hashcat/tools/mozilla2hashcat.py

#
# Script to extract the "hash" from a password protected key3.db or key4.db file.
#
# This code is based on the tool "firepwd" (https://github.com/lclevy/firepwd (GPL-license)
# Although the code has been changed a bit, all credit goes to @lclevy for his initial work.
#
# Tested with Python 3.8.5 and the following libraries: PyCryptodome 3.10.1 and pyasn1 0.4.8
#
# Author: 
#   https://github.com/Banaanhangwagen
#   https://github.com/mneitsabes
# License: MIT
#

import argparse
from collections import namedtuple
import enum
import binascii
import hashlib
import hmac
import os
import sqlite3
import struct
import sys

from Crypto.Cipher import AES, DES3
from pyasn1.codec.der import decoder


class MasterPasswordInfos:
    def __init__(self, mode, global_salt, entry_salt, cipher_text, no_master_password, iteration=None, iv=None):
        if mode not in ['aes', '3des']:
            raise ValueError('Bad mode')

        self.mode = mode
        self.global_salt = global_salt
        self.entry_salt = entry_salt
        self.cipher_text = cipher_text
        self.no_master_password = no_master_password
        self.iteration = iteration
        self.iv = iv


def read_bsd_db(db_filepath: str) -> {}:
    """
    Read the key3.db.

    :param db_filepath: the database filepath
    :type db_filepath: str
    :return: the dict
    :rtype: dict
    """
    with open(db_filepath, 'rb') as f:
        header = f.read(4 * 15)

        magic = struct.unpack('>L', header[0:4])[0]
        if magic != 0x61561:
            raise ValueError('Bad magic number')

        version = struct.unpack('>L', header[4:8])[0]
        if version != 2:
            raise ValueError('Bad version')

        pagesize = struct.unpack('>L', header[12:16])[0]
        nkeys = struct.unpack('>L', header[56:60])[0]

        readkeys = 0
        page = 1
        db1 = []

        while readkeys < nkeys:
            f.seek(pagesize*page)

            offsets = f.read((nkeys+1) * 4 + 2)
            offset_vals = []
            i = 0
            nval = 0
            val = 1
            keys = 0

            while nval != val:
                keys += 1
                key = struct.unpack('<H', offsets[(2+i):(2+i)+2])[0]
                val = struct.unpack('<H', offsets[(4+i):(4+i)+2])[0]
                nval = struct.unpack('<H', offsets[(8+i):(8+i)+2])[0]

                offset_vals.append(key + (pagesize * page))
                offset_vals.append(val + (pagesize * page))
                readkeys += 1
                i += 4

            offset_vals.append(pagesize * (page + 1))
            val_key = sorted(offset_vals)

            for i in range(keys * 2):
                f.seek(val_key[i])
                data = f.read(val_key[i+1] - val_key[i])
                db1.append(data)

            page += 1

        db = {}
        for i in range(0, len(db1), 2):
            db[db1[i+1]] = db1[i]

    return db


def is_decrypting_mozilla_3des_without_master_password(global_salt, entry_salt, cipher_text):
    """
    Indicate if the cipher_text can be decrypted to 'password-check\x02\x02' without a master password
    in the the "mozilla 3DES"

    :param global_salt: the global salt
    :param entry_salt: the entry salt
    :param cipher_text: the encrypted text
    :return: the decrypted text
    """
    hp = hashlib.sha1(global_salt).digest()
    pes = entry_salt + b'\x00'*(20-len(entry_salt))
    chp = hashlib.sha1(hp + entry_salt).digest()
    k1 = hmac.new(chp, pes + entry_salt, hashlib.sha1).digest()
    tk = hmac.new(chp, pes, hashlib.sha1).digest()
    k2 = hmac.new(chp, tk + entry_salt, hashlib.sha1).digest()
    k = k1 + k2
    iv = k[-8:]
    key = k[:24]

    return DES3.new(key, DES3.MODE_CBC, iv).decrypt(cipher_text) == b'password-check\x02\x02'


def is_decrypting_pbe_aes_without_password(global_salt, entry_salt, iteration, iv, cipher_text):
    """
    Indicate if the cipher_text can be decrypted to password-check\x02\x02' without a master password
    in the the AES mode.

    :param global_salt: the global salt
    :param entry_salt: the entry salt
    :param iteration: the number of iteration
    :param iv: the iv
    :param cipher_text: the encrypted text
    :return: the decrypted text
    """
    k = hashlib.sha1(global_salt).digest()
    key = hashlib.pbkdf2_hmac('sha256', k, entry_salt, iteration, dklen=32)

    return AES.new(key, AES.MODE_CBC, iv).decrypt(cipher_text) == b'password-check\x02\x02'


def extract_master_password_infos(db_filepath: str, db_version: int) -> MasterPasswordInfos:
    """
    Extract the master password information from the database.

