Merge pull request #291 from hops/master

Added new hash mode -m 125 = ArubaOS

docs/changes.txt

@@ -32,6 +32,10 @@ File.: Kernel
 Desc.: Added new hash mode -m 13400 = Keepass 1 (AES/Twofish) and Keepass 2 (AES)
 Issue: 92
 
+Type.: Feature
+File.: Kernel
+Desc.: Added new hash mode -m 125 = ArubaOS
+
 Type.: Feature
 File.: Kernel
 Desc.: Extended support from 14 to 255 functions calls per rule on GPU

include/shared.h

@@ -360,6 +360,7 @@ extern hc_thread_mutex_t mux_display;
 #define HT_00121  "SMF > v1.1"
 #define HT_00122  "OSX v10.4, v10.5, v10.6"
 #define HT_00124  "Django (SHA-1)"
+#define HT_00125  "ArubaOS"
 #define HT_00131  "MSSQL(2000)"
 #define HT_00132  "MSSQL(2005)"
 #define HT_00133  "PeopleSoft"
@@ -722,6 +723,8 @@ extern hc_thread_mutex_t mux_display;
 #define DISPLAY_LEN_MAX_122    8 + 40
 #define DISPLAY_LEN_MIN_124   4 + 1 +  0 + 1 + 40
 #define DISPLAY_LEN_MAX_124   4 + 1 + 32 + 1 + 40
+#define DISPLAY_LEN_MIN_125   10 + 40
+#define DISPLAY_LEN_MAX_125   10 + 40
 #define DISPLAY_LEN_MIN_131    6 +  8 + 80
 #define DISPLAY_LEN_MAX_131    6 +  8 + 80
 #define DISPLAY_LEN_MIN_132    6 +  8 + 40
@@ -1473,6 +1476,7 @@ int oracleh_parse_hash            (char *input_buf, uint input_len, hash_t *hash
 int oracles_parse_hash            (char *input_buf, uint input_len, hash_t *hash_buf);
 int oraclet_parse_hash            (char *input_buf, uint input_len, hash_t *hash_buf);
 int osc_parse_hash                (char *input_buf, uint input_len, hash_t *hash_buf);
+int arubaos_parse_hash            (char *input_buf, uint input_len, hash_t *hash_buf);
 int osx1_parse_hash               (char *input_buf, uint input_len, hash_t *hash_buf);
 int osx512_parse_hash             (char *input_buf, uint input_len, hash_t *hash_buf);
 int phpass_parse_hash             (char *input_buf, uint input_len, hash_t *hash_buf);

src/oclHashcat.c

@@ -148,7 +148,7 @@ double TARGET_MS_PROFILE[3]     = { 8, 16, 96 };
 
 #define MAX_DICTSTAT            10000
 
-#define NUM_DEFAULT_BENCHMARK_ALGORITHMS 134
+#define NUM_DEFAULT_BENCHMARK_ALGORITHMS 135
 
 #define global_free(attr)       \
 {                               \
@@ -299,7 +299,8 @@ static uint default_benchmark_algorithms[NUM_DEFAULT_BENCHMARK_ALGORITHMS] =
   8200,
   11300,
   12700,
-  13400
+  13400,
+  125
 };
 
 /**
@@ -683,6 +684,7 @@ const char *USAGE_BIG[] =
   "   8500 = RACF",
   "   7200 = GRUB 2",
   "   9900 = Radmin2",
+  "    125 = ArubaOS",
   "",
   "[[ Enterprise Application Software (EAS) ]]",
   "",
@@ -7346,6 +7348,30 @@ int main (int argc, char **argv)
                    dgst_pos3   = 1;
                    break;
 
