmr","nne","nnw","nob",
"nod","nog","noh","nol","nom","non","non","nor","nor","nos","not","not","nov","now","nox",
"nra","nsa","nsf","nth","ntp","nub","nun","nut","nux","nyc","nye","nyx","nzs","oaf","oak",
"oar","oas","oat","oba","obi","oca","och","ock","ocr","oct","oct","odd","ode","ode","oem",
"oer","off","off","oft","ohg","ohm","oho","ohs","oid","oil","oka","oke","old","ole","ole",
"olg","olm","oma","ome","oms","one","one","ons","ont","oof","ooh","oom","oos","ope","oph",
"opp","ops","opt","ora","orb","orc","ore","oro","orr","ors","ort","ory","ose","osf","osi",
"oto","ott","oui","our","our","ous","out","out","ova","ovi","ovo","owe","owl","own","owt",
"oxa","oxo","oxy","oxy","oyo","ozs","pac","pad","pah","pak","pal","pam","pan","pan","pap",
"par","par","pas","pat","pau","pav","paw","pax","pay","paz","pbs","pbx","pcb","pcp","pcs",
"pct","pdp","pdq","pea","ped","ped","ped","pee","peg","pek","pel","pen","pep","per","per",
"pes","pet","pew","pfc","pga","phd","phi","pie","pig","pin","pip","pit","pix","pkg","pkt",
"plo","plu","ply","pob","pod","pod","poe","poi","pol","pom","pon","pon","pop","pos","pot",
"pow","pox","ppd","ppm","pre","pre","pri","pro","pro","prs","pry","psf","psi","pss","pst",
"pta","pto","pts","pty","pub","puc","pud","pug","pul","pun","pup","pur","pus","put","pva",
"pvc","pvt","pwt","pya","pye","pym","pyo","pyr","pyx","qat","qbp","qed","qkt","qnp","qrp",
"qsl","qso","qst","qsy","qts","qty","qua","que","qui","qum","quo","rad","rae","raf","rag",
"rah","raj","ram","ran","rap","rat","raw","ray","rca","rch","reb","rec","red","ref","reg",
"rei","rem","reo","rep","req","res","ret","rev","rex","rfd","rho","ria","rib","rid","rif",
"rig","rim","rio","rip","rmm","rms","rna","rns","rob","roc","rod","roe","roi","rok","rom",
"ron","roo","ros","rot","row","roy","rpc","rpg","rpm","rsj","rsr","rsx","rte","rtl","rtt",
"rtu","rub","rue","rug","rum","run","rut","rvs","rwa","rya","rye","saa","sac","sad","sag",
"sal","sam","san","sao","sap","sas","sat","sav","saw","sax","say","say","sca","sch","sci",
"sea","sec","sed","see","sen","sep","seq","ser","set","sew","sex","sex","sfz","sgp","sgt",
"sha","she","shf","shy","sib","sic","sid","sin","sip","sir","sis","sit","six","ski","skt",
"sky","sla","slr","sly","sme","sna","snp","sob","soc","sod","soh","sol","son","sop","sos",
"sot","sou","sow","sox","soy","spa","spy","sql","sri","sse","ssi","ssm","ssn","ssr","sst",
"ssw","sta","stk","stp","sty","sub","sub","sud","sue","sui","sum","sun","sup","sur","sur",
"sux","swa","swy","sym","syn","syr","tab","tad","tag","tai","taj","tam","tan","tao","tap",
"tar","tat","tau","tav","taw","tax","tay","tbi","tbs","tcp","tea","ted","tee","tef","teg",
"tel","tel","tem","ten","ten","ter","tex","the","the","thi","tho","thy","tic","tie","til",
"tim","tin","tip","tis","tis","tit","tiu","tiv","tko","tlc","tmh","tnt","tod","toe","tog",
"tom","ton","too","top","top","tor","tos","tot","tov","tow","toy","tpk","tpn","tri","try",
"tsh","tsp","ttl","tty","tub","tue","tug","tui","tum","tun","tup","tut","tux","tuy","tva",
"tvs","twi","two","twp","twx","tyg","tyr","uae","uam","uar","uaw","ubi","udi","udo","ufa",
"ufo","ugh","uhf","uhs","uke","ule","ulm","ult","ump","umu","umw","una","uni","uni","uno",
"upi","ups","urb","urd","ure","uri","urn","uro","usa","usc","use","usk","usm","usn","uso",
"uss","ute","utu","vac","vag","val","van","var","vas","vas","vat","vav","vax","vcr","vdu",
"vee","veg","vet","vex","vfw","vhf","via","vie","vii","vim","vin","vin","vip","vir","vis",
"viz","vlf","vms","vol","von","vow","vox","vri","vug","wac","wad","wae","wag","wah","wal",
"wan","war","was","wat","waw","wax","way","web","wed","wed","wee","wei","wem","wen","wet",
"wha","whi","who","whr","why","wig","win","wis","wit","wiz","wlm","wnw","woe","wog","wok",
"won","woo","wop","wot","wow","wpa","wpm","wre","wry","wsw","wus","wye","wyo","xii","xis",
"xiv","xix","xvi","xxi","xxv","xxx","yah","yak","yam","yan","yap","yaw","yay","yds","yea",
"yeg","yen","yep","yes","yet","yew","yid","yin","yip","yne","yob","yod","yom","yon","you",
"yow","yrs","ytd","yuh","yuk","yum","yup","zag","zan","zap","zed","zee","zen","zho","zig",
"zip","zit","ziz","zoa","zoa","zoe","zoo","zoo","zug");