    :param db_filepath: the db filepath
    :type db_filepath: str
    :param db_version: the db_type, 3 or 4
    :type db_version: int
    :return: the infos
    :rtype: MasterPasswordInfos
    """
    if db_version not in [3, 4]:
        raise ValueError('db_version not supported')

    if db_version == 3:
        db_values = read_bsd_db(db_filepath)

        global_salt = db_values[b'global-salt']
        pwd_check = db_values[b'password-check']
        entry_salt_len = pwd_check[1]
        entry_salt = pwd_check[3: 3 + entry_salt_len]
        cipher_text = pwd_check[-16:]

        no_master_password = is_decrypting_mozilla_3des_without_master_password(global_salt, entry_salt, cipher_text)

        return MasterPasswordInfos('3des', global_salt, entry_salt, cipher_text, no_master_password)
    else:
        db = sqlite3.connect(db_filepath)
        c = db.cursor()
        c.execute('SELECT item1,item2 FROM metadata WHERE id = "password"')
        global_salt, encoded_item2 = c.fetchone()
        decoded_item2 = decoder.decode(encoded_item2)

        pbe_algo = str(decoded_item2[0][0][0])
        if pbe_algo == '1.2.840.113549.1.12.5.1.3':  # pbeWithSha1AndTripleDES-CBC
            entry_salt = decoded_item2[0][0][1][0].asOctets()
            cipher_text = decoded_item2[0][1].asOctets()

            no_master_password = is_decrypting_mozilla_3des_without_master_password(global_salt, entry_salt,
                                                                                    cipher_text)
            return MasterPasswordInfos('3des', global_salt, entry_salt, cipher_text, no_master_password)
        elif pbe_algo == '1.2.840.113549.1.5.13':  # pkcs5 pbes2
            assert str(decoded_item2[0][0][1][0][0]) == '1.2.840.113549.1.5.12'
            assert str(decoded_item2[0][0][1][0][1][3][0]) == '1.2.840.113549.2.9'
            assert str(decoded_item2[0][0][1][1][0]) == '2.16.840.1.101.3.4.1.42'
            assert int(decoded_item2[0][0][1][0][1][2]) == 32  # key length

            entry_salt = decoded_item2[0][0][1][0][1][0].asOctets()
            iteration = int(decoded_item2[0][0][1][0][1][1])
            iv = b'\x04\x0e' + decoded_item2[0][0][1][1][1].asOctets()
            cipher_text = decoded_item2[0][1].asOctets()

            no_master_password = is_decrypting_pbe_aes_without_password(global_salt, entry_salt, iteration, iv,
                                                                          cipher_text)
            return MasterPasswordInfos('aes', global_salt, entry_salt, cipher_text, no_master_password, iteration, iv)

def hex(b) -> str:
    """
    Returns the hexily version of the binary datas.

    :param b: binary datas
    :return: the string
    """
    return binascii.hexlify(b).decode('utf8')


def get_hashcat_string(mpinfos: MasterPasswordInfos) -> str:
    """
    Print the hashchat format string.

    :param mpinfos: the infos
    :type mpinfos: MasterPasswordInfos
    :return: the string
    :rtype: str
    """

    if mpinfos.no_master_password:
        return 'No Primary Password is set.'
    else:
        s = '$mozilla$*'

        if mpinfos.mode == '3des':
            s += f'3DES*{hex(mpinfos.global_salt)}*{hex(mpinfos.entry_salt)}*{hex(mpinfos.cipher_text)}'
        else:
            s += f'AES*{hex(mpinfos.global_salt)}*{hex(mpinfos.entry_salt)}*{mpinfos.iteration}*' \
                 f'{hex(mpinfos.iv)}*{hex(mpinfos.cipher_text)}'

        return s


if __name__ == '__main__':
    usage = 'python3 mozilla2hashcat.py <profile_directory or key3/4.db file>\n'
    parser = argparse.ArgumentParser(formatter_class=argparse.RawDescriptionHelpFormatter, usage=usage)
    parser.add_argument('dir_or_db', help='The directory containing the key3/4.db-file or the key3/4.db-file itself')
    args = parser.parse_args()

    db_filepath = None
    db_type = None

    if os.path.isdir(args.dir_or_db):
        db3_filepath = os.path.join(args.dir_or_db, 'key3.db')
        db4_filepath = os.path.join(args.dir_or_db, 'key4.db')

        if os.path.exists(db3_filepath):
            db_filepath = db3_filepath
            db_type = 3
        elif os.path.exists(db4_filepath):
            db_filepath = db4_filepath
            db_type = 4
    elif os.path.isfile(args.dir_or_db):
        filename = os.path.basename(args.dir_or_db)
        if filename == 'key3.db':
            db_filepath = args.dir_or_db
            db_type = 3
        elif filename == 'key4.db':
            db_filepath = args.dir_or_db
            db_type = 4

    if not db_filepath:
        sys.stderr.write('key3.db or key4.db file not found\n')
        exit(-1)

    infos = extract_master_password_infos(db_filepath, db_type)
    print(get_hashcat_string(infos))