+      case   125:  hash_type   = HASH_TYPE_SHA1;
+                   salt_type   = SALT_TYPE_EMBEDDED;
+                   attack_exec = ATTACK_EXEC_INSIDE_KERNEL;
+                   opts_type   = OPTS_TYPE_PT_GENERATE_BE
+                               | OPTS_TYPE_PT_ADD80
+                               | OPTS_TYPE_PT_ADDBITS15
+                               | OPTS_TYPE_ST_HEX;
+                   kern_type   = KERN_TYPE_SHA1_SLTPW;
+                   dgst_size   = DGST_SIZE_4_5;
+                   parse_func  = arubaos_parse_hash;
+                   sort_by_digest = sort_by_digest_4_5;
+                   opti_type   = OPTI_TYPE_ZERO_BYTE
+                               | OPTI_TYPE_PRECOMPUTE_INIT
+                               | OPTI_TYPE_PRECOMPUTE_MERKLE
+                               | OPTI_TYPE_EARLY_SKIP
+                               | OPTI_TYPE_NOT_ITERATED
+                               | OPTI_TYPE_PREPENDED_SALT
+                               | OPTI_TYPE_RAW_HASH;
+                   dgst_pos0   = 3;
+                   dgst_pos1   = 4;
+                   dgst_pos2   = 2;
+                   dgst_pos3   = 1;
+                   break;
+
       case   130:  hash_type   = HASH_TYPE_SHA1;
                    salt_type   = SALT_TYPE_INTERN;
                    attack_exec = ATTACK_EXEC_INSIDE_KERNEL;
@@ -10689,6 +10715,8 @@ int main (int argc, char **argv)
 
     switch (hash_mode)
     {
+      case   125: if (pw_max > 32) pw_max = 32;
+                  break;
       case   400: if (pw_max > 40) pw_max = 40;
                   break;
       case   500: if (pw_max > 16) pw_max = 16;

src/shared.c

@@ -5691,6 +5691,7 @@ char *strhashtype (const uint hash_mode)
     case   121: return ((char *) HT_00121); break;
     case   122: return ((char *) HT_00122); break;
     case   124: return ((char *) HT_00124); break;
+    case   125: return ((char *) HT_00125); break;
     case   130: return ((char *) HT_00130); break;
     case   131: return ((char *) HT_00131); break;
     case   132: return ((char *) HT_00132); break;
@@ -6231,7 +6232,7 @@ void ascii_digest (char *out_buf, uint salt_pos, uint digest_pos)
 
     snprintf (out_buf, len-1, "{SSHA}%s", ptr_plain);
   }
-  else if (hash_mode == 122)
+  else if ((hash_mode == 122) || (hash_mode == 125))
   {
     snprintf (out_buf, len-1, "%s%08x%08x%08x%08x%08x",
       (char *) salt.salt_buf,
@@ -9803,6 +9804,43 @@ int lm_parse_hash (char *input_buf, uint input_len, hash_t *hash_buf)
   return (PARSER_OK);
 }
 
+int arubaos_parse_hash (char *input_buf, uint input_len, hash_t *hash_buf)
+{
+  if ((input_len < DISPLAY_LEN_MIN_125) || (input_len > DISPLAY_LEN_MAX_125)) return (PARSER_GLOBAL_LENGTH);
+
+  if ((input_buf[8] != '0') || (input_buf[9] != '1')) return (PARSER_SIGNATURE_UNMATCHED);
+
+  u32 *digest = (u32 *) hash_buf->digest;
+
+  salt_t *salt = hash_buf->salt;
+
+  char *hash_pos = input_buf + 10;
+
+  digest[0] = hex_to_u32 ((const u8 *) &hash_pos[ 0]);
+  digest[1] = hex_to_u32 ((const u8 *) &hash_pos[ 8]);
+  digest[2] = hex_to_u32 ((const u8 *) &hash_pos[16]);
+  digest[3] = hex_to_u32 ((const u8 *) &hash_pos[24]);
+  digest[4] = hex_to_u32 ((const u8 *) &hash_pos[32]);
+
+  digest[0] -= SHA1M_A;
+  digest[1] -= SHA1M_B;
+  digest[2] -= SHA1M_C;
+  digest[3] -= SHA1M_D;
+  digest[4] -= SHA1M_E;
+
+  uint salt_len = 10;
+
+  char *salt_buf_ptr = (char *) salt->salt_buf;
+
+  salt_len = parse_and_store_salt (salt_buf_ptr, input_buf, salt_len);
+
+  if (salt_len == UINT_MAX) return (PARSER_SALT_LENGTH);
+
+  salt->salt_len = salt_len;
+
+  return (PARSER_OK);
+}
+
 int osx1_parse_hash (char *input_buf, uint input_len, hash_t *hash_buf)
 {
   if ((input_len < DISPLAY_LEN_MIN_122) || (input_len > DISPLAY_LEN_MAX_122)) return (PARSER_GLOBAL_LENGTH);

tools/test.pl

@@ -45,7 +45,7 @@ my $hashcat = "./oclHashcat";
 
 my $MAX_LEN = 55;
 