print "Enter wheel 1: ";
my $wheel1 = <STDIN>;
chomp($wheel1);
my @wheel1 = split(//, $wheel1);

print "Enter wheel 2: ";
my $wheel2 = <STDIN>;
chomp($wheel2);
my @wheel2 = split(//, $wheel2);

print "Enter wheel 3: ";
my $wheel3 = <STDIN>;
chomp($wheel3);
my @wheel3 = split(//, $wheel3);

my $curr;
my $count;
foreach my $letter1 (@wheel1) {
foreach my $letter2 (@wheel2) {
foreach my $letter3 (@wheel3) {
$curr = lc($letter1.$letter2.$letter3);
if(grep $_ eq $curr, @tlw) {
$count++;
print $curr . "\n";
}
}
}
}
print "Total: $count\n";


Edit: For the record, the password was L-I-T. Every lockbox I've had on houses in the past had an english word as the password as well - H-O-T was the last one, I think

Agent 008
03-03-2009, 10:22 PM
How many letters are there in total on each wheel?

xilikeeggs0
03-03-2009, 10:24 PM
The ones around here have 4 numbers. "0000" and "1234" are, oddly enough, the most common. A lot of the time the doors aren't even locked, so you won't even need to worry about the lock box.

Houses that are for sale are great places to fuck if you're cheap and don't want to get a hotel.

Zok
03-03-2009, 10:24 PM
On this one there were 10 letters per wheel.

If you have N letters on X wheels it will take n^x iterations to find all the permutations. So if you have 5 wheels and 15 letters per wheel, you're in a lot better hands than if you had 3 wheels and 10 letters per wheel.

kelsokid18
03-03-2009, 10:26 PM
How does this pertain to NS&H? Wouldn't this be BI?

Zok
03-03-2009, 10:26 PM
Also, after opening the lockbox, there was a keyhole that you need to stick a special key into in order to change the combo. This key lock is typically not very strong and can be easily picked. Mine had only ONE pin - so it was just a matter of applying torsion and getting a needle to press the pin down to the right level.

Zok
03-03-2009, 10:28 PM
How does this pertain to NS&H? Wouldn't this be BI?

Real world hacking. Using technology to break physical barriers.

Just the same as scanning for garage door opener frequencies or breaking into cars by hacking those auto-unlock things (Scent I believe it's called?) All this really is is a clever brute forcer...