-my @modes = (0, 10, 11, 12, 20, 21, 22, 23, 30, 40, 50, 60, 100, 101, 110, 111, 112, 120, 121, 122, 130, 131, 132, 140, 141, 150, 160, 190, 200, 300, 400, 500, 900, 1000, 1100, 1400, 1410, 1420, 1430, 1440, 1441, 1450, 1460, 1500, 1600, 1700, 1710, 1711, 1720, 1730, 1740, 1722, 1731, 1750, 1760, 1800, 2100, 2400, 2410, 2500, 2600, 2611, 2612, 2711, 2811, 3000, 3100, 3200, 3710, 3711, 3300, 3500, 3610, 3720, 3800, 3910, 4010, 4110, 4210, 4300, 4400, 4500, 4600, 4700, 4800, 4900, 5000, 5100, 5300, 5400, 5500, 5600, 5700, 5800, 6000, 6100, 6300, 6400, 6500, 6600, 6700, 6800, 6900, 7100, 7200, 7300, 7400, 7500, 7600, 7700, 7800, 7900, 8000, 8100, 8200, 8300, 8400, 8500, 8600, 8700, 8900, 9100, 9200, 9300, 9400, 9500, 9600, 9700, 9800, 9900, 10000, 10100, 10200, 10300, 10400, 10500, 10600, 10700, 10800, 10900, 11000, 11100, 11200, 11300, 11400, 11500, 11600, 11900, 12000, 12100, 12200, 12300, 12400, 12600, 12700, 12800, 12900, 13000, 13100, 13200, 13300, 13400);
+my @modes = (0, 10, 11, 12, 20, 21, 22, 23, 30, 40, 50, 60, 100, 101, 110, 111, 112, 120, 121, 122, 125, 130, 131, 132, 140, 141, 150, 160, 190, 200, 300, 400, 500, 900, 1000, 1100, 1400, 1410, 1420, 1430, 1440, 1441, 1450, 1460, 1500, 1600, 1700, 1710, 1711, 1720, 1730, 1740, 1722, 1731, 1750, 1760, 1800, 2100, 2400, 2410, 2500, 2600, 2611, 2612, 2711, 2811, 3000, 3100, 3200, 3710, 3711, 3300, 3500, 3610, 3720, 3800, 3910, 4010, 4110, 4210, 4300, 4400, 4500, 4600, 4700, 4800, 4900, 5000, 5100, 5300, 5400, 5500, 5600, 5700, 5800, 6000, 6100, 6300, 6400, 6500, 6600, 6700, 6800, 6900, 7100, 7200, 7300, 7400, 7500, 7600, 7700, 7800, 7900, 8000, 8100, 8200, 8300, 8400, 8500, 8600, 8700, 8900, 9100, 9200, 9300, 9400, 9500, 9600, 9700, 9800, 9900, 10000, 10100, 10200, 10300, 10400, 10500, 10600, 10700, 10800, 10900, 11000, 11100, 11200, 11300, 11400, 11500, 11600, 11900, 12000, 12100, 12200, 12300, 12400, 12600, 12700, 12800, 12900, 13000, 13100, 13200, 13300, 13400);
 
 my %is_unicode      = map { $_ => 1 } qw(30 40 130 131 132 133 140 141 1000 1100 1430 1440 1441 1730 1740 1731 5500 5600 8000 9400 9500 9600 9700 9800);
 my %less_fifteen    = map { $_ => 1 } qw(500 1600 1800 2400 2410 3200 6300 7400 10500 10700);
@@ -419,7 +419,8 @@ sub verify
       $salt = substr ($decoded, 64);
     }
     # OSX (first 8 hex chars is salt)
-    elsif ($mode == 122 || $mode == 1722)
+    # ArubaOS (the signature gets added in gen_hash)
+    elsif ($mode == 122 || $mode == 1722 || $mode == 125)
     {
       my $index = index ($line, ":");
 