Agent 008
03-03-2009, 10:35 PM
Real world hacking. Using technology to break physical barriers.

Just the same as scanning for garage door opener frequencies or breaking into cars by hacking those auto-unlock things (Scent I believe it's called?) All this really is is a clever brute forcer...

And that's any hacker's wet dream - connecting your laptop to a lock, and hacking away in the real world.

The Cheshire Cat
03-03-2009, 11:43 PM
Haha, I remember downloading that script from you a few days ago I think. And I just looked at it this morning and couldn't figure out what the hell it was for. Thanks for clearing that up. :D

EDIT: If/Next time I'm out in Ohio, I need to stay longer. We can do some pretty fun shit.

Zok
03-03-2009, 11:50 PM
EDIT: If/Next time I'm out in Ohio, I need to stay longer. We can do some pretty fun shit.

I'm sure we can find a *cough* place for you to stay *cough* ;)

The Cheshire Cat
03-04-2009, 12:16 AM
I'm sure we can find a *cough* place for you to stay *cough* ;)

The floor of your hallway again? That sucked so bad. I had to use my shoes as a pillow. I guess that's what I get for being anti-social and wanting to sleep in the hallway.

hazmat
03-04-2009, 02:35 PM
Nice one! Im sure theres a lot of those mechanical locks still around.

But 'round here theyve since gone digital (supra ekey), and as of late, ive seen my uncle (he's in home sales) using a keychain sized thing that generates a different valid passcode each time the button is pressed. Id like to get my hands on their algorithm...

The supra ekey thing i wouldnt bother with, as they need a phone line connected dock to update to the supra server so you can keep using the key. But this new cheaper one would be simple to defeat. If anyones intrested id PM more info about the little device.

Jo Nathen
03-04-2009, 08:45 PM
Amazing post.
Never thought of using a perl code to make combinations.....I have access to excel at work.... thats about it for coding...

illuminatikiller
03-04-2009, 08:51 PM
That's pretty awesome.

kelsokid18
03-04-2009, 10:55 PM
Nice one! Im sure theres a lot of those mechanical locks still around.

But 'round here theyve since gone digital (supra ekey), and as of late, ive seen my uncle (he's in home sales) using a keychain sized thing that generates a different valid passcode each time the button is pressed. Id like to get my hands on their algorithm...

The supra ekey thing i wouldnt bother with, as they need a phone line connected dock to update to the supra server so you can keep using the key. But this new cheaper one would be simple to defeat. If anyones intrested id PM more info about the little device.


http://en.wikipedia.org/wiki/SecurID (http://en.wikipedia.org/wiki/SecurID)

Something similar to that? We used these at work to authenticate onto the VPN.

hazmat
03-05-2009, 03:44 AM
http://en.wikipedia.org/wiki/SecurID (http://en.wikipedia.org/wiki/SecurID)

Something similar to that? We used these at work to authenticate onto the VPN.

Basically, yeah thats the idea. I dont know if its using RSA or what though.

The New Guru
03-05-2009, 09:42 AM
If you're interested in this type of thing, there were some guys that gave a presentation on how they cracked KeeLoq (http://en.wikipedia.org/wiki/KeeLoq) at the 25C3; it's definitely worth watching.
They mainly focused on garage doors, but apparently many car manufacturers use it too. Just google around for the video.

...I'm currently waiting patiently for someone to compile a list of manufacturer keys. ;)

Psionicist
03-05-2009, 03:53 PM
Zok, i had no idea you were into physical security. Huge respect points there.

Prometheum
03-05-2009, 09:48 PM
God, that indentation is dirty.

Dagon
03-06-2009, 05:57 PM
What a great post!
I just found one today. I didn't mess with it though. I'm waiting a few days until the snow melts so my footprints don't give me away. I saw a dvd player and books and some other shit in there I'll grab. The place looks really cool, it's a log cabin.

Now I just have to figure a way to get a hooker back there without her thinking I'm a serial killer.