@@ -2791,6 +2792,10 @@ sub passthrough
 
       $tmp_hash = gen_hash ($mode, $word_buf, substr ($salt_buf, 0, $salt_len));
     }
+    elsif ($mode == 125)
+    {
+      $tmp_hash = gen_hash ($mode, $word_buf, substr ($salt_buf, 0, 10));
+    }
     elsif ($mode == 141 || $mode == 1441)
     {
       my $salt_len = get_random_num (1, 15);
@@ -3194,7 +3199,7 @@ sub single
         }
       }
     }
-    elsif ($mode == 111 || $mode == 122 || $mode == 131 || $mode == 132 || $mode == 400 || $mode == 500 || $mode == 1600 || $mode == 1722 || $mode == 1731 || $mode == 6300 || $mode == 7900 || $mode == 8100 || $mode == 11100)
+    elsif ($mode == 111 || $mode == 122 || $mode == 125 || $mode == 131 || $mode == 132 || $mode == 400 || $mode == 500 || $mode == 1600 || $mode == 1722 || $mode == 1731 || $mode == 6300 || $mode == 7900 || $mode == 8100 || $mode == 11100)
     {
       for (my $i = 1; $i < 32; $i++)
       {
@@ -4092,6 +4097,16 @@ sub gen_hash
 
     $tmp_hash = sprintf ("%s%s", $salt_buf, $hash_buf);
   }
+  elsif ($mode == 125)
+  {
+    my $signature = "01";
+
+    my $salt_buf_bin = pack ("H*", $salt_buf . $signature);
+
+    $hash_buf = sha1_hex ($salt_buf_bin . $word_buf);
+
+    $tmp_hash = sprintf ("%s%s%s", $salt_buf, $signature, $hash_buf);
+  }
   elsif ($mode == 130)
   {
     $hash_buf = sha1_hex (encode ("UTF-16LE", $word_buf) . $salt_buf);

tools/test.sh

@@ -10,7 +10,7 @@
 
 # missing hash types: 5200,6211,6221,6231,6241,6251,6261,6271,6281
 
-HASH_TYPES="0 10 11 12 20 21 22 23 30 40 50 60 100 101 110 111 112 120 121 122 130 131 132 133 140 141 150 160 190 200 300 400 500 900 1000 1100 1400 1410 1420 1430 1440 1441 1450 1460 1500 1600 1700 1710 1711 1720 1722 1730 1731 1740 1750 1760 1800 2100 2400 2410 2500 2600 2611 2612 2711 2811 3000 3100 3200 3710 3711 3800 4300 4400 4500 4700 4800 4900 5000 5100 5300 5400 5500 5600 5700 5800 6000 6100 6300 6400 6500 6600 6700 6800 6900 7100 7200 7300 7400 7500 7600 7700 7800 7900 8000 8100 8200 8300 8400 8500 8600 8700 8900 9100 9200 9300 9400 9500 9600 9700 9800 9900 10000 10100 10200 10300 10400 10500 10600 10700 10800 10900 11000 11100 11200 11300 11400 11500 11600 11900 12000 12100 12200 12300 12400 12600 12800 12900 13000 13100 13200 13300 13400"
+HASH_TYPES="0 10 11 12 20 21 22 23 30 40 50 60 100 101 110 111 112 120 121 122 125 130 131 132 133 140 141 150 160 190 200 300 400 500 900 1000 1100 1400 1410 1420 1430 1440 1441 1450 1460 1500 1600 1700 1710 1711 1720 1722 1730 1731 1740 1750 1760 1800 2100 2400 2410 2500 2600 2611 2612 2711 2811 3000 3100 3200 3710 3711 3800 4300 4400 4500 4700 4800 4900 5000 5100 5300 5400 5500 5600 5700 5800 6000 6100 6300 6400 6500 6600 6700 6800 6900 7100 7200 7300 7400 7500 7600 7700 7800 7900 8000 8100 8200 8300 8400 8500 8600 8700 8900 9100 9200 9300 9400 9500 9600 9700 9800 9900 10000 10100 10200 10300 10400 10500 10600 10700 10800 10900 11000 11100 11200 11300 11400 11500 11600 11900 12000 12100 12200 12300 12400 12600 12800 12900 13000 13100 13200 13300 13400"
 
 #ATTACK_MODES="0 1 3 6 7"
 ATTACK_MODES="0 1 3 7"